Attacks and improvements to an RIFD mutual authentication protocol and its extensions

1. Attacks and improvements to an RIFD mutual authentication protocol and its extensions ShantiBramhacharya and Nick McCarty

2. Introduction • This paper deals with the vulnerability of RFIDs • A Radio Frequency Identifier or RFID is a small device used to claim ownership and keep track of many things, including livestock, credit cards, luggage tags, and libraries, even your Hiram ID. • The entire system is comprised of the tags themselves, a reader whose type depends on the application of the tag, and a server.

3. Problem • Since these devices need to operate rapidly and wirelessly they aren't very secure. • Some possible techniques of these attacks include interception, de-synchronization, impersonation, tracking, and replaying. • These techniques can result in a wide variety of issues ranging from denial of service to outright theft.

4. Previous Attempts • Song and Mitchell’s Mutual Authentication Protocol • Song’s Ownership Transfer Protocol

5. SM Mutual Authentication • Reader sends a random bit string message to a tag • Tag uses its own hidden value (secret ti is how they refer to it in the paper) to compute two separate return strings. • These return strings (M1, M2) are computed in significantly different ways from one another but they both utilize Ti and the initial random string bit

6. SM Continued • The value (M1, M2) is then sent to the reader • Reader sends along the message (r, M1, M2) to the database server with r being the reader’s randomly created string. • The Server then searches its database for a match and if it is found it tells the reader that yes the current tag is valid and sends all the information it has on it.

7. SM Continued • In addition, the server also creates a new message(M3) with the random number generator r2 that the tag used to create M1 and M2. • The reader then forwards M3 to the tag which uses the message to create a new secret ti so that each time a tag is identified it will mutate.

10. Song’s Ownership Transfer • Comprised of two parts • Ownership Sharing Protocol • Works the same as SM except for one thing • When a server finds a match it sends the confirm and new secret ti to two readers (Sj and Sj+1) so that two “owners” are updated.

11. Song’s Continued • Secret Update Protocol • Sj+1, in order to hide its identify from Sj, then creates a new secret ti that it updates the previously (no longer) shared tag with. • Sj+1 still not anonymous because Sj could derive the new ti by eavesdropping. • Sj+1 needs to successfully identify the tag one more time after this in order to apply a ti that was created solely within its system

13. Security Proterties SM • Tag information privacy • Tag location privacy • Resistance to tag impersonation attack • Resistant to replay attack • Resistance to denial of service attack • Forward and backward security • Resistance to server impersonation attack Song • Old owner privacy • New owner privacy • Authorization recovery

14. Specific Problems • Attacks that work against SM and Song as they exist: • Server Impersonation(SM) • User impersonates a server and gains information on both readers and tags • Tag Impersonation(SM) • User impersonates a tag within a system and gains access to the algorithms that generate ti, and a platform from which many other attacks may be launched. • De-Synchronization(Song) • User intercepts the reader to server message of (r1, M1, M2) so that it does not receive the message. • It then impersonates reader and sends a fake (r1, M1, M2) message so that the tags ti is updated to a value that will not be recognized by the server to which it rightfully belongs.

15. Solution • The authors of this paper claim that the main security weaknesses in these protocols exist in their use of circular bit shifting, and xor gates. • SM Solution • M2 on the tag side utilizes a concatenation of r1 and r2 rather than an xor gate. • M2 on the server side utilizes a concatenation of r1 and M1 rather than an xor gate. • M3 uses an xor gate instead of a circular shift of k bits

16. Solution Continued • Song Solution • Takes place in the creation of a new ti by Sj+1 • Rather than simply shifting bits to create a new server side M2, it uses a dynamic hash function • Instead of M2 on the tag side using a shift bit it uses an xor gate and the same hash function as prior.

17. Findings • F denotes a computationally complex function such as hash and key hash • K denotes integer between 1 and 2N • Reducing hash tables to reduce cost increases level of vulnerabilities • Investigation of lower bound remains interesting

18. Level of Success Proof • Two protocols with desired security properties • Vulnerable to series of active attacks Proposed revised protocols • to eliminate vulnerabilities without violation of any other security properties • Whose storage and computational requirements are comparable to existing solutions Future work • Give formal proof their proposed revised protocol • Finding the lower bounds for tags computational requirements for secure RFID communications