Recursive Linear and Differential Cryptanalysis of Ultralightweight Authentication Protocols

Abstract

Abstract-Privacy is faced to serious challenges in the ubiquitous computing world. In order to handle this problem, some researches in recent years have focused on design and analysis of privacy friendly ultralightweight authentication protocols. In less than a decade, many ultralightweight authentication protocols are proposed. Though, successful crypanalyses are proposed for almost all of them, most of these attacks are based on ad-hoc methods that are not extensible to a large class of ultralightweight protocols. So this research area still suffers from the lack of structured cryptanalysis and evaluation methods. In this paper, we introduce new frameworks for full disclosure attacks on ultralightweight authentication protocols based on new concepts of recursive linear and recursive differential cryptanalysis. Both of them exploit triangular functions in ultralightweight protocols and recover all secret data stored in the tag in a recursive manner. The recursive linear attack is applied to Yeh et al. and SLMAP authentication protocols. This attack is passive, deterministic (i.e. the attacker can retrieve all the secrets with probability of one), and requires only a single authentication session. The recursive differential attack is more powerful and can be applied to the protocols which linear attack may not work on. We show the effectiveness of this attack on LMAP ++ and SASI authentication protocols. This differential attack is probabilistic, active in the sense that the attacker suffices only to block some specific messages, and requires a few authentication sessions.

RCIA: A New Ultralightweight RFID Authentication Protocol Using Recursive Hash

“…In [3,4,[8][9][10][11][12][13][14] ultralightweight authentication mutual protocols for RFID systems have been proposed with several variations in design and primitives but cryptanalysis performed in [5][6][7][19][20][21][22][23][24][25][26][27][28][29][30] highlighted the security loop holes and vulnerabilities in the abovementioned protocols. This raises the need of a new secure and robust ultralightweight mutual authentication protocol to combat against all types of malicious activities.…”

“…Hence in order to estimate the secret values for RCIA, other kinds of approximation should be considered. [28]. recursive linear cryptanalysis (RLC) also exploits the -functions and constructs the system of linear equations for each bit of the secret values (Keys and ID).…”

Comments on "Security Improvement of an RFID Security Protocol of ISO/IEC WD 29167-6"

“…Exploiting this weak property, ultra-lightweight protocols are broken to a greater or lesser degree [2]. On the other hand, the use of non-triangular operations -mainly rotations-difficult the protocol analysis but it does not guarantee its security [1]. In fact, in our proposed attack an adversary exploits the non-resistance of XOR operation against active attackers and the weak property of rotation operation against ones-word (X << N = X, when X = 0xF F..F and ∀ n ∈ Z+).…”

Desynchronization attack on RAPP ultralightweight authentication protocol

“…Since the introduction of this class by PerisLopez et al [1], [2], [3] all of the proposals put forward in this area such as SASI [4], Gossamer [5], LMAP ++ [6] and Yeh et al [7] have made use of the mentioned operations. The exclusive or wide use of T-functions in these protocols is widely criticized since it makes some successful cryptanalysis possible [8], [9] and [10].…”

“…Instead, the authors introduced a new data dependent permutation as an ultralightweight operation which is unbalanced and breaks the orders of the bits. In fact, one of the most important features of this operation is its completely non-triangular property which is highly recommended in [8].…”