1. R R FID Authentication : M inimizing Tag Computation CHES2006 Rump Session, Yokohama. Japan 2006. 10. 11. Ph.D. Jin Kwak Kyushu University, JAPAN jkwak@security.re.kr or jkwak@itslab.csce.kyushu-u.ac.jpjkwak@itslab.csce.kyushu-u.ac.jp

2. 2 Background - Definition of RFID RFID (Radio Frequency Identification) is data carrier technology that transmits information via signal in the radio frequency portion of the electromagnetic spectrum. [GS1 US] RFID - Radio Frequency Identification

3. 3 Limitation of Current RFID Storage Low-cost RFID tag has hundreds of bits-memory - EPC C0/0+, EPC Cl G1, EPC C1G2 tag has tens of bits R/W block - Philips’ UCODE EPC G2 tag has 512 bits of on chip memory Computation 5¢ RFID tag cannot implement - symmetric key cryptography - public key cryptography - hash operation - random number generation Security or Efficiency? Computation or Storage?

4. 4 Assumptions Limited successive tag queries The probability that an attacker can successively transmit a Query to targeted RFID tags in different locations before updating the RFID tags’ identification data is very low Limited interleaving The mobility of RFID tags and password mechanism restrict the attacker’s ability to perform attack

5. 5 Initial Set-up Process

6. 6 Authentication Process(1/2)

7. 7 Authentication Process(2/2) … Current Password New Password Item 1 (Made by Manufacturer 1) PW M1 PW R1 Item 2 (Made by Manufacturer 1) PW M1 PW R1 Item n (Made by Manufacturer k) PW Mk PW R1 Item n+1 (Made by Manufacturer k) PW Mk PW R1 … …

8. 8 Security Without PW, the attackers cannot obtain ID By assumptions, tracking probability is very low The attackers cannot use the clone without PW DoS is easily detected Week anonymity Strong anonymity Anti-counterfeiting Recognizability

9. 9 Efficiency RFID tag only perform XOR operations RFID tag needs under 300 bits memory Low computation Small storage

10. 10 Thanks … Please e-mail to jkwak@security.re.kr or jkwak@itslab.csce.kyushu-u.ac.jp jkwak@security.re.kr jkwak@itslab.csce.kyushu-u.ac.jp