Security and privacy of RFID protocols

This thesis studies security and privacy issues of Radio Frequency Identification (RFID) technology that enhances ubiquitous computing environment. Privacy is one of main issues to adopt RFID technology in daily use. Due to resource constraints of low cost RFID tags in terms circuit size, power consumption and memory size, it is very restricted to design a private authentication protocol based on existing cryptographic functions. Therefore new private authentication protocols should be designed with lightweight cryptography primitives. In this thesis, we focus on low cost RFID tags. Our contributions are as follows. First, we analyze the security of recent RFID authentication protocols with respect to two security requirements: mutual authentication and availability. We propose impersonation and de-synchronization attacks against recent RFID authentication protocols. Secondly, we analyze the security of chaotic-map based RFID protocols. We propose secret disclosure, tracking, impersonation and de-synchronization attacks against these protocols. We propose revised protocols resistant to our proposed attacks. Finally, we study privacy and scalability issues in RFID. All previous RFID protocols giving the desired level of privacy required linear work in the back-end server. There are several PUF-based protocols which requires work logarithmic in the number of RFID tags in a system. We propose PUF-based scalable authentication protocols for RFID systems. They provide destructive privacy according to the Vaudenay's privacy and security model. They defend against compromising attack by using PUFs as a secure storage to keep secrets of the tag. To the best of our knowledge, they are the first to provide this level of privacy with constant identification time.