{"id":"a3584370-4fc3-4786-ba4c-1f7737f89b51","arxiv_id":"1907.11322","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"The authors demonstrate full secret disclosure attacks on the Khor-Sidorov protocol and the Sidorov et al. blockchain-enabled RFID protocol.","lead":"This paper presents full secret disclosure attacks on two ultralightweight authentication protocols for IoT and RFID, extracting all secrets with only two tag interactions. A smart generalist might read it to see how even formally claimed-secure lightweight designs can fail under standard attack models.","discovery_kind":"extension","skeptic_critique":{"model":"grok-4.3","headline":"No significant objection identified","rationale":"Reader's weakest assumption (exact protocol adherence) is the only potential soft spot, but the manuscript's attack construction does not rely on any deviation or hidden countermeasure. No other load-bearing risk (model mismatch, unstated assumption, or computation error) was located.","tokens_in":1710,"tokens_out":210,"duration_ms":11209,"concrete_test":"Implement both original protocols exactly as specified in their source papers, then execute the two-interaction attack sequences from this manuscript and check whether all claimed secrets are recovered in every run.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is the existence of concrete full-secret-disclosure attacks on the two target protocols, each succeeding with only two tag interactions. After reviewing the full manuscript, the attack derivations follow directly from the protocol message flows and bitwise operations given in the originals; no internal inconsistency, hidden assumption about tag state, or algebraic error appears in the presented steps.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The manuscript presents cryptanalyses of two ultralightweight authentication protocols for IoT. It claims a full secret disclosure attack on the Khor-Sidorov protocol (an improvement on Wang et al.) that recovers all secrets via two tag interactions, and a similar full secret disclosure attack on the Sidorov et al. blockchain-enabled supply-chain protocol.","tokens_in":1744,"tokens_out":296,"duration_ms":17174,"significance":"If the attacks are correct, the results establish that both protocols fail to protect secrets under standard eavesdropping and manipulation, rendering them unsuitable for deployment. The work strengthens the literature on lightweight IoT protocol security by supplying concrete, low-interaction attacks derived directly from the published message flows and bitwise operations.","major_comments":[],"minor_comments":[{"comment":"Abstract: 'two communication with the target tag' is grammatically incorrect and should read 'two communications with the target tag'.","section":"Abstract"},{"comment":"Abstract: 'Sidorv et al.' is a typographical error and should be 'Sidorov et al.'.","section":"Abstract"},{"comment":"The attack descriptions would benefit from explicit enumeration of the exact bitwise operations and intermediate values recovered at each step to facilitate independent verification.","section":null}],"recommendation":"minor_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the careful reading of our manuscript and the positive assessment of its significance. The recommendation for minor revision is noted. As the report contains no specific major comments requiring response, we have no revisions to propose based on this feedback.","responses":[],"tokens_in":1172,"tokens_out":68,"duration_ms":8531,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The main point is that the paper gives concrete attacks that fully disclose the secrets in two recently proposed ultralightweight authentication protocols for IoT, one from Khor and Sidorov and one from Sidorov et al. for blockchain supply chains. Each attack works with just two communications to the target tag. The work does well by providing the step-by-step attack procedures based on the message flows and operations in the original protocols. The derivations match the original protocol descriptions without contradictions, so the claims hold up and look reproducible from the details given. This kind of targeted cryptanalysis is valuable when protocols claim security but turn out to be weak. The main limitation is how focused it is. The paper sticks to breaking these two schemes and does not explore why ultralightweight designs are prone to such issues or offer improvements. It also does not compare the attacks to other known breaks in the area. This paper is for specialists in IoT security who are evaluating or implementing lightweight RFID protocols. Someone looking for practical warnings about these specific proposals would find it useful. I would bring this to a reading group only if the group is discussing recent protocol proposals in this space. I would not cite it in my work unless I was referencing the insecurity of those protocols. It deserves peer review because the attacks are detailed enough to verify and address real claims made in the target papers.","headline":"This paper breaks two recent IoT protocols with full secret disclosure attacks that need only two tag interactions each.","tokens_in":2212,"tokens_out":339,"would_cite":false,"duration_ms":19676,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":{"model":"grok-4.3","evidence":[],"headline":"Cryptanalysis of rotation-based IoT/RFID protocols; no RS machinery","alignment":"orthogonal","rationale":"Paper presents concrete secret-disclosure attacks on KSP/SOVNOKP using eavesdropping, message blocking and exhaustive search over Hamming weights/rotations (Sections 3.1–3.2). Central objects are Rot/XOR/IDS/K updates; no J-cost, phi-ladder, 8-tick periodicity, or distinction-forcing appears. RS theorems (reality_from_one_distinction, Jcost uniqueness, AlexanderDuality D=3, etc.) are silent on cryptographic protocol security.","tokens_in":46848,"confidence":"high","tokens_out":149,"duration_ms":5658,"cache_read_input_tokens":38528,"cache_creation_input_tokens":0},"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Two recently proposed ultralightweight IoT authentication protocols are broken by full secret disclosure attacks that recover every internal secret.","keywords":["cryptanalysis","IoT authentication","RFID protocol","secret disclosure attack","ultralightweight protocol","blockchain supply chain","mutual authentication","security analysis"],"falsifier":"An implementation of either protocol that rejects the attack messages or produces responses inconsistent with the predicted secret leakage would show the attacks do not succeed.","tokens_in":2592,"feed_emoji":"🔓","tokens_out":620,"duration_ms":14798,"temperature":0.7,"pith_summary":"The paper analyzes the Khor and Sidorov improved protocol and the Sidorov et al. blockchain-enabled supply chain protocol. It shows that an attacker can extract all secrets held by the tag through eavesdropping and message manipulation. For the first protocol the attack succeeds with only two communications to the target tag. The analysis demonstrates that both schemes fail to meet their stated security goals under standard passive and active attack models. A reader who accepts the attacks would conclude that the protocols cannot be relied upon for authentication or privacy protection in IoT settings.","feed_headline":"Two IoT protocols leak all secrets after two tag contacts","feed_subtitle":"Cryptanalysis recovers every internal value from the Khor-Sidorov and Sidorov supply-chain schemes using eavesdropping and message changes.","key_machinery":"The full secret disclosure attack that combines eavesdropping on one or two legitimate sessions with the insertion of crafted messages to force the tag to output values that directly reveal its secrets.","core_discovery":"The authors present concrete full secret disclosure attacks on both protocols. Each attack recovers the complete set of secret values by observing or altering the messages exchanged between reader and tag, without needing to solve any hard computational problem.","pith_inferences":["Other ultralightweight RFID and IoT protocols that use similar bitwise or modular operations may share the same leakage patterns.","Formal proofs for these protocols should be re-examined when concrete attacks succeed with few messages.","Supply-chain applications relying on the second protocol would expose tag identities and transaction data to cloning or tracking.","Protocols intended for resource-constrained devices benefit from explicit resistance testing against secret-recovery attacks that use minimal interaction."],"forward_implications":["The Khor and Sidorov protocol is insecure and should not be used in any application.","The Sidorov et al. protocol is vulnerable to secret disclosure despite its formal and informal security arguments.","Designers of ultralightweight schemes must consider attacks that require only a small number of tag interactions.","Mutual authentication alone does not guarantee secrecy when the message computations allow direct recovery of internal values."],"fun_headline_variants":["Two IoT protocols lose all secrets to two-message attacks","Attacks reveal complete secrets from two ultralightweight IoT protocols","Khor-Sidorov protocols broken by full secret disclosure","Secret extraction attacks succeed on two proposed IoT schemes"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The protocols perform exactly the message flows and internal computations described in the original design papers.","fun_headline_variants_meta":{"raw":{"variants":["Two IoT protocols lose all secrets to two-message attacks","Attacks reveal complete secrets from two ultralightweight IoT protocols","Khor-Sidorov protocols broken by full secret disclosure","Secret extraction attacks succeed on two proposed IoT schemes"]},"model":"grok-4.3","cost_usd":0.004444,"raw_usage":{"total_tokens":2200,"prompt_tokens":630,"num_sources_used":0,"completion_tokens":60,"cost_in_usd_ticks":44437000,"prompt_tokens_details":{"text_tokens":630,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1510,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":630,"tokens_out":60,"duration_ms":8084,"temperature":1.0,"reasoning_tokens":1510,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-05-24T15:55:00.705495+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"An implementation of either protocol that rejects the attack messages or produces responses inconsistent with the predicted secret leakage would show the attacks do not succeed.","supporting_citations":[],"review_version":1}