Pith. sign in

REVIEW 3 minor 30 references

Cryptanalysis of two recently proposed ultralightweight authentication protocol for IoT

T0 review · 0 major / 3 minor · reviewed 2026-05-24 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Two recently proposed ultralightweight IoT authentication protocols are broken by full secret disclosure attacks that recover every internal secret.

desk verdict This paper breaks two recent IoT protocols with full secret disclosure attacks that need only two tag interactions each. read the letter →

arxiv 1907.11322 v1 pith:GGW65KF6 submitted 2019-07-25 cs.CR

Masoumeh Safkhani , Nasour Bagheri This is my paper
classification cs.CR
keywords cryptanalysisIoTauthenticationRFIDprotocolsecretdisclosureattackultralightweightblockchainsupplychainmutualsecurityanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper analyzes the Khor and Sidorov improved protocol and the Sidorov et al. blockchain-enabled supply chain protocol. It shows that an attacker can extract all secrets held by the tag through eavesdropping and message manipulation. For the first protocol the attack succeeds with only two communications to the target tag. The analysis demonstrates that both schemes fail to meet their stated security goals under standard passive and active attack models. A reader who accepts the attacks would conclude that the protocols cannot be relied upon for authentication or privacy protection in IoT settings.

What carries the argument

The full secret disclosure attack that combines eavesdropping on one or two legitimate sessions with the insertion of crafted messages to force the tag to output values that directly reveal its secrets.

What would settle it

An implementation of either protocol that rejects the attack messages or produces responses inconsistent with the predicted secret leakage would show the attacks do not succeed.

Watch

Extended reading notes

Core claim

The authors present concrete full secret disclosure attacks on both protocols. Each attack recovers the complete set of secret values by observing or altering the messages exchanged between reader and tag, without needing to solve any hard computational problem.

Load-bearing premise

The protocols perform exactly the message flows and internal computations described in the original design papers.

Editorial extensions

If this is right

  • The Khor and Sidorov protocol is insecure and should not be used in any application.
  • The Sidorov et al. protocol is vulnerable to secret disclosure despite its formal and informal security arguments.
  • Designers of ultralightweight schemes must consider attacks that require only a small number of tag interactions.
  • Mutual authentication alone does not guarantee secrecy when the message computations allow direct recovery of internal values.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Other ultralightweight RFID and IoT protocols that use similar bitwise or modular operations may share the same leakage patterns.
  • Formal proofs for these protocols should be re-examined when concrete attacks succeed with few messages.
  • Supply-chain applications relying on the second protocol would expose tag identities and transaction data to cloning or tracking.
  • Protocols intended for resource-constrained devices benefit from explicit resistance testing against secret-recovery attacks that use minimal interaction.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

0 major / 3 minor

Summary. The manuscript presents cryptanalyses of two ultralightweight authentication protocols for IoT. It claims a full secret disclosure attack on the Khor-Sidorov protocol (an improvement on Wang et al.) that recovers all secrets via two tag interactions, and a similar full secret disclosure attack on the Sidorov et al. blockchain-enabled supply-chain protocol.

Significance. If the attacks are correct, the results establish that both protocols fail to protect secrets under standard eavesdropping and manipulation, rendering them unsuitable for deployment. The work strengthens the literature on lightweight IoT protocol security by supplying concrete, low-interaction attacks derived directly from the published message flows and bitwise operations.

minor comments (3)
  1. [Abstract] Abstract: 'two communication with the target tag' is grammatically incorrect and should read 'two communications with the target tag'.
  2. [Abstract] Abstract: 'Sidorv et al.' is a typographical error and should be 'Sidorov et al.'.
  3. The attack descriptions would benefit from explicit enumeration of the exact bitwise operations and intermediate values recovered at each step to facilitate independent verification.

Simulated Author's Rebuttal

0 responses · 0 unresolved

We thank the referee for the careful reading of our manuscript and the positive assessment of its significance. The recommendation for minor revision is noted. As the report contains no specific major comments requiring response, we have no revisions to propose based on this feedback.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity identified

full rationale

The manuscript presents concrete cryptanalytic attacks on two external protocols (Khor-Sidorov and Sidorov et al.). Attack derivations are obtained by direct inspection of the message flows, bitwise operations, and state updates given in the cited original papers; no equation, parameter, or uniqueness claim inside this work reduces to a self-definition, fitted input, or self-citation chain. The central result (full secret disclosure in two tag interactions) is therefore an independent verification step rather than a tautology.

Assumptions & free parameters 0 free parameters · 0 assumptions · 0 invented entities

This is a cryptanalysis paper; it relies on standard Dolev-Yao style attacker capabilities and the published protocol descriptions rather than introducing new parameters, axioms, or entities.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Cryptanalysis of two recently proposed ultralightweight authentication protocol for IoT." pith.science (2026). https://pith.science/paper/GGW65KF6

@misc{pith2026190711322,
  author       = {Pith},
  title        = {Pith review of: Cryptanalysis of two recently proposed ultralightweight authentication protocol for IoT},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GGW65KF6}},
  note         = {Machine review of arXiv:1907.11322}
}
read the original abstract

By expanding the connection of objects to the Internet and their entry to human life, the issue of security and privacy has become important. In order to enhance security and privacy on the Internet, many security protocols have been developed. Unfortunately, the security analyzes that have been carried out on these protocols show that they are vulnerable to one or few attacks, which eliminates the use of these protocols. Therefore, the need for a security protocol on the Internet of Things (IoT) has not yet been resolved. Recently, Khor and Sidorov cryptanalyzed the Wang et al. protocol and presented an improved version of it. In this paper, at first, we show that this protocol also does not have sufficient security and so it is not recommended to be used in any application. More precisely, we present a full secret disclosure attack against this protocol, which extracted the whole secrets of the protocol by two communication with the target tag. In addition, Sidorv et al. recently proposed an ultralightweight mutual authentication RFID protocol for blockchain enabled supply chains, supported by formal and informal security proofs. However, we present a full secret disclosure attack against this protocol as well.

Figures

Figures reproduced from arXiv: 1907.11322 by the authors.

Figure 1
Figure 1. Mutual authentication phase of KSP [9] [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Mutual authentication phase of SOVNOKP [23] 1. The adversary eavesdrops a session of the protocol between the target tag and a legitimate reader, where, the reader generates an arbitrary nonce r and sends it to the tag, along with Hello. 2. The tag, when receives the message, generates a random number q and com￾putes s = Rot(q ⊕ r, wt(q)), T = IDSnew ⊕ r ⊕ q and U = Rot(IDSold ⊕ IDSnew, wt(q)) and sends skT kU to th… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

30 extracted references · 30 canonical work pages

  1. [1]

    S. F. Aghili, M. Ashouri-Talouki, and H. Mala. Dos, impers onation and de- synchronization attacks against an ultra-lightweight rfid mutual authentication protocol for IoT. The Journal of Supercomputing , 74(1):509–525, 2018

    work page 2018

  2. [2]

    S. F. Aghili, H. Mala, P. Kaliyar, and M. Conti. Seclap: Sec ure and lightweight rfid authentication protocol for medical iot. Future Generation Computer Systems , 101:621 – 634, 2019

    work page 2019

  3. [3]

    Ahmadian, M

    Z. Ahmadian, M. Salmasizadeh, and M. R. Aref. Desynchroni zation attack on RAPP ultralightweight authentication protocol. Inf. Process. Lett. , 113(7):205– 209, 2013

    work page 2013

  4. [4]

    Avoine, X

    G. Avoine, X. Carpent, and B. Martin. Privacy-friendly sy nchronized ultra- lightweight authentication protocols in the storm. J. Network and Computer Ap- plications, 35(2):826–843, 2012

    work page 2012

  5. [5]

    Bagheri, M

    N. Bagheri, M. Safkhani, P. Peris-Lopez, and J. E. Tapiado r. Weaknesses in a new ultralightweight RFID authentication protocol with permu tation - RAPP. Security and Communication Networks , 7(6):945–949, 2014

    work page 2014

  6. [6]

    Baghery, B

    K. Baghery, B. Abdolmaleki, and M. Emadi. Game-based cryp tanalysis of a lightweight CRC-based authentication protocol for EPC tag s. AUT Journal of Electrical Engineering, 46(1):27–36, 2014

    work page 2014

  7. [7]

    H.-Y. Chien. SASI: A new ultralightweight RFID authentic ation protocol providing strong authentication and strong integrity. IEEE Trans. Dependable Sec. Comput. , 4(4):337–340, 2007

    work page 2007

  8. [8]

    K. Fan, P. Song, and Y. Yang. ULMAP: Ultralightweight NFC M utual Authen- tication Protocol with Pseudonyms in the Tag for IoT in 5G. Mobile Information Systems, 2017, 2017

    work page 2017

Show all 30 references
  1. [9]

    J. H. Khor and M. Sidorov. Weakness of ultra-lightweight m utual authentication protocol for iot devices using rfld tags. In 2018 Eighth International Conference on Information Science and Technology (ICIST) , pages 91–97. IEEE, 2018

    2018

  2. [10]

    H. Luo, G. Wen, J. Su, and Z. Huang. SLAP: Succinct and ligh tweight authenti- cation protocol for low-cost RFID system. Wireless Networks, pages 1–10, 2016

    2016

  3. [11]

    Mukherjee, R

    B. Mukherjee, R. L. Neupane, and P. Calyam. End-to-end io t security middleware for cloud-fog communication. In Cyber Security and Cloud Computing (CSCloud), 2017 IEEE 4th International Conference on , pages 151–156. IEEE, 2017

    2017

  4. [12]

    Peris-Lopez, J

    P. Peris-Lopez, J. C. Hernandez-Castro, J. M. Estevez-T apiador, and A. Ribagorda. LMAP: A real lightweight mutual authentication protocol fo r low-cost RFID tags. In Proceedings of RFIDSec06 Workshop on RFID Security , Graz,Austria , 12-14 July 2006

    2006

  5. [13]

    R. C.-W. Phan. Cryptanalysis of a new ultralightweight R FID authentication pro- tocol - SASI. IEEE Transactions on Dependable and Secure Computing , 6(4):316– 320, 2009

    2009

  6. [14]

    R. A. Rahman and B. Shah. Security analysis of IoT protoco ls: A focus in CoAP. In Big Data and Smart City (ICBDSC), 2016 3rd MEC International Conference on, pages 1–7. IEEE, 2016

    2016

  7. [15]

    Ronen, A

    E. Ronen, A. Shamir, A.-O. Weingarten, and C. OFlynn. Iot goes nuclear: Creating a zigbee chain reaction. In Security and Privacy (SP), 2017 IEEE Symposium on , pages 195–212. IEEE, 2017

    2017

  8. [16]

    Safkhani

    M. Safkhani. Cryptanalysis of r2ap an ultralightweight authentication protocol for rfid. Journal of Electrical and Computer Engineering Innovation s, 6(1):107–114, 2018

    2018

  9. [17]

    Safkhani and N

    M. Safkhani and N. Bagheri. Generalized desynchronizat ion attack on UMAP: application to rcia, kmap, SLAP and sasi + protocols. IACR Cryptology ePrint Archive, 2016:905, 2016

    2016

  10. [18]

    Safkhani and N

    M. Safkhani and N. Bagheri. Passive secret disclosure at tack on an ultralightweight authentication protocol for internet of things. The Journal of Supercomputing , 73(8):3579–3585, 2017

    2017

  11. [19]

    Safkhani, N

    M. Safkhani, N. Bagheri, and M. Shariat. On the security o f rotation operation based ultra-lightweight authentication protocols for RFI D systems. Future Inter- net, 10(9):82, 2018

    2018

  12. [20]

    Safkhani, Y

    M. Safkhani, Y. Bendavid, S. Rostampour, and N. Bagheri. On designing lightweight rfid security protocols for medical iot. Crypto logy ePrint Archive, Report 2019/851, 2019. https://eprint.iacr.org/2019/851

    2019

  13. [21]

    Sarvabhatla, M

    M. Sarvabhatla, M. Giri, and C. S. Vorugunti. Cryptanaly sis of a biometric-based user authentication scheme for heterogeneous wireless sen sor networks. In Contem- porary Computing (IC3), 2014 Seventh International Confer ence on , pages 312–

    2014

  14. [22]

    Serhrouchni and P

    A. Serhrouchni and P. Minet. A lightweight mutual authen tication protocol for the IoT. Mobile and Wireless Technologies 2017: ICMWT 2017 , 425:3, 2017

    2017

  15. [23]

    Sidorov, M

    M. Sidorov, M. T. Ong, R. V. Sridharan, J. Nakamura, R. Ohm ura, and J. H. Khor. Ultralightweight mutual authentication rfid protoco l for blockchain enabled supply chains. IEEE Access, 7:7273–7285, 2019

    2019

  16. [24]

    Taylor, D

    M. Taylor, D. Reilly, and B. Lempereur. An access control management protocol for internet of things devices. Network Security , 2017(7):11–17, 2017

    2017

  17. [25]

    Tewari and B

    A. Tewari and B. Gupta. Cryptanalysis of a novel ultra-li ghtweight mutual authen- tication protocol for IoT devices using RFID tags. The Journal of Supercomputing , 73(3):1085–1102, 2017

    2017

  18. [26]

    Y. Tian, G. Chen, and J. Li. A new ultralightweight RFID au thentication protocol with permutation. IEEE Communications Letters , 16(5):702–705, 2012

    2012

  19. [27]

    Wang, C.-M

    K.-H. Wang, C.-M. Chen, W. Fang, and T.-Y. Wu. On the secur ity of a new ultra-lightweight authentication protocol in iot environ ment for RFID tags. The Journal of Supercomputing , pages 1–6, 2017

    2017

  20. [28]

    Z. Wang. A privacy-preserving and accountable authenti cation protocol for iot end-devices with weaker identity. Future Generation Computer Systems , 2017

    2017

  21. [29]

    Y. Yin, M. Xu, Q. Zhang, and J. Chen. Cryptanalysis of a new lightweight rfid mutual authentication protocol with cache in reader for IoT

  22. [30]

    Zhuang, Y

    X. Zhuang, Y. Zhu, and C. Chang. A new ultralightweight RF ID protocol for low- cost tags: R 2 AP. Wireless Personal Communications , 79(3):1787–1802, 2014

    2014

Pith tools

Reviewed May 24, 2026 · model on record in the stance chip above.