Weakness in a Serverless Authentication Protocol for Radio Frequency Identification

The design of secure authentication protocols for radio frequency identification (RFID) system is still a quite challenging problem. Many authentication protocols for RFID have been proposed, but most have weaknesses or flaws. We analyze the security of a serverless RFID authentication protocol which recently been presented by Hoque et al. The protocol was expected to safeguard both RFID tag and RFID reader against major attacks, and RFID server is not needed in the protocol. However, our security analysis shows that the authentication protocol is vulnerable to attack of data desynchronization. This attack destroys the availability of the protocol. Furthermore, improvement to overcome the security vulnerability of the protocol was presented.