## 2 Preliminaries
### The ULRAS Protocol  
The designers of ULRAS only use exclusive-or operation \(\oplus\) and a special left rotation operation called RR method in the structure of their protocol, inspired by Gossamer protocol [13]. In the RR method, to compute the left rotation of \(X\) by using variable \(Y\), which is of the same length, i.e., \(RR(X,Y)\), one can do as follows:  
* presents \(X\) and \(Y\) in their binary forms;
* computes \(X^{\prime}=\mathit{Reverse}(X,Y)\), which inverses only those bits of \(X\) for which their correspondence bit-place in \(Y\) are \"1\";
* computes \(RR(X,Y)\) as \(Rot(X^{\prime},Y)\) which is the left rotation of \(X^{\prime}\) by amount of \(Y\)\(mod\)\(L\), where \(L\) is the length of \(X\) and \(Y\). In this section, we give a brief description of the ULRAS protocol, where we follow the notations that are represented in Table 1. While the designers [24] have used \"\(Rot(X,Y)\) through \(RR\) method\" to denote \(RR(X,Y)\), in our description, we use \(RR(X,Y)\) for the sake of simplicity. As shown in Figure 1, the ULRAS protocol runs as below:  
1. The reader starts the protocol by generating and sending a random time stamp \(T_{R}\) and Query to the tag. 2. The tag, once received the message, verifies whether \(T_{R}\stackrel{{?}}{{>}}T_{t}\). If \(T_{R}>T_{t}\), the tag: * generates a random number \(R_{t}\); * calculates \(M_{1}\) as below: \(M_{1}=RR(RR(ID\oplus K\oplus R_{t}\oplus T_{R},ID+R_{t}),K\oplus R_{t})\); * and sends \(IDS\), \(M_{1}\) and \(R_{t}\) to the reader. 3. Upon reception of the message, the reader sends \(IDS\), \(M_{1}\), \(R_{t}\) and \(T_{R}\) to the back-end database. 4. Once the back-end database receives the message, it verifies whether the received \(IDS\) matches with \(IDS_{new}\) or \(IDS_{old}\). If the back-end database does not find any match, stops the protocol; otherwise, the database: * calculates \(M_{1}^{\prime}=RR(RR(ID\oplus K_{X}\oplus R_{t}\oplus T_{R},ID+R_{t}),K_{X} \oplus R_{t})\) which \(X\) is \(new\) or \(old\). Then it verifies whether \(M_{1}^{\prime}\stackrel{{?}}{{=}}M_{1}\). If \(M_{1}^{\prime}\
eq M_{1}\), the back-end database stops the protocol; otherwise, it does as follows: * authenticates the tag; * generates \(i_{sub}\in\{1,2,3,4\}\) and computes \(M_{2}\) and \(M_{3}\) as below: \(M_{2}=RR(RR(ID\oplus R_{t}\oplus T_{R},ID\oplus R_{t}),K_{X}+R_{t})\); \(M_{3}=RR(i_{sub}\oplus K_{X},K_{X}\oplus R_{t}\oplus T_{R})\); * generates sub-key as below: \(subkey=Rot(K_{X}(i_{sub}),K_{X}\oplus R_{t}\oplus T_{R})\); * updates its values as below: \(IDS_{old}=IDS_{new}\); \(K_{old}=K_{new}\); \(IDS_{new}=Rot(IDS\oplus R_{t},K\oplus R_{t}\oplus T_{R})\); *\(K_{new}\) is generated by replacing \(K_{i_{sub}}\); * and sends \(M_{2}\) and \(M_{3}\) through reader to the tag. 5. Upon receipt of the messages, the tag calculates \(M_{2}^{\prime}=RR(RR(ID\oplus R_{t}\oplus T_{R},ID\oplus R_{t}),K+R_{t})\) with its local values and then verifies whether \(M_{2}^{\prime}=M_{2}\). If \(M_{2}^{\prime}\)=\(M_{2}\), the tag: * successfully authenticates the back-end server; * extracts \(i_{sub}\) from \(M_{3}\); * generates new sub-key as \(subkey=Rot(K(i_{sub}),K\oplus R_{t}\oplus T_{R})\); * and finally updates its \(IDS,K\) and \(T_{t}\) as below: \(IDS_{new}=Rot(IDS\oplus R_{t},K\oplus R_{t}\oplus T_{R})\); \(K_{new}\) is generated by replacing \(K_{i_{sub}}\). [PERSON] and [PERSON] in [25], presented a secret disclosure attack and also reader impersonation attack against ULRAS and then presented the improved version of it and claimed their improvement provides security against various kind of attacks. However, their improvement such as its predecessor is still insecure. [PERSON] and [PERSON] in their improvement removed \(RR\) method and instead used \(Rot(X,Y)\). They also slightly modified the messages of the protocol. Because of the close similarity to the ULRAS protocol, we ignore the detailed description of the [PERSON] and [PERSON] protocol and only provide a brief description of it in Figure 2.