معصومه صفخانی - دانشگاه تربیت دبیر شهید رجایی، دانشکده مهندسی کامپیوتر، مدیر گروه معماری سیستم های کامپیوتری، دکترای مهندسی برق
امیر عباسیان - دانشگاه تربیت دبیر شهید رجایی، دانشکده مهندسی کامپیوتر، دانشجوی کارشناسی ارشد

These days, many researchers work on RFID EPC-C۱ G۲ authentication protocols designing with the use of ۱۶-bit PRNGs. However, thanks to short input/output length of such PRNG functions that makes it feasible to convert it, most of such protocols are vulnerable against full secret disclosure attacks. Recently, Moradi et al. in [۱] analyzed an EPC-C۱ G۲ authentication protocol named 〖SRP〗^+ and presented a revised version of the 〖SRP〗^+ protocol. In this paper, we show that unfortunately the revised version of 〖SRP〗^+protocol, same as its predecessor i.e. 〖SRP〗^+ protocol, is still vulnerable against full secret disclosure attack. In the presented attack, adversary discloses all secrets of the protocol only by eavesdropping one run of the protocol, impersonating the reader in one run of the protocol and doing only ۳×۲^۱۶ off -line PRNG function evaluations.

EPC, C۱ G۲, RFID, Secret Disclosure Attack, Authentication, ۱۶, bit PRNG Function