Privacy of recent RFID authentication protocols

Khaled Ouafi; Raphael C.W. Phan

doi:10.1007/978-3-540-79104-1_19

Privacy of recent RFID authentication protocols

Khaled Ouafi, Raphael C.W. Phan

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research › peer-review

78 Citations (Scopus)

Abstract

Privacy is a major concern in RFID systems, especially with widespread deployment of wireless-enabled interconnected personal devices e.g. PDAs and mobile phones, credit cards, e-passports, even clothing and tires. An RFID authentication protocol should not only allow a legitimate reader to authenticate a tag but it should also protect the privacy of the tag against unauthorized tracing: an adversary should not be able to get any useful information about the tag for tracking or discovering the tag's identity. In this paper, we analyze the privacy of some recently proposed RFID authentication protocols (2006 and 2007) and show attacks on them that compromise their privacy. Our attacks consider the simplest adversaries that do not corrupt nor open the tags. We describe our attacks against a general untraceability model; from experience we view this endeavour as a good practice to keep in mind when designing and analyzing security protocols.

Original language	English
Title of host publication	Information Security Practice and Experience - 4th International Conference, ISPEC 2008, Proceedings
Pages	263-277
Number of pages	15
DOIs	https://doi.org/10.1007/978-3-540-79104-1_19
Publication status	Published - 2008
Externally published	Yes
Event	Information Security Practice and Experience Conference 2008 - Sydney, Australia Duration: 21 Apr 2008 → 23 Apr 2008 Conference number: 4th https://link.springer.com/book/10.1007/978-3-540-79104-1 (Proceedings)

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	4991 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	Information Security Practice and Experience Conference 2008
Abbreviated title	ISPEC 2008
Country/Territory	Australia
City	Sydney
Period	21/04/08 → 23/04/08
Internet address	https://link.springer.com/book/10.1007/978-3-540-79104-1 (Proceedings)

Keywords

Authentication protocols
Privacy
Provably secure
RFID
Untraceability

Access to Document

10.1007/978-3-540-79104-1_19

Cite this

Ouafi, K., & Phan, R. C. W. (2008). Privacy of recent RFID authentication protocols. In Information Security Practice and Experience - 4th International Conference, ISPEC 2008, Proceedings (pp. 263-277). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 4991 LNCS). https://doi.org/10.1007/978-3-540-79104-1_19

@inproceedings{8696afce5cba4745bcf908bf0154c6fc,

title = "Privacy of recent RFID authentication protocols",

abstract = "Privacy is a major concern in RFID systems, especially with widespread deployment of wireless-enabled interconnected personal devices e.g. PDAs and mobile phones, credit cards, e-passports, even clothing and tires. An RFID authentication protocol should not only allow a legitimate reader to authenticate a tag but it should also protect the privacy of the tag against unauthorized tracing: an adversary should not be able to get any useful information about the tag for tracking or discovering the tag's identity. In this paper, we analyze the privacy of some recently proposed RFID authentication protocols (2006 and 2007) and show attacks on them that compromise their privacy. Our attacks consider the simplest adversaries that do not corrupt nor open the tags. We describe our attacks against a general untraceability model; from experience we view this endeavour as a good practice to keep in mind when designing and analyzing security protocols.",

keywords = "Authentication protocols, Privacy, Provably secure, RFID, Untraceability",

author = "Khaled Ouafi and Phan, {Raphael C.W.}",

year = "2008",

doi = "10.1007/978-3-540-79104-1_19",

language = "English",

isbn = "3540791035",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

pages = "263--277",

booktitle = "Information Security Practice and Experience - 4th International Conference, ISPEC 2008, Proceedings",

url = "https://link.springer.com/book/10.1007/978-3-540-79104-1",

}

Ouafi, K & Phan, RCW 2008, Privacy of recent RFID authentication protocols. in Information Security Practice and Experience - 4th International Conference, ISPEC 2008, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 4991 LNCS, pp. 263-277, Information Security Practice and Experience Conference 2008, Sydney, New South Wales, Australia, 21/04/08. https://doi.org/10.1007/978-3-540-79104-1_19

Privacy of recent RFID authentication protocols. / Ouafi, Khaled; Phan, Raphael C.W.
Information Security Practice and Experience - 4th International Conference, ISPEC 2008, Proceedings. 2008. p. 263-277 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 4991 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research › peer-review

TY - GEN

T1 - Privacy of recent RFID authentication protocols

AU - Ouafi, Khaled

AU - Phan, Raphael C.W.

N1 - Conference code: 4th

PY - 2008

Y1 - 2008

N2 - Privacy is a major concern in RFID systems, especially with widespread deployment of wireless-enabled interconnected personal devices e.g. PDAs and mobile phones, credit cards, e-passports, even clothing and tires. An RFID authentication protocol should not only allow a legitimate reader to authenticate a tag but it should also protect the privacy of the tag against unauthorized tracing: an adversary should not be able to get any useful information about the tag for tracking or discovering the tag's identity. In this paper, we analyze the privacy of some recently proposed RFID authentication protocols (2006 and 2007) and show attacks on them that compromise their privacy. Our attacks consider the simplest adversaries that do not corrupt nor open the tags. We describe our attacks against a general untraceability model; from experience we view this endeavour as a good practice to keep in mind when designing and analyzing security protocols.

AB - Privacy is a major concern in RFID systems, especially with widespread deployment of wireless-enabled interconnected personal devices e.g. PDAs and mobile phones, credit cards, e-passports, even clothing and tires. An RFID authentication protocol should not only allow a legitimate reader to authenticate a tag but it should also protect the privacy of the tag against unauthorized tracing: an adversary should not be able to get any useful information about the tag for tracking or discovering the tag's identity. In this paper, we analyze the privacy of some recently proposed RFID authentication protocols (2006 and 2007) and show attacks on them that compromise their privacy. Our attacks consider the simplest adversaries that do not corrupt nor open the tags. We describe our attacks against a general untraceability model; from experience we view this endeavour as a good practice to keep in mind when designing and analyzing security protocols.

KW - Authentication protocols

KW - Privacy

KW - Provably secure

KW - RFID

KW - Untraceability

UR - http://www.scopus.com/inward/record.url?scp=41549161615&partnerID=8YFLogxK

U2 - 10.1007/978-3-540-79104-1_19

DO - 10.1007/978-3-540-79104-1_19

M3 - Conference Paper

AN - SCOPUS:41549161615

SN - 3540791035

SN - 9783540791034

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 263

EP - 277

BT - Information Security Practice and Experience - 4th International Conference, ISPEC 2008, Proceedings

T2 - Information Security Practice and Experience Conference 2008

Y2 - 21 April 2008 through 23 April 2008

ER -

Privacy of recent RFID authentication protocols

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Cite this