How can a RFID (Radio Frequency Identification Devices) system prove that two or more RFID tags are in the same location? Previous researchers have proposed yoking-proof and grouping-proof techniques to address this problem – and when these turned out to be vulnerable to replay attacks, a new existence-proof technique was proposed. We critique this class of existence-proofs and show it has three problems: (a) a race condition when multiple readers are present; (b) a race condition when multiple tags are present; and (c) a problem determining the number of tags. We present two new proof techniques, a secure timestamp proof (secTS-proof) and a timestampchaining proof (chaining-proof) that avoid replay attacks and solve problems in previously proposed techniques.
Chih-Chung Lin, Yuan-Cheng Lai, J. D. Tygar, Chuan