On The Untraceability of
Anonymous RFID
Authentication Protocol with
Constant Key-Lookup
Presented By Professor LI Yingjiu
Outline
• Background
• Review the BMM protocol in AsiaCCS’08
• Crack the Protocol by three-run interleave
attack
• Crack the supply chain based on our
attack
• Improve the BMM protocol
• Conclusion
2
Background
• It is still a challenge to balance the security
and scalability.
• For example,
– The OSK protocol needs O(N) hash
calculation.
– Numerous protocols based on tree-structure
suffers from de-synchronization attack and
compromising attack.
• It is emergent to setup a protocol
balancing both the security and scalability.
3
BMM protocol in AsiaCCS’08
• Burmester, Medeiros and Motta (BMM)
proposed an RFID authentication protocol
with constant key-lookup to balance the
security requirement and scalability.
• The protocol is based on challengeresponse technique.
• Guarantee spoofing attack, replay attack,
de-synchronization attack, etc..
4
Overview of BMM Protocol
5
Initiate System
6
Mutual Authentication
• Tag
Reader
7
Update Process
• Tag
Reader
8
Three-run Interleave Attack
• This attack can trace the same tag by
‘ps=r’.
• The reason is updating ‘ps’
inappropriately.
• Include three steps.
9
Three-run Interleave Attack---Run 1
10
Three-run Interleave Attack---Run 2
Not Update ‘r’
11
Three-run Interleave Attack---Run 3
12
Discussion
• Note that in the third run, a different
challenge c’’ could be used by a trusted
reader to challenge the tag. As long as the
‘r’ value is not updated in the second run,
the ‘ps’ value is still the same as the one in
the first run.
13
Crack the Whole Supply Chain
• Three assumptions:
– Trusted zone
– One-time authentication
– Sticky adversary
• Two attack strategies:
– Trace a single tag
– Trace multiple tags
14
Crack a Supply Chain System Based
on BMM Protocol
15
Trace a Single Tag
16
Trace Multiple Tags
• Adversary’s database for tracing multiple
tags
17
Improve BMM Protocol
18
Conclusion
• Under a weak adversary model, an
attacker can launch a three-run interleave
attack to trace and identify a tag.
• Attackers can crack the whole supply
chain using BMM protocol.
• We improve BMM protocol to prevent tags
from tracing.
• The improved Protocol is same efficient as
BMM protocol.
19
20