Cryptanalysis of a new ultralightweight RFID authentication protocol—SASI

Since RFID tags are ubiquitous and at times even oblivious to thehuman user, all modern RFID protocols are designed to resist tracking so that thelocation privacy of the human RFID user is not violated. Another design criterionfor RFIDs is the low computational effort required for tags, in view that most tagsare passive devices that derive power from an RFID reader’s signals. Along thisvein, a class of ultralightweight RFID authentication protocols has been designed,which uses only the most basic bitwise and arithmetic operations like exclusive-OR, OR, addition, rotation, and so forth. In this paper, we analyze the security ofthe SASI protocol, a recently proposed ultralightweight RFID protocol with betterclaimed security than earlier protocols. We show that SASI does not achieveresistance to tracking, which is one of its design objectives.