A secure minimalist RFID authentication and an ownership transfer protocol compliant to EPC C1G2

Radio-frequency identification (RFID) technology is employed in numerous applications in our everyday lives. However, many users do not realize how personal and valuable the information is that is being transmitted when they use the RFID-enabled objects. Many take the security of such transactions for granted. In reality, RFID technology is subjected to major security and privacy concerns such as the lack of confidentiality, traceability, impersonation, and denial-of-service attacks. Existing RFID authentication protocols demonstrate a lot of progress covering all the above-mentioned issues. However, they are still vulnerable to certain security and privacy attacks. Furthermore, due to their complexity, most of the schemes do not conform to the EPC Class-1 Gen-2 (C1G2) Standard and thus cannot be implemented on passive low-cost RFID tags. With this work, we present a minimalist RFID Authentication protocol compliant to the EPC C1G2 based on Quadratic residues. Through the detailed security and privacy analyses, we show that our scheme provides the anonymity, location privacy, achieves both backward and forward untraceability, and is secure against the impersonation and desynchronization attacks. The proposed scheme also supports ownership transfer that can be performed over the insecure environment for tags. The use of lightweight functions makes the scheme efficient, scalable, and feasible for implementation on simple low-cost tags.