Cryptanalysis of two recently proposed ultralightweight authentication protocol for IoT
Masoumeh Safkhani Nasour Bagheri
cs.CR















































































basicstyle=,
mathescape







preDefinitionDefinition

Definition .






















assumptionAssumption













 
 Computer Engineering Department, Shahid Rajaee Teacher Training University, Tehran, Iran, Postal code: 16788-15811, Tel/fax:+98-21-22970117, Safkhani@srttu.edu
Electrical Engineering Department, Shahid Rajaee Teacher Training University, Tehran, Iran, NBagheri@srttu.edu

M. Safkhani, Y. Bendavid, S.   Rostampour, N. Bagheri



Cryptanalysis of two recently proposed ultralightweight authentication protocol for IoT
    Masoumeh Safkhani1,  Nasour Bagheri2
    December 30, 2023
=======================================================================================




By expanding the connection of objects to the Internet and their entry to human life, the issue of security and privacy has become important. In order to enhance security and privacy on the Internet, many security protocols have been developed. Unfortunately, the security analyzes that have been carried out on these protocols show that they are vulnerable to one or few attacks, which eliminates the use of these protocols. Therefore, the need for a security protocol on the Internet of Things (IoT) has not yet been resolved.

Recently, Khor and Sidorov cryptanalyzed the Wang et al.  protocol and presented an improved version of it. In this paper, at first, we show that this protocol also does not have sufficient security and so it is not recommended to be used in any application. More precisely, we present a full secret disclosure attack against this protocol, which extracted the whole secrets of the protocol by two communication with the target tag. 

In addition, Sidorv et al. recently proposed an ultralightweight mutual authentication RFID protocol for blockchain enabled supply chains, supported by formal and informal security proofs. However, we present a full secret disclosure attack against this protocol as well. 




Internet of Things (IoT), Authentication, Secret Disclosure Attack. 




§ INTRODUCTION
 

Internet of Things (IoT) can be used to control all devices through an Internet connection. IoT covers a wide range of applications at large and small scale. One of the solutions for implementing the IoT is the use of Radio Frequency Identification (RFID) which allows the connection of various objects via the Internet.

Internet technology uses objects in a variety of contexts and, given the availability of security and privacy, has the ability to make things easy for humans.
One of the most fascinating things about the IoT is its ability to smart homes, smart cities, use it in wearable gadgets and also use it in cars. Wearable gadgets include a series of sensors and use special software to collect their users' data; these gadgets ultimately analyze aggregated data such as health, fitness, and the like, and report the results to the user. The IoT can also make cars, with the help of special sensors and of course the Internet, both increase their safety and the optimal performance of internal components and passengers' safety.

One of the main issues that has always been raised about the IoT is its security issue. Since this technology connects a lot of devices through the Internet, hacking them can have irreparable losses, such as losing sensitive personal and economic information. One reason for this is that either security protocols have not been used to secure IoT or that protocols have not been adequately secured. Therefore, a researchers' challenge in this field is to ensure users' privacy and the confidentially of their information by developing suitable software and hardware, to be used in Internet-based products. On the other hand, the use of security mechanisms is one of the main prerequisites for protecting the privacy and confidentiality of a variety of applications, and IoT is not an exception.



 §.§ Related Work and Motivation
 

A factor that can help expand the IoT is to create confidence for users of this technology in terms of maintaining their privacy and security, because if there is no proper security in its infrastructure, damage to IoT-based equipment, the possibility of losing personal information, the loss of privacy, and even the disclosure of economic and other data, are highly likely, and this may lead to the inability to use it in critical applications.  Ronen and Shamir in <cit.> pointed out that if security is not taken into account in the IoT-based infrastructure, the technology will threaten the future of the world as a nuclear bomb.

Reviewing the proposed mechanisms and designing new models that are compatible with IoT-based devices are also very important. Given that an IoT system can include many objects with limited resources, it requires special protocols to ensure that privacy and security are guaranteed. Therefore, with the further development of IoT, its security concerns are expected to receive more attention. So far, several security protocols have been proposed to ensure IoT security, e.g. <cit.>, however, most of them have failed in providing their security goals <cit.> and various attacks, such as the  protocol's secret values disclosure, DoS, traceability, impersonation and etc. were reported against them. The presentation of these attacks resulted in the development of the protocol's designing   knowledge and the protocol designers are designing their protocols in such a way as to be as safe as the published attacks so far. Unfortunately, there are still attacks against newly designed protocols, and this science has not yet matured.


Among different designing strategies of security protocols, attempts to design a secure ultralightweight protocol for constrained environment has a long (unsuccessful) history. Pioneer examples include  <cit.>,  <cit.>,  <cit.>,  <cit.> and  <cit.> and among the recent proposals is  <cit.>, and many other broken protocols that have been compromised by the later third parties analysis <cit.>.
All those protocols tried to provide enough security only using few lightweight operations such as bitwise operations, e.g. logical AND, OR, XOR and rotation. However, the mentioned analysis have shown that it is not easy to design a strong protocol using cryptographically-weak components.

In the line of designing ultralightweight protocols, in <cit.>, Tewari and Gupta proposed a new ultralightweight authentication protocol for IoT and claimed that their protocol satisfies all security requirements. However, in <cit.>, an efficient passive secret disclosure attack is applied to this protocol. Moreover, in <cit.>, Wang et al. cryptanalyzed the Tewari and Gupta protocol and also proposed an improved version of it. This protocol later analysed by Khor and Sidorov <cit.>, where they also proposed an improved protocol following the same designing paradigm. In this paper, we consider the security of this improved protocol which has been proposed by Khor and Sidorov, and for simplicity, we call it  (stands for Khor and Sidorov protocol) and show that  is vulnerable to desynchronization attack and also against secret disclosure attack. 


As a new emerging technology, blockchain is believed to provide higher data protection, reliability,  transparency, and lower management costs compared to a conventional centralized database. Hence, it could be a promising solution for large scale IoT systems.  Targeting those benefits Sidorov et al. recently proposed an ultralightweight mutual authentication RFID protocol for blockchain-enabled supply chains <cit.>. Although they have claimed security against various attacks, we present an efficient secret disclosure attack on it. For the sake of simplicity, we call this protocol .











 §.§ Paper organization

The rest of the paper is structured as follows: Section <ref> is dedicated to a brief review of  and  which are among recent proposals to provide security in the IoT environment. Our proposed secret disclosure attacks are applied to these protocols in Section <ref>. Finally, the paper is concluded in Section  <ref>. 







§  DESCRIPTION OF  AND 
 

To describe we use the notations that are represented in Table <ref>. These notations are also used through the other parts of the paper. 


  


 §.§ 

Tewari and Gupta recently <cit.> proposed an ultra-lightweight authentication protocol for IoT environment. Soon after that, two analyzes were published on it <cit.>. In one of them, i.e.  <cit.>, Wang et al. presented a secret disclosure attack that reveals the shared secret key between the server and the tag. To overcome this security flaw, they suggested the modifications on the protocol in such a way that it is expected to be secure against that attack. However, later Khor and Sidorov <cit.> have shown that Wang et al.'s protocol is as insecure as its predecessor and also proposed a new improved protocol which we call it . As it is shown in Fig.  <ref>, following the notations represented in Table  <ref>,  runs as follows:





  * The reader starts the authentication phase of the protocol by sending Hello and a random number r message to the tag.

  * The tag, when receives the message, generates a random number q and computes s=Rot(q⊕ r, wt(q)), T=IDS_new⊕ r⊕ q and U=Rot(IDS_old⊕ IDS_new, wt(q)) and sends sTU  to the reader.

  * Upon receipt of the message, the reader does as follows:



  * It does an exhaustive search to find wt(q)  to find a record of its database that  satisfies the received s and T, where the reader will be able to find IDS_old also, given U, to authenticate the tag.

  * The reader generates two new random numbers m and n and computes P=m ⊕ n ⊕ q, Q=Rot(n, wt(K_new)) and R=Rot(Rot(K ⊕ m, wt(n)), wt(K⊕ m)) and sends them to the tag.



  * Once the tag receives the message, it:


  * Extracts n and m and verifies the messages integrity based on R to authenticate the reader.

  * If the reader has been authenticated, the tag and the reader will update their new parameters
IDS_new=Rot(IDS_new⊕ q, wt(n))⊕ Rot(q,wt(m)) and K_new=Rot(K_new⊕ q⊕ n, wt(m))⊕ Rot(m,wt(n)).








  





 §.§ 
	
 protocol  <cit.>follows the  protocol designing paradigm and it is based on almost similar components.  As it is shown in Fig.  <ref>, following the notations represented in Table  <ref>,  runs as follows:



  * The reader starts the authentication phase of the protocol by sending Hello and a random number r message to the tag.

  * The tag, when receives the message, generates a random number q and computes A=Rot(IDS⊕ r, wt(q)), and B=Rot(IDS, wt(r)) ⊕ Rot(K⊕ r, wt(q)) and sends AB  to the reader.

  * Upon receipt of the message, the reader forwards rAB to the supply chain node.

  * Upon receipt of  rAB , the reader does as follows:	


  * It does an exhaustive search to find wt(q)  to find a record of its database that satisfies the received A, where the reader will be able to find IDS and K to verify the received B to authenticate the tag.

  * Based on the h(IDSK), it can check and track the product history together with permission level by reading the data from the blockchain. If the product has a correct history record in terms of ownership, timestamp, location, and product status, the supply chain node can authenticate the tag.

  * Once the tag has been authorized, the supply chain node generates a random number m and computes C=Rot(r, wt(IDS)⊕ wt(K))⊕ Rot(m, wt(K)), and D=Rot(m, wt(IDS)) ⊕ Rot(r, wt(K)) and sends CD  to the reader.



  * The reader forwards the received CD  to the tag.

  * Once the tag receives the message, it:


  * Extracts m  from C and verifies the messages integrity based on D to authenticate the reader/supply chain node.

  * If the reader/supply chain node has been authenticated and wt(m) is even, the tag  will update its parameters as:
IDS_new=Rot(IDS⊕ K, wt(r))⊕ Rot(K⊕ wt(q),wt(IDS)) and K_new=Rot(K, wt(r))⊕ Rot(r⊕ q,wt(K)).








  




§ SECURITY ANALYSIS OF  AND  
 

Although the designers of  and  argued its security formally using GNY logic, however, it is easy to show that they are as vulnerable to different attacks as their predecessor rotation based protocols, e.g. see <cit.>.  



 §.§ Secret Disclosure Attack on 



To analyze , we follow the same adversary model as them, when they analyzed Wang et al.'s protocol <cit.>, where “adversary is able to eavesdrop, intercept, block, and
modify messages sent during communication
between the reader and a tag.”. Given the target tag, the attack procedure will be as follows:




























  * The adversary eavesdrops a session of the protocol between the target tag and a legitimate reader, where, the reader generates an arbitrary nonce r and sends it to the tag, along with Hello.

  * The tag, when receives the message, generates a random number q and computes s=Rot(q⊕ r, wt(q)), T=IDS_new⊕ r⊕ q and U=Rot(IDS_old⊕ IDS_new, wt(q)) and sends sTU  to the reader, which is eavesdropped by the adversary.

  * Upon receipt of the message, the reader does as follows:


  * It does an exhaustive search to find wt(q)  to find a record of its database that  satisfies the received s and T, where the reader will be able to find IDS_old also, given U, to authenticate the tag.

  * The reader generates two new random numbers m and n and computes P=m ⊕ n ⊕ q, Q=Rot(n, wt(K_new)) and R=Rot(Rot(K ⊕ m, wt(n)), wt(K⊕ m)) and sends them to the tag, which is eavesdropped by the adversary.
	


  * The adversary terminates the protocol.

  * Given that tag has not received PQR, it will not update its records, i.e. IDS_new, K_new, IDS_old and  K_old. 

  * The adversary waits for another session between the target tag and a legitimate reader, where, the reader generates an arbitrary nonce r' and sends it to the tag, along with Hello.

  * The tag, when receives the message, generates a random number q' and computes s'=Rot(q'⊕ r', wt(q')), T'=IDS_new⊕ r'⊕ q' and U'=Rot(IDS_old⊕ IDS_new, wt(q')) and sends s'T'U'  to the reader, which is eavesdropped by the adversary.

  * Upon receipt of the message, the reader does as follows:


  * It does an exhaustive search to find wt(q')  to find a record of its database that  satisfies the received s' and T', where the reader will be able to find IDS_old also, given U', to authenticate the tag.

  * The reader generates two new random numbers m' and n' and computes P'=m' ⊕ n' ⊕ q', Q'=Rot(n', wt(K_new)) and R'=Rot(Rot(K ⊕ m', wt(n')), wt(K⊕ m')) and sends them to the tag, which is eavesdropped by the adversary.
	


  * Given that T⊕ T'=q⊕ r⊕ q'⊕ r', the adversary finds two offset values c and c', respectively as wt(q) and wt(q'), such that   and RRot(s,c) ⊕ RRot(s',c')=T⊕ T' and assigns RRot(s,c) to q⊕ r and RRot(s',c') to q'⊕ r'.

  * The adversary now extracts  IDS_new=T⊕ RRot(s,c), q=RRot(s,c) ⊕ r and IDS_old=IDS_new⊕ RRot(U, wt(q)).

  * The adversary finds three offset values c_1, c_2 and c_3, respectively as wt(K_new), wt(n)+wt(K_new⊕ m) and  wt(n')+wt(K_new⊕ m'), such that   and P⊕ P'⊕ q⊕ q'=RRot(Q,c_1) ⊕ RRot(Q',c_2) ⊕ RRot(R,c_2)⊕ RRot(R',c_3).

  * The adversary assigns  RRot(Q,c_1), RRot(Q',c_2), RRot(R,c_2) and RRot(R',c_3) respectively to n, n', K⊕ m and K⊕ m'.

  * The adversary extracts m=P⊕ RRot(Q,c_1)⊕ q and K=RRot(R,c_2)⊕ m.
	
Following above attack, the adversary extracts whole shared parameters between the tag and the reader with the complexity of eavesdropping two sessions of the protocol, blocking a message and doing polynomial computations.
It is clear that T⊕ T=q⊕ r⊕ q'⊕ r'. Now the adversary can also compute the updated values of IDS_new and K_new as IDS_new=Rot(IDS_new⊕ q, wt(n))⊕ Rot(q,wt(m)) and K_new=Rot(K_new⊕ q⊕ n, wt(m))⊕ Rot(m,wt(n)).
:
It should be noted the adversary can use other metrics to filter possible wrong guesses, e.g., c_1, c_2 and c_3 should be respectively equal to  wt(K_new), wt(n)+wt(K_new⊕ m) and  wt(n')+wt(K_new⊕ m'). 

Given that the adversary has whole secret parameters, applying any other attack will be trivial, e.g., reader/tag impersonation, desynchronization and traceability attacks.






 §.§ Secret Disclosure Attack on 



To analyze , we follow the same adversary model as them, when they analyzed Wang et al.'s protocol <cit.>, where “ adversary has the capability to initiate communication with the reader and a tag and it is able to eavesdrop, intercept, block, and
modify messages sent during communication
between the reader and a tag. Moreover, the number of unsuccessful attempts is limited to 5, otherwise, the reader sends KILL command to the tag ”. The parameter length is considered to be 96 bits. Given the target tag, the attack procedure, which is almost similar to the attack against , will be as follows:




  * The adversary eavesdrops all transferred messages over a session of the protocol between the target tag and a legitimate reader, i.e., r,A,B,C,D where, A=Rot(IDS⊕ r, wt(q)),  B=Rot(IDS, wt(r)) ⊕ Rot(K⊕ q, wt(q)), C=Rot(r, wt(IDS)⊕ wt(K))⊕ Rot(m, wt(K)), and D=Rot(m, wt(IDS)) ⊕ Rot(r, wt(K)).

  * The adversary blocks CD, sent from the reader to the tag. Hence, tag will not update its secrets, i.e., IDS and K.

  * The adversary waits for another session between the the target tag and a legitimate reader, where, the reader generates an arbitrary nonce r' and sends it to the tag, along with Hello.

  * The adversary again  eavesdrops all transferred messages over a session of the protocol between the target tag and a legitimate reader, i.e., r',A',B',C',D' where, A'=Rot(IDS⊕ r', wt(q')),  B'=Rot(IDS, wt(r')) ⊕ Rot(K⊕ q', wt(q')), C'=Rot(r', wt(IDS)⊕ wt(K))⊕ Rot(m', wt(K)), and D'=Rot(m', wt(IDS)) ⊕ Rot(r', wt(K)).


  * Given that RRot(A, wt(q))⊕ RRot(A', wt(q'))=IDS⊕ r⊕ IDS⊕ r'=r⊕ r' and r and r' are transferred over insecure channel, which is eavesdropped by the  adversary, the adversary extracts IDS and K as follows:


  * for i∈{0,1,…, 95}

  * for j∈{0,1,…, 95}

  *   if RRot(A, i)⊕ RRot(A', j)==r⊕ r', return RRot(A, i)⊕ r, i and j respectively as IDS, wt(q) and wt(q').


  * Given r, r', IDS, wt(q) and wt(q'), the adversary extracts K as  RRot((B⊕ Rot(IDS, wt(r))),wt(q))⊕ r.

  * The adversary can use other metrics to filter possible wrong guesses, e.g., B', C, C', D and D'. 

  * The adversary calculates the updated parameters as IDS_new=Rot(IDS⊕ K, wt(r'))⊕ Rot(K⊕ wt(q'),wt(IDS)) and K_new=Rot(K, wt(r'))⊕ Rot(r'⊕ q',wt(K))
	
Following above attack, the adversary extracts whole shared parameters between the tag and the reader with the complexity of eavesdropping two sessions of the protocol, blocking a message and doing polynomial computations. In this case also, since the adversary has whole secret parameters, applying any other attack will be trivial, e.g., reader/tag impersonation, desynchronization and traceability attacks.














§ CONCLUSIONS
 
In this paper, we have shown that two recent proposed security protocols for IoT and RFID systems (i.e.  and  ) are vulnerable against secret disclosure attacks, were we presented attacks with the complexity of eavesdropping only two sessions of each protocol and negligible computational complexity.


abbrv 
 




