Destructive. It refers to the class of adversaries for who tampering with a tag results in its destruction. In a more formal sense, a Destructive adversary is not allowed to issue any query with vtag a er requesting C (vtag).

Forward. A er a Forward adversary corrupts a tag, she is only allowed to corrupt other tags or terminate.

Weak. is class captures the set of adversaries who cannot corrupt any tag.

Orthogonal to this classi cation, we also consider the case in which adversaries do not have access to the R oracle. Such adversaries are referred to as Narrow and for every class listed abo e, we consider a Narrow counterpart.

Narrow-Strong. is class denotes the set of Strong adversaries who do not access R .

Narrow-Destructive. isincludesallDestructiveadversarieswhocannotaccessR .

Narrow-Forward. is is equivalent to Narrow [ Forward.

Narrow-Weak. is is the class of the weakest adversaries who can neither corrupt tags nor access R .

Regarding the relation between those adversarial classes, it is clear that for every non-narrow classP wehaveNarrow P P . ItalsoholdsthatWeak Forward Destructive Strong and Narrow-Weak Narrow-Forward Narrow-Destructive Narrow-Strong.

. . Matching Con ersation

Before de ning the necessary properties of an RFID scheme, we formalize the event that a tag and a reader have an undisturbed protocol instance. is notion will prove to be useful to de ne correctness and security for RFID systems.

De nition . (Matching Conversation)

We say that a protocol instance had a matching con ersation with the tag ID if they exchanged well interleaved and faithfully (but maybe with some time delay) messages until is completed.

. . Correctness

Basically, correctness formalizes the fact that whenever the reader and a tag ID participate in an undisturbed protocol session, the reader authenticates the tag, that is, it ends up with Output = ID, except with a small negligible probability. e di erence between our de nition and vaudenay’s de nition of correctness is that we take into account all possible actions that may have happened in the past for the system. at is, we require that a legitimate tag remains successful in authenticating itself and an illegitimate one gets rejected regardless of the past events that occurred in the RFID system. e de nition we propose is in fact close to the de nition of adaptive completeness from the ZK-Privacy model [DLYZ ].

.

We also propose a weaker notion of correctness in which only tags that have not completed more than t consecutive unsuccessful instances get authenticated by the reader. at is, we propose the following de nition.

De nition . (Weak Correctness for Simple RFID Schemes)

A simple RFID system is said to be weakly-correct if

ere exists an e ciently computable predicate ′ such that if a tag ID and the reader have a matching con ersation in a session and the tag ID has previously completed t successive sessions without the reader authenticating it, we have

jPr[ ′(ID; t) ! 1] Pr[Output( ) = ID]j = negl(k)

For every Strong adversary A that produces no output but ees all the tags before terminating, and every e cient sampling algorithm Samp on the set of the system’s tags, we have

For simple schemes, this de nition of weak-correctness means that the output of ′ is computationally indistinguishable from the output of with matching sessions and known tag identi ers. Clearly, this de nition is less restrictive than Vaudenay’s who mandated perfect indistinguishability between the two predicates, i.e., the original de nition states thar the two predicates have to be equivalent. Since the de nition of correctness leaves a negligible probability that the reader authenticates another tag in place of the one it is running the instance with, re ecting this probability in the ′ predicate is reasonable.

. ’

. . Security

Security is the equivalent of soundness in the eJW model. It formalizes the fact that no adversary should be able to make the reader accept a protocol session in which the adversary has been actively involved in the sense that sge did not only relay messages. In summary, an RFID scheme is said to be secure if no Strong adversary is able to make a reader protocol instance recognize an uncorrupted tag ID except with negligible probability and that is even if the adversary corrupts all the other tags, unless and the tag have a matching conversation.

De nition . (Security of an RFID System)

We say that an RFID scheme is secure if for every Strong adversary, the probability that the reader ends with a tape Output = ID for a session that has no matching con ersation with the tag ID is negligible in the RFID scheme’s security parameter.

Simple RFID schemes enjoy an interesting property: their security reduces to an adversary playing with a system consisting of a single tag IDt and having access to an oracle implementing(sk; ; ; ) to which she can submit triplets of the form (ID; KID; ) with the restriction ID ≠ IDt. In the following, we give the formal proof that this simpli cation holds for our class of simple and weakly-correct RFID systems.

De nition . (Security of Simple and Weakly-Correct RFID Systems)

For simple RFID schemes that are weakly-correct, we consider the following simpli ed security game for adversaries who are given access to an oracle O who checks the predicate (sk; ; ; ).

: (sk; pk)

: C T 1(ID)

: vtag D T (ID) : L

: Run AO interacting with L , S R , and S T . AO is not allowed to specify ID in its queries to O .

: b R ( )

: Output if has no matching con ersation with ID and R ( ) = 1.

e scheme is said to be simply secure if the winning probability of any adversary playing the simple security experiment is negligible in the security parameter.

Lemma .

For simple and weakly-correct RFID schemes, simple security implies security.

Proof. We use the game proof methodology to reduce an adversary against the security of the scheme to an adversary playing the simple security game. We denote by Si the event that A wins the experiment described by game i.

.

Pr[S4] = Pr[S3]

. ’