Attacks and improvements to an RIFD mutual authentication protocol and its extensions Shanti Bramhacharya and Nick McCarty Introduction This paper deals with the vulnerability of RFIDs A Radio Frequency Identifier or RFID is a small device used to claim ownership and keep track of many things including livestock credit cards luggage tags and libraries even your Hiram ID The entire system is comprised of the tags themselves a reader whose type depends on the application of the tag and a server Problem Since these devices need to operate rapidly and wirelessly they aren t very secure Some possible techniques of these attacks include interception de synchronization impersonation tracking and replaying These techniques can result in a wide variety of issues ranging from denial of service to outright theft Previous Attempts Song and Mitchell s Mutual Authentication Protocol Song s Ownership Transfer Protocol SM Mutual Authentication Reader sends a random bit string message to a tag Tag uses its own hidden value secret ti is how they refer to it in the paper to compute two separate return strings These return strings M1 M2 are computed in significantly different ways from one another but they both utilize Ti and the initial random string bit SM Continued The value M1 M2 is then sent to the reader Reader sends along the message r M1 M2 to the database server with r being the reader s randomly created string The Server then searches its database for a match and if it is found it tells the reader that yes the current tag is valid and sends all the information it has on it SM Continued In addition the server also creates a new message M3 with the random number generator r2 that the tag used to create M1 and M2 The reader then forwards M3 to the tag which uses the message to create a new secret ti so that each time a tag is identified it will mutate Song s Ownership Transfer Comprised of two parts Ownership Sharing Protocol Works the same as SM except for one thing When a server finds a match it sends the confirm and new secret ti to two readers Sj and Sj 1 so that two owners are updated Song s Continued Secret Update Protocol Sj 1 in order to hide its identify from Sj then creates a new secret ti that it updates the previously no longer shared tag with Sj 1 still not anonymous because Sj could derive the new ti by eavesdropping Sj 1 needs to successfully identify the tag one more time after this in order to apply a ti that was created solely within its system Security Proterties SM Tag information privacy Tag location privacy Resistance to tag impersonation attack Resistant to replay attack Resistance to denial of service attack Forward and backward security Resistance to server impersonation attack Song Old owner privacy New owner privacy Authorization recovery Specific Problems Attacks that work against SM and Song as they exist Server Impersonation SM User impersonates a server and gains information on both readers and tags Tag Impersonation SM User impersonates a tag within a system and gains access to the algorithms that generate ti and a platform from which many other attacks may be launched De Synchronization Song User intercepts the reader to server message of r1 M1 M2 so that it does not receive the message It then impersonates reader and sends a fake r1 M1 M2 message so that the tags ti is updated to a value that will not be recognized by the server to which it rightfully belongs Solution The authors of this paper claim that the main security weaknesses in these protocols exist in their use of circular bit shifting and xor gates SM Solution M2 on the tag side utilizes a concatenation of r1 and r2 rather than an xor gate M2 on the server side utilizes a concatenation of r1 and M1 rather than an xor gate M3 uses an xor gate instead of a circular shift of k bits Solution Continued Song Solution Takes place in the creation of a new ti by Sj 1 Rather than simply shifting bits to create a new server side M2 it uses a dynamic hash function Instead of M2 on the tag side using a shift bit it uses an xor gate and the same hash function as prior Findings Server Tag SM Revised SM Secret Update Revised SU k 1 F 3F K 2 F 4F 3F 3F 4F 4F F denotes a computationally complex function such as hash and key hash K denotes integer between 1 and 2N Reducing hash tables to reduce cost increases level of vulnerabilities Investigation of lower bound remains interesting Level of Success Proof Two protocols with desired security properties Vulnerable to series of active attacks Proposed revised protocols to eliminate vulnerabilities without violation of any other security properties Whose storage and computational requirements are comparable to existing solutions Future work Give formal proof their proposed revised protocol Finding the lower bounds for tags computational requirements for secure RFID communications