Ððððööö Øøø Blockin× Ò×ø Ääòòòö Êêáá Ùøøøòøø Blockin Blockinøøóò Èöóøó Blockinóð×

Authenti ation Proto ols Matthias Krause and Dirk Stegemann Theoreti al Computer S ien e University of Mannheim Mannheim, Germany Abstra t. The limited omputational resour es available on RFID tags imply a need for spe ially designed authenti ation proto ols. The light weight authenti ation proto ol HB+ proposed by Juels and Weis seems urrently se ure for several RFID appli ations, but is too slow for many pra ti al settings. As a possible alternative, authenti ation proto ols based on hoosing random elements from L se ret linear n-dimensional subspa es of GF (2) (so alled linear (n, k, L)-proto ols), have been onsidered. We show that to a ertain extent, these proto ols are vulnerable to algebrai atta ks. Parti ularly, our approa h allows to break Ci ho«, Klonowski and Kutyaowski's CKK2-proto ol, a spe ial linear (n, k, 2)-proto ol, for pra ti ally re ommended parameters in less than a se ond on a standard PC. Moreover, we show that even unrestri ted (n, k, L)-proto ols an be e iently broken if L is too small.