## 3 Security Analysis of ULRAS Protocol
### De-Synchronization Attack  
A de-synchronization attack is a type of attack for which the adversary tries to do operations that lead to a shared value between protocols' parties to be updated to different values. Therefore, in this case, protocols' parties may not authenticate each other any more and therefore the adversary, by using this attack, can destroy the availability property of security protocols. A security protocol which does not have any of three main security properties, i.e., confidentiality, integrity or availability (or in brief CIA triangle) is not secure and it is not recommended to be used in any sensitive application. The ULRAS protocol's designers have claimed that, since the reader keeps a history of old shared \(IDS\) and \(K\), an adversary cannot de-synchronize the tag and the reader. However, in this section, we present an efficient attack to de-synchronize the tag and the reader. In our attack, the adversary employs the fact that the tag and the reader partially update the key in the last step of the protocol. Hence, if the adversary forces them to update different parts of \(K\), the tag and the reader will be de-synchronized. To do the attack, in a session of the protocol between the legitimate reader and the target tag \(\mathcal{T}\), the adversary does as follows:  
1. The reader sends \(T_{R}\) and Query to the tag. 2. The tag verifies whether \(T_{R}\stackrel{{? }}{{>}}T_{t}\), generates \(R_{t}\), calculates \(M_{1}=RR(RR(ID\oplus K\oplus R_{t}\oplus T_{R},ID+R_{t}),K\oplus R_{t})\), and sends \(IDS\), \(M_{1}\) and \(R_{t}\) to the reader. 3. The reader sends \(IDS\), \(M_{1}\), \(R_{t}\) and \(T_{R}\) to the back-end database. 4. The back-end database verifies the received \(M_{1}\), authenticates the tag, generates \(i_{sub}\in\{1,2,3,4\}\) and computes \(M_{2}=RR(RR(ID\oplus R_{t}\oplus T_{R},ID\oplus R_{t}),K_{X}+R_{t})\) and \(M_{3}=RR(i_{sub}\oplus K_{X},K_{X}\oplus R_{t}\oplus T_{R})\) and sends them to the reader. It then generates \(subkey=Rot(K_{X}(i_{sub}),K_{X}\oplus R_{t}\oplus T_{R})\) and updates the tag's parameters as below: \begin{table}
\begin{tabular}{c c c c} \hline \hline \(\mathbf{X}\) & \(\mathbf{Y}\) & \(\mathbf{X^{\prime}=\mathit{Reverse}(X,Y)}\) & \(\mathbf{X\oplus Y}\) \\ \hline
0000 & 1011 & 1011 & 1011 \\
0001 & 1011 & 1010 & 1010 \\
0010 & 1011 & 1000 & 1000 \\
0100 & 1011 & 1111 & 1111 \\
0101 & 1011 & 1110 & 1110 \\
0110 & 1011 & 1101 & 1101 \\
0111 & 1011 & 1100 & 1100 \\
1000 & 1011 & 0011 & 0011 \\
1001 & 1011 & 0010 & 0010 \\
1010 & 1011 & 0001 & 0001 \\
1011 & 1011 & 0000 & 0000 \\
1100 & 1011 & 0111 & 0111 \\
1101 & 1011 & 0110 & 0110 \\
1111 & 1011 & 0100 & 0100 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The truth table to show the equality of \(X^{\prime}=\mathit{Reverse}(X,Y)\) with \(X\oplus Y\). \(IDS_{old}=IDS_{new}\); \(K_{old}=K_{new}\); \(IDS_{new}=Rot(IDS\oplus R_{t},K\oplus R_{t}\oplus T_{R})\); \(K_{new}\) generated by replacing \(K_{i_{sub}}\);
5. The adversary, who has eavesdropped \(T_{R}\), \(R_{t}\), \(M_{2}\) and \(M_{3}\), manipulates \(M_{3}\) as follows: * Assuming \(x=K_{X}\oplus R_{t}\oplus T_{R}\)_mod_\(L\) and given that \(M_{3}=(i_{sub}\oplus R_{t}\oplus T_{R})\lll x\), because \(M_{3}=RR(i_{sub}\oplus K_{X},K_{X}\oplus R_{t}\oplus T_{R})=(i_{sub}\oplus K_{ X}\oplus K_{X}\oplus R_{t}\oplus T_{R})\lll(K_{X}\oplus R_{t}\oplus T_{R})=(i_{sub} \oplus R_{t}\oplus T_{R})\lll(K_{X}\oplus R_{t}\oplus T_{R})=(i_{sub}\oplus R_{ t}\oplus T_{R})\lll x\), the adversary can determine \(i_{sub}\) and also \(x\) by knowing \(M_{3}\) as below: * Given that the adversary already has eavesdropped \(R_{t}\) and \(T_{R}\), she can calculate \(R_{t}\oplus T_{R}\). On the other hand, \(i_{sub}\) has only three bits. Hence, given \(R_{t}\oplus T_{R}\) and \((i_{sub}\oplus R_{t}\oplus T_{R})\lll x\), it would be easy to determine the values of \(x\) and \(i_{sub}\), exclude that the value of \((i_{sub}\oplus R_{t}\oplus T_{R})\lll x\) is rotation invariant which has no high probability and we omit it here for simplicity.