Privacy of recent RFID authentication protocols

Privacy is a major concern in RFID systems, especially withwidespread deployment of wireless-enabled interconnected personal de-vices e.g. PDAs and mobile phones, credit cards, e-passports, even cloth-ing and tires. An RFID authentication protocol should not only allowa legitimate reader to authenticate a tag but it should also protect theprivacy of the tag against unauthorized tracing: an adversary should notbe able to get any useful information about the tag for tracking or dis-covering the tag's identity. In this paper, we analyze the privacy of somerecently proposed RFID authentication protocols (2006 and 2007) andshow attacks on them that compromise their privacy. Our attacks con-sider the simplest adversaries that do not corrupt nor open the tags. Wedescribe our attacks against a general untraceability model; from expe-rience we view this endeavour as a good practice to keep in mind whendesigning and analyzing security protocols.