1. Attacks and Improvements to an RFID Mutual Authentication Protocol and its Extensions Shaoying Cai 1 Yingjiu Li 1 Tieyan Li 2 Robert H. Deng 1 1 Singapore Management University 2 Institute for Infocomm Research (I 2 R) March 16-18, 2009, Zurich, Switzerland Second ACM Conference on Wireless Network Security (WiSec ‘09)

2. Overall RFID Authentication Protocol for Low-Cost Tags B. Song and C. J. Mitchell (WiSec 08) RFID Tag Ownership Transfer B. Song (RFIDsec 08) Tag impersonation attack Server impersonation attack De-synchronization attack Song-Mitchell Protocol Song’s Secret Update Protocol

3. Outline RFID Background Attacks and Improvements to the Song–Mitchell Protocol Attacks and Improvements to the Song’s Secret Update Protocol Conclusions

4. Radio Frequency Identification System Components: Tag, Reader, Back-end database Characteristics : Wireless connection ( tag  reader ) Limited capability of the tags 100 meters TagReader Attacker Attacker Model: Active attacker Backend Server

5. Privacy and Security Concerns of Mutual Authentication Protocol Tag information privacy Tag location privacy Resistance to server\tag impersonation attack Resistance to replay attack Resistance to de-synchronization attack Forward and backward security

6. Privacy Concerns of Ownership Transfer New owner privacy Old owner privacy Authorization recovery

7. Song-Mitchell Mutual Authentication Protocol t i = h(s i ) Implicit tag authentication Identification Server authentication Update

8. Server Impersonation Attack r1r1 M 1, M 2 M3M3 M 1, M 3 r1’r1’ M 1 ’, M 2 ’ M3’M3’ Em, you are valid. I’m serve r Result ?

9. Result of Server Impersonation Attack r1r1 M 1, M 2 T i Search database, Search… Search…. But, [(s i,t i ) new, (s i,t i ) old ] Server [t’] Who are you? It’s me, T i …. I was changed by Attacker.

10. Tag Impersonation Attack r1’r1’ M 1 ’, M 2 ’ r1r1 M 1, M 2 M3M3 Yeah, you are T i. I’m serve r I’m tag T i TiTi Result ?

11. Vulnerability Analysis : >> : S >> l/2 = [S] R || [S] L

12. Modified Song-Mitchell Protocol

13. Song's secret update protocol t i  t i ’

14. De-Synchronization Attack r 1, M 1, M 2 r 2 ’, M 3 ’ T i r 1, M 1 ’, M 2 ’ Update T i ’s secret to t i ’ T i Updates to t i ’’

15. Modified Tag Update Protocol

16. Conclusions Song-Mitchell mutual authentication protocol Tag secret update protocol Server impersonation attack Tag impersonation attack De-synchronization attack

17. Discussion F denotes a computationally complex function such as hash and keyed hash, and k is an integer between 1 and 2N Performance Formal Proof Will be given in our future work.

18. Q & A?

19. Thank you! Shaoying Cai: sycai@smu.edu.sg