On the (im)possibility of receiving security beyond 2l using an l-bit PRNG: the case of Wang et. al. protocol

Recently,Wang et al. analyzed the security of two EPC C1-G2 compliant RFID authentication protocols, called RAPLT and SRP, and proved that these protocols are vulnerable against de-synchronization and secret disclosure attacks. The time complexity of their attacks were O(2). In addition, they proposed an improved version of SRP entitled SRP, for which they claim the security would be O(2). However, in this letter, we analyze the security of SRP and show that the complexity of retrieving all secret parameters of a given tag is O(2), similar to its predecessor protocol.