Shanti Bramhacharya and Nick McCarty

Attacks and improvements to an RIFD mutual authentication

protocol and its extensions

This paper deals with the vulnerability of RFIDs

A Radio Frequency Identifier or RFID is a small device used to claim ownership and keep track of many things, including livestock, credit cards, luggage tags, and libraries, even your Hiram ID.

The entire system is comprised of the tags themselves, a reader whose type depends on the application of the tag, and a server.

Introduction

Since these devices need to operate rapidly and wirelessly they aren't very secure.

Some possible techniques of these attacks include interception, de-synchronization, impersonation, tracking, and replaying.

These techniques can result in a wide variety of issues ranging from denial of service to outright theft.

Problem

Song and Mitchell’s Mutual Authentication Protocol

Song’s Ownership Transfer Protocol

Previous Attempts

Reader sends a random bit string message to a tag

Tag uses its own hidden value (secret ti is how they refer to it in the paper) to compute two separate return strings.

These return strings (M1, M2) are computed in significantly different ways from one another but they both utilize Ti and the initial random string bit

SM Mutual Authentication

The value (M1, M2) is then sent to the reader

Reader sends along the message (r, M1, M2) to the database server with r being the reader’s randomly created string.

The Server then searches its database for a match and if it is found it tells the reader that yes the current tag is valid and sends all the information it has on it.

SM Continued

In addition, the server also creates a new message(M3) with the random number generator r2 that the tag used to create M1 and M2.

The reader then forwards M3 to the tag which uses the message to create a new secret ti so that each time a tag is identified it will mutate.

SM Continued

Comprised of two parts

Ownership Sharing ProtocolWorks the same as SM except for one thingWhen a server finds a match it sends the

confirm and new secret ti to two readers (Sj and Sj+1) so that two “owners” are updated.

Song’s Ownership Transfer

Secret Update ProtocolSj+1, in order to hide its identify from Sj, then

creates a new secret ti that it updates the previously (no longer) shared tag with.

Sj+1 still not anonymous because Sj could derive the new ti by eavesdropping.

Sj+1 needs to successfully identify the tag one more time after this in order to apply a ti that was created solely within its system

Song’s Continued

SMTag information privacyTag location privacyResistance to tag impersonation attackResistant to replay attackResistance to denial of service attackForward and backward securityResistance to server impersonation attackSongOld owner privacyNew owner privacyAuthorization recovery

Security Proterties

Attacks that work against SM and Song as they exist:Server Impersonation(SM)

User impersonates a server and gains information on both readers and tags

Tag Impersonation(SM)User impersonates a tag within a system and gains access to

the algorithms that generate ti, and a platform from which many other attacks may be launched.

De-Synchronization(Song)User intercepts the reader to server message of (r1, M1,

M2) so that it does not receive the message.It then impersonates reader and sends a fake (r1, M1, M2)

message so that the tags ti is updated to a value that will not be recognized by the server to which it rightfully belongs.

Specific Problems

The authors of this paper claim that the main security weaknesses in these protocols exist in their use of circular bit shifting, and xor gates.

SM SolutionM2 on the tag side utilizes a concatenation of

r1 and r2 rather than an xor gate.M2 on the server side utilizes a concatenation

of r1 and M1 rather than an xor gate.M3 uses an xor gate instead of a circular shift

of k bits

Solution

Song SolutionTakes place in the creation of a new ti by Sj+1

Rather than simply shifting bits to create a new server side M2, it uses a dynamic hash function

Instead of M2 on the tag side using a shift bit it uses an xor gate and the same hash function as prior.

Solution Continued

SM Revised SM

Secret Update

Revised SU

ServerTag

(k+1)F3F

(K+2)F4F

3F3F

4F4F

Findings

F denotes a computationally complex function such as hash and key hash

K denotes integer between 1 and 2NReducing hash tables to reduce cost increases

level of vulnerabilitiesInvestigation of lower bound remains

interesting

ProofTwo protocols with desired security propertiesVulnerable to series of active attacks

Proposed revised protocols to eliminate vulnerabilities without violation of any

other security propertiesWhose storage and computational requirements are

comparable to existing solutionsFuture workGive formal proof their proposed revised protocolFinding the lower bounds for tags computational

requirements for secure RFID communications

Level of Success