Reducing Time Complexity in RFID Systems

Abstract

Abstract. Radio frequency identification systems based on low-cost computing devices is the new plaything that every company would like to adopt. Its goal can be either to improve the productivity or to strengthen the security. Specific identification protocols based on symmetric challengeresponse have been developed in order to assure the privacy of the device bearers. Although these protocols fit the devices' constraints, they always suffer from a large time complexity. Existing protocols require O(n) cryptographic operations to identify one device among n. Molnar and Wagner suggested a method to reduce this complexity to O(log n). We show that their technique could degrade the privacy if the attacker has the possibility to tamper with at least one device. Because low-cost devices are not tamper-resistant, such an attack could be feasible. We give a detailed analysis of their protocol and evaluate the threat. Next, we extend an approach based on time-memory trade-offs whose goal is to improve Ohkubo, Suzuki, and Kinoshita's protocol. We show that in practice this approach reaches the same performances as Molnar and Wagner's method, without degrading privacy.

Improved Anonymity for Key-Trees

“…The trade-off that exists between efficiency and security in tree-based protocols was already pointed out by Avoine [1], with respect to Molnar's original trees. Because tags share their partial keys, if one tag is compromised (i.e.…”

“…Examples are OSK (by Ohkubo, Suzuki and Kinoshita in [14]) and Yeo's protocol [16]. In [1], Avoine et al suggest applying time-memory trade-offs (based on Hellmann tables [9]) to hash-chain protocols (namely OSK and an improved version thereof). In [2] they extend this trade-off with socalled rainbow tables and checkpoints to further improve efficiency.…”

“…This expected size of the anonymity set that a randomly selected member will belong to, is denoted S. One could also view it as the average anonymity set size over all tags, as shown in (1). Note thatS can be computed for any given scenario where a tree is broken into anonymity sets.…”

Lightweight Privacy Preserving Authentication for RFID Using a Stream Cipher

“…A paradigmatic example of an RFID identification protocol providing some forward privacy is the OSK scheme [39,40] which relies on the use by the tag of two one-way hash functions. 1 Variants of the OSK scheme turning it into a forward private authentication protocol have been proposed in [5], thus making it resistant to replay attacks. 2 It was however noticed that the OSK protocol and its authentication variants are vulnerable to Denial of Service attacks (DoS) that desynchronize a tag from the system.…”

Optimal Key-Trees for Tree-Based Private Authentication

“…The problem of the above described tree-based approach is that upper level keys in the tree are used by many members, and therefore, if a member is compromised and its keys become known to the adversary, then the adversary gains partial knowledge of the key of other members too [1]. This obviously reduces the privacy provided by the system to its members, since by observing the authentication of an uncompromised member, the adversary can recognize the usage of some compromised keys, and therefore its uncertainty regarding the identity of the authenticating member is reduced (it may be able to determine which subtree the member belongs to).…”