# 5G-Compliant Authentication Protocol for RFID
## 4 Analysis
### Active Adversaries
If \(\mathcal{A}\) can compute \(k_{t}\), then it can also distinguish the flows of the 5G-compliant RFID protocol from random flows. **Corollary 2**: _An active adversary cannot forge new valid flows of the 5G-compliant RFID protocol without knowing the private key \(k_{t}\)._  
We have shown that an adversary \(\mathcal{A}\) cannot modify the flows of the 5G-compliant RFID protocol so that they remain valid. To compute new valid flows, \(\mathcal{A}\) must know the private key used to generate them (the _hi_ are one-way keyed cryptographic functions). As observed in the previous Section, the authentication in 5G-AKA is implicit. This means that although the parties may accept a message as valid, the authentication is not completed until a valid \(K_{SEAF}\) is computed and the derived keys are used. The computation of \(K_{SEAF}\) is not possible without the private key, so replay attacks mainly focus on privacy and DoS (de-synchronizing the parties) attacks. **Theorem 3**: _The 5G-compliant RFID protocol is secure against replay attacks._  
We first prove that the replay of the first flow of each protocol: \(\langle r_{i}\), \(SUPICi\), \(PK1 Ci\), \(PK2 Ci\), \(AUTNi\rangle\), respectively \(\langle r_{S}\), \(ARt\), \(AUTNt\rangle\), do not have any significant effect (Lemmas 5 and 6). Then, we prove that the replay of the second flow of each protocol: \(\langle CONFi\rangle\) and \(\langle RESt,CKt\), \(IKt\), \(INTREST\rangle\), respectively, will not be accepted (Lemmas 7 and 8). **Lemma 5**: _The replay of a previously sent flow \(\langle r_{i}\), \(SUPICi\), \(PK1 Ci\), \(PK2 Ci\), \(AUTNi\rangle\) does not have any effect on the initialization procedure of 5G-compliant RFID protocol._  
Suppose that an adversary intercepts the first flow \(\langle r_{i}\), \(SUPICi\), \(PK1 Ci\), \(PK2 Ci\), \(AUTNi\rangle\), which in a normal execution would cause the reader to store the values \(SUPI\) and \(pk_{HN}\). Later, the adversary, even after the execution of other initialization procedures, replays this flow, impersonating the tag to the Reader. The Reader will check the authenticity of the flow and store \(SUPI\) and \(pk_{HN}\). The replay of flows will not have any effect on this protocol. **Lemma 6**: _The replay of a previously sent flow \(\langle r_{S}\), \(ARt\), \(AUTNt\rangle\) does not have a negative effect on the authentication procedure of 5G-compliant RFID protocol._  
Suppose that an adversary intercepts the first flow \(\langle r_{S}\), \(ARt\), \(AUTNt\rangle\), which in a normal execution would cause that reader to initiate an authentication request by sending the tag's subscriberidentity. Later, the adversary, even after the execution of other authentication procedures, replays this flow to the reader, impersonating the tag. The reader will check the authenticity of the flow and initialize the authentication procedure. However, because the genuine tag is not involved, the adversary cannot respond correctly to the challenge and the authentication will not be successful. This is exactly what happens in 5G-AKA when the adversary replays a previously intercepted \(GUTI\) or \(SUCI\). Therefore, this replay attack does not have any significant effect on 5G-compliant RFID protocol. The replay of a \(CONFi\) message will not be accepted by the tag in a different session. Proof. : Three options are possible, depending on when the adversary interrupts a previous legitimate communication. 1. The adversary intercepts the first flow: \(\langle r_{i}\), \(SUPCi\), \(PK1 Ci\), \(PK2 Ci\), \(AUTNi\rangle\), and later replays it, impersonating the tag to the reader. The reader then computes a valid \(CONFi\) that is stored by the adversary. 2. In the second flow, the adversary intercepts the valid \(CONFi\) computed by the Reader. 3. The adversary does not intercept any flow, just eavesdrops and stores \(CONFi\) during a legitimate communication.