Privacy Preserving Mutual Authentication Protocol for Low-cost RFID

Jeongkyu Yang*, Kui Ren**, SuGil Choi***, Kwangjo Kim*

*Information and Communication University (ICU)

**Worcester Polytechnic Institute (WPI)

**Electronics and Telecommunications Research Institute (ETRI)

Abstract

In ubiquitous society, radio frequency identification (RFID) will be important for object identification in various areas. However, they have potential risks and may violate privacy for their bearers since low-cost RFID tags are highly resource-constrained so that it is very restricted to implement the existing cryptographic algorithms. To protect user privacy and remove security vulnerabilities, we propose a privacy preserving mutual authentication protocol that fits the low-cost RFID environment. Our protocol considers the privacy protection for the tag bearers, which requires many security features. The proposed protocol is robust enough against attacks such as the man-in-the-middle attack, the replay attack as well as the data loss. It is based on mutual authentication between a tag and a back-end server and provides the reader authentication in case the reader is not a trusted third party and the communication channel is insecure. It is also forgery resistant against an attacker who copies or counterfeits a prevailing RFID tag. With the minor computation and memory size, it is practical compared to the previous results.

I. Introduction

Radio Frequency Identification (RFID) technology is expected to take an important role for object identification as a ubiquitous infrastructure, and is currently considered as the next generation technology that is mainly used to identify massive objects and will be a substitution for the existing optical bar code system in the near future. The micro-chip equipped on a tag has a unique identification information and is applicable for various fields such as animal tracking, supply chain management, inventory control, etc.

RFID has been already used in many applications. In 2003, Mark & Spencer, the largest retailer of clothing in the U. K. developed Radio Frequency Identification (RFID) tagging for a trial on individual garments [20]. This follows the success of trials on RFID tagging on 3.5 million produce delivery trays in Marks & Spencer's food supply chain. Michelin also embedded RFID tags in tires for its tire tracking system [21]. For more sensitive area, European Central Bank (ECB) determined to embed RFID tags on its banknotes from 2005 for special purposes like banknote tracking and strong forgery resistance as well as user privacy protection [5]. After Exxon Mobile developed the mobile payment system known as Speedpass, many service providers like SONY and Philips has been tried to develop mobile payment system using radio frequency radiation [22].

1. Security and Privacy Issues in RFID Systems

In addition to the good aspects of RFID technology, the existing RFID systems are vulnerable to many security risks and imply potential privacy problems, since it is very hard to implement the existing cryptographic algorithms due to the restricted computational power and the memory size of a low-cost RFID tag [5,6,8,13,14,17]. User privacy issue is considered as a big barrier for the proliferation of RFID system applications since the data of a tag can be transmitted by an illegal interrogation without its bearer's notification. We consider two privacy issues when using RFID. One is the data leakage illegally from a tag. Another is the malicious tracking for the unique ID of a tag [11]. A tag bearer has various objectives that they do not want to make others know what they currently keep and what those objectives are. If the tags are attached to those objectives, the private information of tag bearers can be revealed regardless of their attention. The location privacy of tag bearers can be revealed through the response information from the tag although the tag information is securely protected. Especially, the location privacy can be more significant when a certain tag is exposed to the long-term tracking. In RFID-labeled society, the value for commodities or products is mostly identified by the RFID. Thus, simple forgery such as copying a tag's information or even more sophisticated measure will be very attractive for the malicious users and the adversaries to disguise or impersonate [8]. From this reason, the forgery resistance is also strictly required for desirable usage of RFID.

2. Motivation and Authentication Protocol Considerations

To remove security vulnerabilities, an authentication protocol for RFID systems can be considered as a security measure. As discussed in [1,4,5,13,17], one of the important issues to provide the security services under RFID environment is to design an authentication protocol considering the low computational power of RFID tags.

In this paper, we propose a privacy preserving mutual authentication protocol that fits the low-cost RFID system environment. The proposed authentication protocol meets the privacy protection for tag bearers, which requires confidentiality, anonymity, and integrity in the cryptographic point of view. Our protocol is robust enough against the active attacks such as the man-in-the-middle attack, and the replay attack as well as the data loss [13,14,16]. The protocol is based on mutual authentication between a tag and a back-end server, and provides authentication for the reader in case the reader is not regarded as the trusted third party (TTP). Our protocol is also forgery resistant against the attacker who copies or counterfeits a prevailing RFID tag.

The remainder of the paper is organized as follows: In section 2, we introduce RFID system primer, and related works, then propose authentication scheme in section 3. In section 4, we give security analysis and complexity analysis, then conclude in section 5.

II. Related Works

1. RFID System Primer

Fig. 1. Typical RFID System

As shown in Figure 1, typical RFID system consists of RF tags, or transponders, and RF tag readers, or transceivers [14]. In addition, a back-end server is usually working together in RFID system as a separate component [13,17]. A tag consists of IC chip and antenna, and transmits its stored data to a reader as response for a radio frequency interrogation. A reader sends a radio signal to tags, receives the data transmitted from a tag, and sends the data to a back-end server. The back-end server is a secure server and has a database which stores the various information of each tag like the identification information and all other application related data of tags and location information of readers. The server determines each tag's identification from the information responded from the tag by way of an authorized reader. The server replies the data from its database to the reader. The data is mostly depended on a certain application.

For the privacy of tag bearers, the unique ID of the tag must be anonymous to protect the location privacy, and all messages to process the authentication must be secure to guarantee the user data privacy. A reader is generally considered as a TTP. The insecure communication channel through the air interface between tags and reader is more vulnerable to an attack than the secure channel between readers and back-end servers. The range of radio frequency from the reader is much stronger than that from the tag when the tag is passive and receives power from the reader. Thus, an adversary can eavesdrop for interrogation of the reader from the much longer distance [16].

The cost of a RFID tag should be reduced under US$0.50 for various applications. In order to achieve this price, IC should be priced less than US$0.20 [16]. This price barrier for low-cost tags restricts the range of tag gates number from 7.5 to 15 K gates, and the number of gates for security purpose is limited to from 2.5 to 5 K gates [15]. Due to this, it must be infeasible to use the existing cryptographic algorithm [3].

2. Previous Results

One-way hash function or hash function is a powerful and yet computational efficient cryptographic tool. Based on the one-wayness property of hash function together with authentication process for low-cost RFID system are currently considered as the proper solution in the aspect of security requirements and hardware adequacy for low-cost RFID tags. According to [12], a hash function unit with block size of 64-bit can be implemented with only about 1.7 K-gates. Some works proposed hash-based authentication protocols.

Weis et al. [17] introduced two hash-based authentication schemes, hash-lock scheme and extended hash-lock scheme. Their schemes mutually authenticate a tag and a back-end server, and try to provide the user privacy protection features such as anonymity on a tag's data. However, their proposed protocols are neither private nor secure against eavesdroppers since the attacker can track  and  and impersonate the tag to a legitimate reader. Extended hash-lock scheme also has an implementation issue like a random number generator into each tag.

Recently, Henrici and Müller [6] proposed a simple and efficient authentication protocol for low-cost RFID system. Their protocol is based on a hash function on a tag and a random number generator on a back-end server to protect the user information privacy, the user location privacy, and the replay attack. Their scheme also provides a simple method for the data loss. However, this protocol cannot resist against the man-in-the-middle attack. The attacker can be located between a legitimate tag and a legitimate reader and obtain the information from the tag. Thus, the attacker easily can be authenticated by the legitimate reader before the next session.

Hwang et al. proposed the enhanced version of [6] to fix its drawback and provide more efficient authentication performance. Their scheme reduce the required memory size and the number of hash calculation for low-cost RFID tags [19].

In previous protocols, a reader is assumed as a TTP. In the current wireless communication environment, the communication channel between a reader and a back-end server can be considered as the insecure channel. Thus, an adversary can impersonate as a legitimate reader. Previous schemes cannot prevent the man-in-the-middle attack when a reader is no more a TTP. Besides, previous results did not clearly denote the linkage between the authentication information and the tag, so forgery is easily enabled with the passive eavesdropping.

III. Proposed Protocol

1. Notations

We use the notations as shown in Table 1 to describe the protocol throughout the paper. Like [6], we adopt the similar database structure and the same mechanism to prevent the data loss. A back-end server manages a pair of records for each tag in case the reply message from the back-end server to the tag is lost or intercepted. Each record consists of fields like . The detailed descriptions of the fields are shown in the same table of notations.

Table 1. Notations

T	RF tag, or transponder.
R	RF tag reader, or transceiver.
B	Back-end server, it has a database.
	Chip serial number that is embedded into T during manufacturing
	Symmetric-key cryptosystem based encryption function with the secret key, .
	Symmetric-key cryptosystem based decryption function with the secret key, .
	One-way hash function
	Keyed hash function with the secret key .
	Temporary identification value of T, it is used to make the shared secret randomized.
	Temporary value to be used to make the shared secret, , randomized.
	Secret key shared between R and B.
	Shared random secret between T and B.
	Shared random secret between T and B.
	Random Number Generator
	Random number generated by of R.
	Keyed one-way hash value of .
	Exclusive-or (XOR) function.
	Verification operator to check whether the left side are valid for the right side or not
	Update operator from the right side to the left side.
	A field for the temporary identification value of T and used as a primary index.
	A field for the shared random secret, .
	A field for the shared random secret, .
	A field for the pointer linking a pair of records each other to counteract for the data loss.
	A field for the chip serial number, , of T.
	A field of all other application related data of T.

2. Assumptions

Our protocol works with the natural assumption that T has a hash function, XOR gate, and the capability to keep state during a single session. The widely acceptable low-cost RFID tags would most likely require the usage of passive tags [14,17]. To design our proposed protocol, we assume the low-cost RFID tag is passive and has a re-writable memory like EEPROM with reasonable size like EPC Class 2 of EPC Global [16]. In Crypto 2004, Biham et al. [2,7,18] showed that collision of SAH0, MD4, MD5, HAVAL-128, and RIPEMD is easily found. With this in mind, we expect that the cryptographic hash function used in our protocol has the desirable security like preimage resistance, second preimage resistance, and collision avoidance. In our protocol, we assume T has a hash function. In [12], it is said that a hash function unit with block size of 64-bit can be implemented with only about 1.7 K-gates, so it is also assumed that there will be the practical implementation of hash function for the low-cost RFID tag with the desirable security. Like [6,13], we assume that T only has its authentication related information. A tag also has a memory for keeping values of , , and  to process mutual authentication. The simple structures for the database record and the tag memory are shown in Figure 2. Other required data of T for an application are stored in the database of B.

In the previous schemes [6,17], they assumed R is a TTP and the communication channel between R and B is secure. However, we assume that R is not a TTP and the communication channel is insecure like the today's wireless network. With this assumption, their schemes are easily compromised with the man-in-the-middle attack. To verify the validity of R, R has a , , and both R and B have, , a keyed one-way hash function, . To secure  in the reply message from B, B encrypts, , and R decrypts, .  is the secret key and is randomized for each session with the random number  from R. We assume that  is the secret key shared between R and B, and R and B has enough capability to manage the symmetric-key cryptosystem and sufficient computational power for encryption and decryption.

3. Attacking Model

To solve the security risks and privacy issues, the following attacking model must be assumed and prevented [6, 14, 16, 17]. However, In our protocol, we do not consider a physical attack like detaching RFID tag physically from a product because it is hard to carry out in public or on a wide scale without detection. We consider the following attacks and describe;

Man-in-the-middle attack: The attackers can impersonate as a legitimate reader and get the information from T, so he can impersonate as the legitimate T responding to R. Thus, the attacker easily can be authenticated by the legitimate R before the next session.

Replay attack: The attackers can eavesdrop the response message from T, and retransmit the message to the legitimate R.

Forgery: The simple copy for the information of T by eavesdropping is enabled by the adversary.

Data loss: The protocol can be damaged from denial-of-service(DoS) attack, power interruption, and hijacking.

4. Security Requirement

To protect the user privacy, we consider the following requirement in cryptographic point of view [16, 13].

Data Confidentiality: The private information of T must be kept secure to guarantee user privacy. The information of T must be meaningless for its bearer even though it is eavesdropped by an unauthorized R.

Tag Anonymity: Although the data of T is encrypted, the unique identification information of T is exposed since the encrypted data is constant. An attacker can identify each T with its constant encrypted data. Therefore, it is important to make the information of T anonymous.

Data Integrity: If the memory of T is rewritable, forgery and data modification will happen. Thus, the linkage between the authentication information and T itself must be given in order to prevent the simple copy for T. In addition to this, the data integrity for the authentication information between T and B must be guaranteed. On the other hand, there is the possible data loss coming from DoS attack, power interruption, message hijacking, etc. Thus, the authentication information between T and B must be delivered without any failure, and the data recovery must be provided.

Besides, we must consider and evaluate the following security feature in the design of RFID authentication protocol.

Mutual authentication and reader authentication: In addition to access control, the mutual authentication between T and B must be provided as a measure of trust [10]. By authenticating mutually, the replay attack and the man-in-the-middle attack to both T and B is prevented. B also must authenticate R to avoid the man-in-the-middle attack by an illegitimate R on the insecure channel.

5. Design of Authentication Protocol

We adapt RNG on R to protect the man-in-the-middle attack. In this protocol, R generates a pseudo random number, , and queries with  to T. R also transmits  and  to B with the response message from T.  is the keyed hash value from R and is verified by B. Thus, the protocol can prevent the man-in-the-middle attack even though an attacker can query T before T is interrogated by the legitimate R and it can be authenticated with its corresponding response. To make this protocol forgery resistant, we exclusive-or a RFID chip's original serial number on , namely the man-in-the-middle attack and the forgery resistance factor. During the authentication process in B side, B can check  with the chip serial number that is stored on the corresponding database record. The overall protocol is shown as Figure 2. The subordinate procedures for each step are described.

Initial Setup.

1) Each T is given two fresh random secrets and a database of B also stores them as the shared secret. The temporary used two shared secrets are  and . T has a hash function and a XOR function. T does not need to have the additional storage for its serial number, , since  is unique and permanently embedded into each T [11]. , , and the initial identification data, , are initially stored into , , and  of memory of each T respectively.

2) R has a  and a keyed hash function, generates a fresh random nonce, , and calculates  for every session. R and B manage the secret key  for keyed hash function. We simply denote  by .

3) The database of B manages a record pair for each tag consisting of  like [6].  is the value of  and used as a primary index to refer to other information of fields.  is not set since no associated entry exists initially at this moment. , keeps the unique chip serial number, , for each T . B has a hash function and a keyed hash function to verify T and R respectively. The pair of records point each other with the pointer field, . Thus, the record for the previous session can be used to recover the data for the current session when the data loss is occurred.

6. Detailed Description

We describe the proposed protocol according to the sequence of message exchange and also discuss the security goals which can be achieved during the execution of each protocol message. The one session of mutual authentication is processed from step 1 to step 5 challenging and responding the valid authentication messages.

Step 1 (Challenge) In this step, R usually applies a collision-avoidance protocol like the secure binary tree walking [4, 16] or the standard protocols of ISO 18000-3 MODE [9] to singularize T out of many. R generates a fresh random nonce, r, and randomizes it with the keyed one-way hash function, . R sends  to the queried T. The key, , is shared by R and B, and  is used to authenticate the validity of R. With , the man-in-the-middle attack is prevented against an active attacker. It is also used to detect the illegitimate R by B after step 3.

Fig. 2. Proposed Authentication Protocol

Step 2 (T-R Response) When queried, T sends  and  to R. Both  and  are the outputs of one-way hash function.  is used as the identification information.  has two purposes; One is to verify the legitimate R with , and another is to prevent the forgery with  by the passive eavesdropping.  and  are randomized with the shared secrets,  and  for every read attempt.

Step 3 (R-B Response) R simply forwards  and  to B. At the same time, R also transmits  and  to prevent the man-in-the-middle attack and to detect the illegal R. Within this step, B authenticates R and T consequently with  and  respectively.

At first, B verifies whether the forwarded  is valid or not by comparing  with hk(r).  is the shared secret key only between R and B, so B can detect the illegal R and discards the forwarded message. Thus, man-in-the middle attack by the illegitimate R and a passive eavesdropper can be prevented.

If R is valid, B retrieves the records of  corresponding to  and get , , and  from , , and  respectively. Then, B authenticates T with . B calculates  and compares with .

Since B initially stores the chip serial number, , B can evaluate the linkage between the forwarded authentication information  and T itself in order to prevent forgery. Forgery can be detected and prevented by B at this moment.

At the same time, B can detect and prevent the man-in-the-middle attack since S is used as the factor of the man-in-the-middle attack detection. Similarly, the replay attack can be also detected and prevented simultaneously.

If B successfully finishes the authentication process, B generates  with its one of shared random secrets .  will be used to make the shared keys anonymous in the remaining steps.

The database of B generates a new record to consist of a pair of records and updates with the corresponding record.  have the value to point the pair of records each other. When errors or the data loss in message for the current session are occurred, the database of B can reference the record of the previous session pointed by  of the current session. Thus, the protocol is reliable for the data recovery against the data loss.

Step 4 (B-R Reply) B encrypts the corresponding  using , the randomly created shared secret key between B and R. Then, B replies  and . Then, B makes its shared two keys,  and , randomized simply by exclusive-oring. The same process will be applied to the next step for making the corresponding shared secrets of T anonymous. After this step, the corresponding decryption process, , is processed by R to get . Thus,  of T is securely obtained only by legitimate R although the adversary eavesdrops the reply messages on the insecure channel.

Step 5 (R-T Reply) Like step 3, R forwards  to the corresponding T. Then, T processes the mutual authentication. T verifies the forwarded . T calculates  and compares it with . If matched, then the mutual authentication is finally succeeded. T updates the shared secrets  and  simply exclusive-oring with  and . Otherwise, T will not updates them in case the replay attack to T occurs.

IV. Evaluation of Proposed Protocol

1. Security Analysis

We evaluate our protocol in the view point of the security requirement.

Our protocol guarantees the secure mutual authentication only with the hashed messages, , , , and , and T does not store user privacy information. Thus, data confidentiality of tag owners is guaranteed and the user privacy on data is strongly protected. In every session, we use the fresh random nonce as the keys between entities. These keys are randomized and anonymous since they are updated for every read attempt. Thus, tag anonymity is guaranteed and the location privacy of a tag owner is not compromised, either. Based on the mutual authentication, our protocol guarantees the data integrity between T and B. By using the pair of database records and managing  as we described in the authentication step 3, our protocol provides the data recovery against the data loss during the authentication processes.

To give the forgery resistance feature, we simply exclusive-or the embedded chip serial number, , of T to the authentication information, .  is initially embedded during the chip manufacturing. Whenever T generates , it refers , so we can come up with the linkage between  and T itself. B keeps each tag's chip serial number initially and authenticates the ownership of the authentication information for T.

Through the authentication step 1 to step 3, R sends  to T and ,  to B for preventing the man-in-the-middle attack. B can verify  with the calculation of the keyed hashed value of  transmitted from R. Also, the man-in-the-middle attack by R as an illegitimate reader is detected and prevented on the insecure channel between R and B. The  of the corresponding T is not compromised since it is encrypted by B and decrypted by R with the randomly generated secret key, , from  of R. The key freshness is also guaranteed for each session. The replay attack for T and B is detected and prohibited through the step 3 for B and the step 5 for T.

2. Comparison with Previous Protocols

Table 2 shows the comparison of the computational loads and the required memory size for a single session, and Table 3 shows the comparison of the security requirements and the possible attacks.

To compare with the previous protocols, we assume the size of all components are L bits, and a RNG and a hash function are  and respectively. We exclude  for the comparison since the size of  depends on applications. In our protocol, T only has a hash function and XOR function, and the size of the memory is . Thus, the proposed protocol is light-weight and practical. Our protocol seems to have encryption and decryption overheads between R and B. However, those cryptographic tools are needed to secure  on the insecure channel. We assume that R and B have enough computational power to process encryption and decryption based on the symmetric-key cryptosystem.

The proposed protocol also satisfies the security requirements and provides the privacy protection features as mentioned in the previous section. We denote the hash-lock scheme [17], the extended hash-lock scheme [17], the hash-based varying Identifier [6], and the improved hash-based varying Identifier [19] by HLS, EHLS, HBVI, and IHBVI respectively. As shown in Table 3, our protocol exhibits much secure and more reliable compared to other previous results.

Table 2. Computational Loads and Required Memory

Protocol	Entities	HLS[17]	EHLS[17]	HBVI[6]	IHBVI[19]	Our Scheme
No. of Hash Operation	T	1	2	3	2	2
	B	-	n	3	2	2
No. of Keyed Hash Oeperation	R	-	-	-	-	1
	B	-	-	-	-	1
No. of RNG Operation	T	-	1	-	-	-
	R	-	-	-	1	1
	B	-	-	1	-	-
No. of Encryption	B	-	-	-	-	1
No. of Decryption	R	-	-	-	-	1
Number of Authentication Steps		6	5	5	5	5
Required Memory Size	T
	R	-	-	-
	B
‡Notation - not required number of tags size of required memory

Table 3. Comparison between Protocols

Protocol	HLS[17]	EHLS[17]	HBVI[6]	IHBVI[19]	Our Scheme
User data confidentiality	×	△	△	○	○
Tag anonymity	×	△	△	○	○
Data integrity	△	△	○	○	○
Mutual authentication	△	△	△	○	○
Reader authentication	×	×	×	×	○
Man-in-the-middle attack prevention	△	△	×	△	○
Replay attack prevention	△	△	○	○	○
Forgery Resistance	×	×	×	×	○
Data Recovery	×	×	○	○	○
‡Notation ○ satisfied △ partially satisfied × not satisfied

V. Conclusion

The existing RFID systems are vulnerable to many security risks and imply potential privacy problems, since low-cost RFID tags are highly resource-constrained and cannot support its long-term cryptography. In this paper, we proposed the privacy preserving RFID mutual authentication protocol for the low-cost RFID environment that is computationally light-weight and anonymously interact between entities. Our protocol provides the mutual authentication between the tag and the back-end server and anonymously interacts. All authentication messages are randomized and the tag only has its unique identification data, so the user data privacy and the location privacy is guaranteed. Our protocol is robust enough since it protects the replay attack and man-in-the-middle even when the reader is not a trusted third party and the communication channel is insecure. We add the linkage feature between the tag and its authentication data, so forgery is prohibited. The proposed protocol basically fits the low-cost RFID system environment. As the tag only has a hash function with the shared two fresh random secrets of small memory size, the proposed protocol is practical for low-cost RFID system compared to the previous results.

References

[1] Auto-ID Center, "860MHz-960MHz Class I Radio Frequency Identification Tag Radio Frequency & Logical communication Interface Specification Proposed Recommendation Version 1.0.0", Technical Report MIT-AUTOID-TR-007, Nov. 2002.

[2] A. Joux, "Collisions in SHA-0", presented at the rump session of Crypto 2004.

[3] A. Juels, \Minimalist Cryptography for Low-Cost RFID Tags", Available at http://www.rsasecurity.com/rsalabs/node.asp?id=2033

[4] A. Juels, R.L. Rivest and M. Szydlo, "The Blocker Tag: Selective Blocking of RFID Tags for Consumer Privacy", In Proceedings of 10th ACM Conference on Computer and Communications Security(CCS 2003), Oct. 2003.

[5] A. Juels and R. Pappu, "Squealing euros: Privacy protection in RFID-enabled banknotes", In Rebecca N. Wright, editor, Financial Cryptography FC'03, volume 2742 of LNCS, pages 103-121, Le Gosier, Gaudeloupe, FrenchWest Indies, January 2003. IFCA, Springer-Verlag.

[6] D. Henrici, and P. Müller, "Hash-based Enhancement of Location Privacy for Radio-Frequency Identification Devices using Varying Identifiers", PerSec'04 at IEEE PerCom, 2004.

[7] E. Biham, and R. Chen, "New results on SHA-0 and SHA-1", presented at the rump session of Crypto 2004.

[8] G. Avoine, "Privacy issues in RFID banknotes protection schemes", In Sixth Smart Card Research and Advanced Application IFIP Conference - CARDIS, Toulouse, France, August 2004. Kluwer.

[9] ISO/IEC JTC 1/SC 31/WG 4. "Information technology AIDC techniques - RFID for item management Air interface, Part3: Parameters for air interface communications at 13.56 MHz", April 2004. Version N681R.

[10] I. Vajda and L. buttyan, "Lightweight Authentication Protocols for Low-Cost RFID Tags", Ubicomp 2003.

[11] K. Finkenzeller, "RFID Handbook Second Edition", Wiley & Sons, 2002.

[12] K. Yuksel, "Universal Hashing for Ultra-Low-Power Cryptographic Hardware Applications", Master's Thesis, Dept. of Electronical Engineering, WPI, 2004.

[13] M. Ohkubo, K. Suzuki, and S. Kinoshita, "Cryptographic Approach to Privacy-Friendly Tags", RFID Privacy Workshop 2003, MIT, MA, USA, Nov 2003.

[14] S. Sarma, S. Weis, and D. Engels, "RFID Systems and Security and Privacy Implication", Auto-ID Center, 2002.

[15] S. Sarma, S. Weis, and D. Engels, "Radio-Frequency Identification: Security Risks and Challenges", CryptoBytes, 2003.

[16] S. Weis, "Security and Privacy in Radio-Frequency Identification Devices", Master's thesis, MIT, 2003.

[17] S. Weis, S. Sarma, R. Rivest, and D. Engels, "Security and Privacy Aspects of Low-Cost Radio Frequency Identification Systems", In proceedings of the 1st Security in Pervasive Computing, 2003.

[18] X. Wang, X. Lai, D. Feng, and H. Yu, "Collisions for hash functions MD4, MD5, HAVAL-128 and RIPEMD", presented at the rump session of Crypto 2004.

[19] Y. Hwang, S. Lee, D. Lee, and J. Lim, "An Authentication Protocol for Low-Cost RFID in Ubiquitous", Proceedings of CISC S'04, pp.109-114, 2004 June (inKorean)

[20] http://www2.marksandspencer.com/thecompany/mediacentre/pressreleases/2003/

com2003-04-07-00.shtml

[21] RFID Journal. Michelin embeds RFID tags in tires. http://www.rfidjournal.com/article/view/269

[22] Texas Instruments ISO 14443 payment platform promises faster data transfer rates and more security. http://http://www.rfidjournal.com/article/articleview/327/1/1/