[Paper Review] Security Flaws in a Recent Ultralightweight RFID Protocol

Pedro Peris‐Lopez, Julio Hernández-Castro+2 more|ArXiv.org|Oct 12, 2009

RFID technology advancementsEngineering17 references21 citations

TL;DR

This paper cryptanalyzes Lee et al.'s recent ultralightweight RFID mutual authentication protocol (UMA-RFID), demonstrating it is vulnerable to multiple critical attacks including traceability, full disclosure, cloning, and desynchronization. Despite using bitwise XOR, OR, AND, and rotation operations, the protocol fails to achieve essential security properties due to weaknesses in its message composition and lack of resistance to active manipulation of channel messages.

ABSTRACT

In 2006, Peris-Lopez et al. [1, 2, 3] initiated the design of ultralightweight RFID protocols -with the UMAP family of protocols- involving only simple bitwise logical or arithmetic operations such as bitwise XOR, OR, AND, and addition. This combination of operations was revealed later to be insufficient for security. Then, Chien et al. proposed the SASI protocol [4] with the aim of offering better security, by adding the bitwise rotation to the set of supported operations. The SASI protocol represented a milestone in the design of ultralightweight protocols, although certain attacks have been published against this scheme [5, 6, 7]. In 2008, a new protocol, named Gossamer [8], was proposed that can be considered a further development of both the UMAP family and SASI. Although no attacks have been published against Gossamer, Lee et al. [9] have recently published an alternative scheme that is highly reminiscent of SASI. In this paper, we show that Lee et al.'s scheme fails short of many of its security objectives, being vulnerable to several important attacks like traceability, full disclosure, cloning and desynchronization.

Motivation & Objective

• To evaluate the security of Lee et al.'s UMA-RFID protocol, a recently proposed ultralightweight RFID mutual authentication scheme.
• To identify and demonstrate practical attacks that compromise core security properties such as privacy, integrity, and synchronization.
• To show that the inclusion of rotation operations alone is insufficient to prevent cryptanalytic breakthroughs in ultralightweight RFID protocols.

Proposed method

• The adversary eavesdrops on a legitimate authentication session to capture {IDTn, An, Bn, Cn} messages.
• The attacker manipulates the captured messages by applying XOR operations with constant values C1 and C2, where C1 has a Hamming weight of exactly 2.
• The attacker sends modified messages An+1 = An ⊕ C1 and Bn+1 = Bn ⊕ C2 to the tag to trigger a new authentication and update phase.
• By exploiting the tag’s dual storage of old and new secret values, the attacker causes the tag to update its state while the reader remains unsynchronized.
• The attack succeeds with high probability due to the statistical likelihood that the Hamming weight of Nn ⊕ C1 remains unchanged after two-bit flips.
• The attacker iteratively tests different C2 values with Hamming weight 2, requiring only ~8,128 attempts on average due to the constrained search space.

Experimental results

Research questions

• RQ1 Can a passive adversary desynchronize a tag and reader pair in the UMA-RFID protocol using only message replay and manipulation?
• RQ2 Does the use of rotation operations in UMA-RFID prevent identity disclosure or traceability attacks?
• RQ3 Is the protocol resilient to cloning attacks when the adversary can manipulate authentication messages?
• RQ4 What is the probability of success for an active attack that alters the challenge-response messages using XOR with low-Hamming-weight constants?
• RQ5 Can the protocol’s design be exploited to cause irreversible state desynchronization without knowledge of the secret key?

Key findings

• The UMA-RFID protocol is vulnerable to a desynchronization attack where an adversary can manipulate messages An and Bn using XOR with constants of Hamming weight 2, causing the tag to update its state while the reader remains unsynchronized.
• The attack succeeds with a high probability because flipping two bits in a uniformly random vector like Nn preserves its Hamming weight with a 50% chance.
• The average number of required attempts to find a valid C2 value is approximately 8,128, which is negligible compared to the full 2^128 search space.
• The protocol fails to prevent traceability, as an adversary can track tags by observing and replaying messages across sessions.
• The protocol is also vulnerable to full disclosure and cloning attacks due to the lack of forward secrecy and weak message integrity.
• Despite using rotation operations, the protocol does not achieve resistance to active attacks, demonstrating that operation composition alone does not guarantee security in ultralightweight RFID systems.