## 3 Security Analysis of ULRAS Protocol
### Traceability Attack  
Traceability attacks often occur when a constant information binded with protocols' parties leak through the exchanged messages over protocol. Now, in this section, we present a traceability attack against the ULRAS protocol which once again shows that this protocol is not secure.  
In the de-synchronization attack which was presented in Section 3.1, the adversary can determine \(x\). Given that \(x=K_{X}\oplus R_{t}\oplus T_{R}\)_mod_\(L\) and the adversary knows \(R_{t}\oplus T_{R}\), \(x\) leaks log\({}_{2}\)L bits information from \(K_{X}\), if \(L=2^{n}\), where \(n\) is an integer. In this case, the above de-synchronization attack can be used as a traceability attack on a target tag \(\mathcal{T}\), as long as the first quarter of \(K_{X}\) has not been updated. To do this traceability attack, a passive adversary eavesdrops \(T_{R}\), \(R_{t}\) and \(M_{3}\) and determines \(x\). Assuming that \(i_{sub}\
eq 1\) the tag \(\mathcal{T}\) will not update the first quarter of \(K_{X}\), which \(x\) depends on. Hence, in the next run of the ULRAS protocol, given a tag \(\mathcal{T}^{\prime}\), the adversary can eavesdrop a session between \(\mathcal{T}^{\prime}\) and the reader \(\mathcal{R}\) to determine log\({}_{2}\)L bits of the first quarter of \(K_{X}\) and to decide whether \(\mathcal{T}^{\prime}\stackrel{{?}}{{=}}\mathcal{T}\). Here, \(\mathcal{T}\) is the target tag which previously adversary eavesdropped its authentication session with the reader and saved its protocol's exchanged messages and \(\mathcal{T}^{\prime}\) is a new tag which adversary wants to know whether it is the target tag. The algorithm of the above attack is also shown in Algorithm 1. The adversary'ssuccess probability to trace the tag is '1' and its complexity is only two runs of the protocol and some offline computations.  
```
Data:\(T_{R},R_{t},M_{3}=RR(i_{sub}\oplus K_{X},K_{X}\oplus R_{t}\oplus T_{R})==(i_{sub} \oplus R_{t}\oplus T_{R})\llldot x,i_{sub},i^{\prime}_{sub}\
eq 1\) Result: decides whether \(\mathcal{T}^{\prime}\stackrel{{?}}{{=}}\mathcal{T}\) where \(\mathcal{T}\) is an adversary's target tag.  1. Eavesdrops a session between reader and \(\mathcal{T}\) and stores  \(T_{R},R_{t},M_{3}=RR(i_{sub}\oplus K_{X},K_{X}\oplus R_{t}\oplus T_{R})==(i_{ sub}\oplus R_{t}\oplus T_{R})\llldot x\);  2. Obtains \(x=K_{X}\oplus R_{T}\oplus T_{R}\)\(mod\)\(L\) and \(i_{sub}\) by using \(M_{3}\), \(T_{R}\) and \(R_{t}\) and this fact  \(i_{sub}\in\{2,3,4\}\);  3. Retrieves \(log_{2}L\) bits information from \(K_{X}\) by using \(x\);  4. Eavesdrops a session between \(\mathcal{T}^{\prime}\) and the reader;  5. Obtains \(x^{\prime}=K^{\prime}_{X}\oplus R^{\prime}_{T}\oplus T^{\prime}_{R}\)\(mod\)\(L\) and \(i^{\prime}_{sub}\) by using \(M^{\prime}_{3}\), \(T^{\prime}_{R}\) and \(R^{\prime}_{t}\) and this fact  \(i^{\prime}_{sub}\in\{2,3,4\}\);  6. Retrieves \(log_{2}L\) bits information from \(K^{\prime}_{X}\) by using \(x^{\prime}\);  7. Compares the retrieved bits of \(K^{\prime}_{X}\) with \(K_{X}\) to decide whether \(\mathcal{T}^{\prime}\stackrel{{?}}{{=}}\mathcal{T}\).
```  
**Algorithm 1**The algorithm of proposed traceability attack against ULRAS protocol