Subtle Flaws in the Secure RFID Tag Searching Protocol: SRTS

Secure RFID searching emerged as a new application field in RFID systems finds out whether a specific RFID tag is nearby within a group of tags in a secure manner. Although numerous RFID authentication protocols have been proposed in different studies, RFID searching has not drawn much attention from the RFID community. Also, most of the existing RFID searching protocols do not comply with the EPC Class-1 Gen2 standard, because their designs employ hardware complex cryptographic primitives such as hash functions or complicated encryption schemes. Recently, Sundaresan et al. has introduced an ultra-lightweight secure RFID searching protocol which only requires a Pseudo Random Number Generator and XOR encryption, i.e. it can be implemented on low-cost EPC Class-1 Gen2 compliant RFID tags. The authors present a detailed security analysis of their protocol to prove its security correctness and they claim that the protocol fulfills the security and privacy requirements. In this study, however, we describe tracking, replay and tag impersonation attacks that show the protocol fails to bear out some of its privacy and security objectives.