Cryptanalysis of R2AP an Ultralightweight Authentication Protocol for RFID

Abstract

<strong>Background and Objectives:</strong> To overcome the security flaw of RAPP authentication protocol, Zhuang et al. proposed a novel ultralightweight RFID mutual authentication protocol, called R²AP. In this paper, we first propose a new desynchronization attack against this protocol.<br /> <strong>Methods:</strong> To extract the secret ID, linear cryptanalysis is used, which is a tool mostly for attack block ciphers.<br /> <strong>Results: </strong>Our proposed desynchronization attack succeeds with the probability almost 1 and requires an adversary to initiate 1829 sessions of the protocol with the tag. On the other hand, the protocol updates the tag and the reader secretes to provide the tag holder privacy. However, it is shown that a passive adversary who eavesdrops only two sessions of the protocol can trace the tag with the probability of 0.921. In addition, passive attack for which the adversary can extract the secret ID of the tag is presented assuming that the adversary eavesdropped 128 sessions of the protocol, its success probability would be 0.387.<br /> <strong>Conclusion:</strong> It was shown that R²AP suffers from desynchronization, traceability, and disclosure attacks, where the two later attacks work in passive adversary model.