Shanti Bramhacharya and Nick McCarty
Attacks and improvements to an RIFD mutual authentication
protocol and its extensions
This paper deals with the vulnerability of RFIDs
A Radio Frequency Identifier or RFID is a small device used to claim ownership and keep track of many things, including livestock, credit cards, luggage tags, and libraries, even your Hiram ID.
The entire system is comprised of the tags themselves, a reader whose type depends on the application of the tag, and a server.
Introduction
Since these devices need to operate rapidly and wirelessly they aren't very secure.
Some possible techniques of these attacks include interception, de-synchronization, impersonation, tracking, and replaying.
These techniques can result in a wide variety of issues ranging from denial of service to outright theft.
Problem
Song and Mitchell’s Mutual Authentication Protocol
Song’s Ownership Transfer Protocol
Previous Attempts
Reader sends a random bit string message to a tag
Tag uses its own hidden value (secret ti is how they refer to it in the paper) to compute two separate return strings.
These return strings (M1, M2) are computed in significantly different ways from one another but they both utilize Ti and the initial random string bit
SM Mutual Authentication
The value (M1, M2) is then sent to the reader
Reader sends along the message (r, M1, M2) to the database server with r being the reader’s randomly created string.
The Server then searches its database for a match and if it is found it tells the reader that yes the current tag is valid and sends all the information it has on it.
SM Continued
In addition, the server also creates a new message(M3) with the random number generator r2 that the tag used to create M1 and M2.
The reader then forwards M3 to the tag which uses the message to create a new secret ti so that each time a tag is identified it will mutate.
SM Continued
Comprised of two parts
Ownership Sharing ProtocolWorks the same as SM except for one thingWhen a server finds a match it sends the
confirm and new secret ti to two readers (Sj and Sj+1) so that two “owners” are updated.
Song’s Ownership Transfer
Secret Update ProtocolSj+1, in order to hide its identify from Sj, then
creates a new secret ti that it updates the previously (no longer) shared tag with.
Sj+1 still not anonymous because Sj could derive the new ti by eavesdropping.
Sj+1 needs to successfully identify the tag one more time after this in order to apply a ti that was created solely within its system
Song’s Continued
SMTag information privacyTag location privacyResistance to tag impersonation attackResistant to replay attackResistance to denial of service attackForward and backward securityResistance to server impersonation attackSongOld owner privacyNew owner privacyAuthorization recovery
Security Proterties
Attacks that work against SM and Song as they exist:Server Impersonation(SM)
User impersonates a server and gains information on both readers and tags
Tag Impersonation(SM)User impersonates a tag within a system and gains access to
the algorithms that generate ti, and a platform from which many other attacks may be launched.
De-Synchronization(Song)User intercepts the reader to server message of (r1, M1,
M2) so that it does not receive the message.It then impersonates reader and sends a fake (r1, M1, M2)
message so that the tags ti is updated to a value that will not be recognized by the server to which it rightfully belongs.
Specific Problems
The authors of this paper claim that the main security weaknesses in these protocols exist in their use of circular bit shifting, and xor gates.
SM SolutionM2 on the tag side utilizes a concatenation of
r1 and r2 rather than an xor gate.M2 on the server side utilizes a concatenation
of r1 and M1 rather than an xor gate.M3 uses an xor gate instead of a circular shift
of k bits
Solution
Song SolutionTakes place in the creation of a new ti by Sj+1
Rather than simply shifting bits to create a new server side M2, it uses a dynamic hash function
Instead of M2 on the tag side using a shift bit it uses an xor gate and the same hash function as prior.
Solution Continued
SM Revised SM
Secret Update
Revised SU
ServerTag
(k+1)F3F
(K+2)F4F
3F3F
4F4F
Findings
F denotes a computationally complex function such as hash and key hash
K denotes integer between 1 and 2NReducing hash tables to reduce cost increases
level of vulnerabilitiesInvestigation of lower bound remains
interesting
ProofTwo protocols with desired security propertiesVulnerable to series of active attacks
Proposed revised protocols to eliminate vulnerabilities without violation of any
other security propertiesWhose storage and computational requirements are
comparable to existing solutionsFuture workGive formal proof their proposed revised protocolFinding the lower bounds for tags computational
requirements for secure RFID communications
Level of Success