Skip to main content
Kent Academic Repository

Cryptanalysis of a novel authentication protocol conforming to EPC-C1G2 standard

Peris-Lopez, Pedro, Hernandez-Castro, Julio C., Estevez Tapiador, Juan, Ribagorda, Arturo (2009) Cryptanalysis of a novel authentication protocol conforming to EPC-C1G2 standard. Computer Standards and Interfaces, 31 (2). pp. 372-380. ISSN 0920-5489. (doi:10.1016/j.csi.2008.05.012) (Access to this publication is currently restricted. You may be able to access a copy if URLs are provided) (KAR id:31952)

Language: English

Restricted to Repository staff only
[thumbnail of Cryptanalysis of a novel authentication protocol conforming to EPC-C1G2 standard.pdf]
Official URL:


In 2006, the standard EPC Class-1 Generation-2 (EPC-C1G2) was ratified both by EPCglobal and ISO. This standard can be considered as a "universal" specification for low-cost RFID tags. Although it represents a great advance for the consolidation of RFID technology, it does not pay due attention to security and, as expected, its security level is very low. In 2007, Chien et al. published a mutual authentication protocol conforming to EPC-C1G2 which tried to correct all its security shortcomings. In this article, we point out various major security flaws in Chien et al.'s proposal. We show that none of the authentication protocol objectives are met. Unequivocal identification of tagged items is not guaranteed because of possible birthday attacks. Furthermore, an attacker can impersonate not only legitimate tags, but also the back-end database. The protocol does not provide forward security either. Location privacy is easily jeopardized by a straightforward tracking attack. Finally, we show how a successful auto-desynchronization (DoS attack) can be accomplished in the back-end database despite the security measures taken against it.

Item Type: Article
DOI/Identification number: 10.1016/j.csi.2008.05.012
Uncontrolled keywords: Authentication; Cryptanalysis; EPC-C1G2; RFID; Security
Subjects: Q Science > QA Mathematics (inc Computing science) > QA 75 Electronic computers. Computer science
Divisions: Divisions > Division of Computing, Engineering and Mathematical Sciences > School of Computing
Depositing User: Julio Hernandez Castro
Date Deposited: 24 Oct 2012 13:19 UTC
Last Modified: 16 Nov 2021 10:09 UTC
Resource URI: (The current URI for this page, for reference purposes)

University of Kent Author Information

Hernandez-Castro, Julio C..

Creator's ORCID:
CReDIT Contributor Roles:
  • Depositors only (login required):

Total unique views for this document in KAR since July 2020. For more details click on the image.