Practical attacks on a mutual authentication scheme under the EPC Class-1 Generation-2 standard

Abstract

The EPC Class-1 Generation-2 RFID standard provides little security, as has been shown in previous works such as [S. Karthikeyan, M. Nesterenko, RFID security without extensive cryptography, in: Proceedings of the 3rd ACM Workshop on Security of Ad Hoc and Sensor Networks, 2005, pp. 63–67; D.N. Duc, J. Park, H. Lee, K. Kim, Enhancing security of EPCglobal Gen-2 RFID tag against traceability and cloning, in: The 2006 Symposium on Cryptography and Information Security, 2006; H.Y. Chien, C.H. Chen, Mutual authentication protocol for RFID conforming to EPC Class 1 Generation 2 standards, Computer Standards & Interfaces 29 (2007) 254–259; P. Peris-Lopez, J.C. Hernandez-Castro, J.M. Estevez-Tapiador, A. Ribagorda, Cryptanalysis of a novel authentication protocol conforming to EPC-C1G2 standard, in: Proceedings of Int’l Conference on RFID Security (RFIDSec)’07, Jul 2007; T.L. Lim, T. Li, Addressing the weakness in a lightweight RFID tag-reader mutual authentication scheme, in Proceedings of the IEEE Int’l Global Telecommunications Conference (GLOBECOM) 2007, Nov 2007, pp. 59–63]. In particular, the security of an RFID tag’s access and kill passwords is almost non-existent. Konidala and Kim recently proposed a new mutual authentication scheme [D.M. Konidala, Z. Kim, K. Kim, A simple and cost-effective RFID tag-reader mutual authentication scheme, in: Proceedings of Int’l Conference on RFID Security (RFIDSec)’07, Jul 2007, pp. 141–152] – an improved version of their first attempt [D.M. Konidala, K. Kim, RFID tag-reader mutual authentication scheme utilizing tag’s access password, Auto-ID Labs White Paper WP-HARDWARE-033, Jan 2007] – in which a tag’s access and kill passwords are used for authentication. In this paper, we show that the new scheme continues to present serious security flaws. The 16 least significant bits of the access password can be obtained with probability $2^{-2}$, and the 16 most significant bits with a probability greater than $2^{-5}$. Finally, we show how an attacker can recover the entire kill password with probability $2^{-2}$.

Introduction

EPCglobal is an organization that develops standards for the electronic product code (EPC), as well as an RFID framework (the EPCglobal Architecture Framework [9]) that supports the use of EPC. Among the few standards that have been developed by EPCglobal is the EPC Class-1 Gen-2 standard (EPC-C1G2 for short) [10] that specifies the RFID communications protocol for ultra-high frequency (UHF) communication between 860 and 960 MHz. The standard specifies that a compliant RFID tag should contain two 32-bit secrets – the access password and the kill password. The access password is used to authenticate readers that wish to access information stored on the tag and controls access to the information. The kill password is used to disable the tag permanently. Once a tag has been ‘killed’, it is rendered in silence thereafter.

EPC-C1G2 standard additionally specifies a simple scheme that allows a tag to authenticate a reader. This attempts to protect the access password by using a simple form of masking prior to transmission. However, a passive eavesdropper monitoring the messages exchanged between reader and tag can acquire this sensitive information by simply computing an XOR operation [11]. Konidala and Kim exposed this weakness and proposed tag-reader mutual authentication scheme (TRMA) to protect the access password [8]. Unfortunately, their scheme was soon found to be vulnerable to a number of attacks that could reveal the access password [5]. Konidala and Kim therefore proposed a new improved scheme (TRMA⁺) in [7], which they claimed to be secure. However, under close scrutiny, we have found that there are still weaknesses in the scheme. We show how practical attacks can effectively disclose both the access and the kill passwords. This paper highlights the need for designers of security schemes to conduct stringent cryptanalysis in order to be sure that their schemes provide the necessary resilience to attacks.

Other approaches to RFID authentication that conform to the EPC-C1G2 standard have been proposed previously. An efficient tag identification and reader authentication protocol based on the use of XORs and matrix operations was proposed in [1]. Duc et al. proposed a tag-to-backend database authentication protocol in [2], which uses a 16-bit pseudo-random number generator (PRNG), cyclic redundancy checksum (CRC) and XOR operations. Chien and Chen examined both protocols and pointed out particular security flaws [3]. Correspondingly, they proposed a new scheme similar to that of Duc et al., but this later came under attack by Peris-Lopez et al. [4].