Cryptanalysis of a novel authentication protocol conforming to EPC-C1G2 standard

Abstract

In 2006, the standard EPC Class-1 Generation-2 (EPC-C1G2) was ratified both by EPCglobal and ISO. This standard can be considered as a “universal” specification for low-cost RFID tags. Although it represents a great advance for the consolidation of RFID technology, it does not pay due attention to security and, as expected, its security level is very low. In 2007, Chien et al. published a mutual authentication protocol conforming to EPC-C1G2 which tried to correct all its security shortcomings. In this article, we point out various major security flaws in Chien et al.'s proposal. We show that none of the authentication protocol objectives are met. Unequivocal identification of tagged items is not guaranteed because of possible birthday attacks. Furthermore, an attacker can impersonate not only legitimate tags, but also the back-end database. The protocol does not provide forward security either. Location privacy is easily jeopardized by a straightforward tracking attack. Finally, we show how a successful auto-desynchronization (DoS attack) can be accomplished in the back-end database despite the security measures taken against it.

Introduction

RFID technology today is employed in a great number of applications. However, security aspects do not play an important role in the introduction of this promising technology. We should have learned from past errors such as those related to bluetooth or WiFi technology. However, the security level offered by commercial solutions is very low (e.g. Texas Instruments DST tags [4], Philips Mifare cards [14]). The two main problems related to RFID technology are privacy and tracking:

Privacy: Tag content, which may include sensitive information, is revealed when insecure tags are interrogated by readers. Tags and readers should be authenticated to correct this problem. However, readers are frequently not authenticated, and tags usually answer in a completely transparent way.

Tracking: A problem closely related to privacy is tracking, or violations of location privacy. Even if access of tag content were only allowed to authorized readers, tracking still might not be guaranteed. The answer provided by tags is usually a constant value (i.e. a static identifier). Under this assumption, an attacker will be able to establish an association between tags and its owners. Additionally, we can relax our conditions and assume that tags only contain product codes rather than a unique identifier. In spite of this, Weis et al. claims that tracking will still be possible by using an assembly of tags (a constellation) [29].

In addition to the previous threats, there are some other aspects that must be considered: eavesdropping, physical attacks, counterfeiting, active attacks, denial of service, etc. For depth in all these matters we recommend reading of [12], [21], [22] which provide surveys of the most important advances in RFID technology.

Each time a new protocol is defined, the class of tag for which the proposed protocol is appropriate should also be specified. In general terms, a tag contains a microchip with some computational and storage capabilities, and a coupling element, such as an antenna coil for communication. Tags can be classified according to two main criteria:

The type of memory: The memory element serves as writable and non-writable data storage. Tags can be programmed to be read-only, write-once read-many, or fully rewritable. Depending on the kind of tag, tag programming can take place at the manufacturing level or at the application level.

The source of power: A tag can obtain power from the signal received from the reader, or it can have its own internal power source. The way the tag gets its power generally defines the category of the tag: 1. Passive tags do not have internal source of power. They harvest their power from the reader that sends out electromagnetic waves. These kind of tags are restricted in their read/write range as they rely on RF electromagnetic energy from the reader for both power and communication. 2. Semi-passive tags use a battery to run the microchip's circuitry but communicate by harvesting power from the reader signal. 3. Active tags possess a power source that is used to run the microchip's circuitry and to broadcast a signal to the reader.

Another relevant parameter is tag price, in which we mainly distinguish between high-cost and low-cost RFID tags. We note that depending on the class of tag, the security level that can be supported will also be different. For example, the security level of a tag used in e-passports should not be the same as that of a low-cost tag employed in the supply chain (e.g. tags compliant to EPC Class-1 Generation-2 specification). To clarify the kind of systems we refer to as low-cost/high-cost RFID tags, Table 1 summarizes their specifications, these being relevant to current-commercial RFID tags.