Abstract
Recently, Alomair et al. proposed the first UnConditionally Secure mutual authentication protocol for low-cost RFID systems(UCS-RFID). The security of the UCS-RFID relies on five dynamic secret keys which are updated at every protocol run using a fresh random number (nonce) secretly transmitted from a reader to tags.
Our results show that, at the highest security level of the protocol (security parameter= 256), inferring a nonce is feasible with the probability of 0.99 by eavesdropping(observing) about 90 runs of the protocol. Finding a nonce enables a passive attacker to recover all five secret keys of the protocol. To do so, we propose a three-phase probabilistic approach in this paper. Our attack recovers the secret keys with a probability that increases by accessing more protocol runs. We also show that tracing a tag using this protocol is also possible even with less runs of the protocol.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Hopper, N.J., Blum, M.: Secure Human Identification Protocols. In: Boyd, C. (ed.) ASIACRYPT 2001. LNCS, vol. 2248, pp. 52–66. Springer, Heidelberg (2001)
Bringer, J., Chabanne, H., Dottax, E.: HB++: a Lightweight Authentication Protocol Secure Against Some Attacks. In: IEEE International Conference on Pervasive Services, Workshop on Security, Privacy and Trust in Pervasive and Ubiquitous Computing SecPerU (2006)
Bringer, J., Chabanne, H.: Trusted-HB: a low-cost version of HB+ secure against man-in-the-middle attacks. CoRR, abs/0802.0603 (2008)
Bringer, J., Chabanne, H., Dottax, E.: HB++: a lightweight authentication protocol secure against some attacks. In: Second International Workshop on Security, Privacy and Trust in Pervasive and Ubiquitous Computing (SecPerU 2006), pp. 28–33. IEEE Computer Society, Los Alamitos (2006)
Duc, D.N., Kim, K.: Securing HB+ against GRS man-in-the-middle attack. In: Institute of Electronics, Information and Communication Engineers, Symposium on Cryptography and Information Security, Sasebo, Japan, January 23-26, p. 123 (2007)
Gilbert, H., Robshaw, M.J.B., Seurin, Y.: HB\(\sharp\): Increasing the security and effciency of HB+. In: Smart, N.P. (ed.) EUROCRYPT 2008. LNCS, vol. 4965, pp. 361–378. Springer, Heidelberg (2008)
Munilla, J., Peinado, A.: HB-MP: A further step in the HB-family of lightweight authentication protocols. Computer Networks (2007)
Madhavan, M., Thangaraj, A., Sankarasubramaniam, Y., Viswanathan, K.: NLHB: A Non-Linear Hopper Blum Protocol. In: IEEE National Conference on Communications (NCC) 2010, CoRR abs/1001.2140 (2010)
Peris-Lopez, P., Hernandez-Castro, J.C., Estevez Tapiador, J., Ribagorda, A.: LMAP: A Real Lightweight Mutual Authentication Protocol for Low-cost RFID tags. In: RFIDSec 2006 (2006)
Peris-Lopez, P., Hernandez-Castro, J.C., Estevez-Tapiador, J., Ribagorda, A.: M2AP: A minimalist mutual-authentication protocol for low-cost RFID tags. In: Ma, J., Jin, H., Yang, L.T., Tsai, J.J.-P. (eds.) UIC 2006. LNCS, vol. 4159, pp. 912–923. Springer, Heidelberg (2006)
Peris-Lopez, P., Hernandez-Castro, J.C., Estevez-Tapiador, J., Ribagorda, A.: EMAP: An Efficient Mutual-Authentication Protocol for Low-cost RFID tags. In: OTM Federated Conferences and Workshop: IS Workshop (2006)
Avoine, G.: Adversarial Model for Radio Frequency Identification. Cryptology ePrint Archive, Report 2005/049 (2005)
Ohkubo, M., Suzuki, K., Kinoshita, S.: Cryptographic Approach to Privacy-Friendly Tags. In: RFID Privacy Workshop (2003)
Henrici, D., Muller, P.: Hash-based Enhancement of Location Privacy for Radio Frequency Identification Devices using Varying Identifiers. In: Proceedings of PerSec 2004, IEEE PerCom, pp. 149–153 (2004)
Henrici, D., Muller, P.: Providing Security and Privacy in RFID Systems Using Triggered Hash Chains. In: PerCom 2008, pp. 50–59 (2008)
Kulseng, L.S.: Lightweight Mutual Authentication, Owner Transfer, and Secure Search Protocols for RFID Systems, Master Thesis, Iowa State University, Ames (2009)
Alomair, B., Lazos, L., Poovendran, R.: Securing Low-cost RFID Systems: an Unconditionally Secure Approach. In: RFIDsec 2010, Asia, Singapore (2010)
Feller, W.: An Introduction to Probability Theory and its Applications. Wiley India Pvt. Ltd, Chichester (2008)
Heydt-Benjamin, T.S., Bailey, D.V., Fu, K., Juels, A., O’Hare, T.: Vulnerabilities in first-generation RFID-enabled credit cards. In: Dietrich, S., Dhamija, R. (eds.) FC 2007 and USEC 2007. LNCS, vol. 4886, pp. 2–14. Springer, Heidelberg (2007)
Carluccio, D., Lemke, K., Paar, C.: E-passport: The global traceability or how to feel like a UPS package. In: Lee, J.K., Yi, O., Yung, M. (eds.) WISA 2006. LNCS, vol. 4298, pp. 391–404. Springer, Heidelberg (2007)
Hoepman, J.-H., Hubbers, E., Jacobs, B., Oostdijk, M., Schreur, R.W.: Crossing borders: Security and privacy issues of the european e-passport. In: Yoshiura, H., Sakurai, K., Rannenberg, K., Murayama, Y., Kawamura, S.-i. (eds.) IWSEC 2006. LNCS, vol. 4266, pp. 152–167. Springer, Heidelberg (2006)
CASPIAN, Boycott Benetton (2007), http://www.boycottbenetton.com
Mitsubishi Electric Asia Switches on RFID (2006), http://www.rfidjournal.com/article/articleview/2644/
Target, Wal-Mart Share EPC Data (2005), http://www.rfidjournal.com/article/articleview/642/1/1/
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Sohizadeh Abyaneh, M.R. (2011). Passive Cryptanalysis of the UnConditionally Secure Authentication Protocol for RFID Systems. In: Rhee, KH., Nyang, D. (eds) Information Security and Cryptology - ICISC 2010. ICISC 2010. Lecture Notes in Computer Science, vol 6829. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-24209-0_6
Download citation
DOI: https://doi.org/10.1007/978-3-642-24209-0_6
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-24208-3
Online ISBN: 978-3-642-24209-0
eBook Packages: Computer ScienceComputer Science (R0)