Cryptanalysis of a Lightweight RFID Authentication Protocol Based on a Variable Matrix Encryption Algorithm

2026-03-30

AI Summary

This study addresses a lightweight RFID mutual authentication protocol based on variable matrix encryption, exposing fundamental security flaws stemming from insufficient nonlinear confusion, the absence of ciphertext chaining mechanisms, and inadequate key-update capacity. It is the first to systematically identify the entropy degradation inherent in this protocol under lightweight constraints. To exploit these weaknesses, the authors propose a novel algebraic attack that integrates matrix transposition structures with modular factor testing. By analyzing multiple sessions of ciphertexts and solving associated linear systems, the attack successfully recovers the full 64-bit session modulus and all protocol secrets, thereby demonstrating a practical and complete break of the scheme under realistic parameter settings.

Abstract

Recently, a two-way RFID authentication protocol based on the AM-SUEO-DBLTKM variable matrix encryption algorithm was proposed for low-cost mobile RFID systems. Its design combines adaptive modulus selection, self-updating matrix ordering, and transpose/block-based matrix generation. In this paper, we show that the protocol has structural weaknesses. First, the underlying primitive remains a linear transformation modulo a session modulus, with no nonlinear confusion layer and no ciphertext chaining. Second, in the lightweight setting emphasized by the original paper, the update space is very small: there are only a few modulus choices, only four matrix-order choices when two secret matrices are used, and only a limited family of DBLTKM-generated matrices. Third, the correctness requirements of the protocol impose nontrivial constraints on the sizes of the modulus and plaintext coordinates, weakening the claimed entropy of the secret quantities. Building on these observations, we describe a multi-session algebraic attack path. Under repeated reuse of the same matrix and modulus -- an event plausible because of the small update space -- ciphertexts corresponding to $N_t$, $N_t+1$, $N_r$, and $N_r+1$ reveal a full column of the matrix. Across sessions, transpose-based matrix generation helps recover additional entries of the secret matrices, while the remaining entries can be obtained later from ordinary ciphertext equations. We then show that candidate factors of the session moduli can be tested by solving reduced equations for secret $S$ across many sessions and checking for mutually consistent solutions. This, in turn, enables recovery of candidate 64-bit moduli and the remaining protocol secrets. Taken together, our results indicate that the protocol is structurally insecure and admits a realistic route to full compromise in the lightweight parameter regime advocated for deployment.

Problem

• RFID authentication
• lightweight cryptography
• variable matrix encryption
• structural weakness
• algebraic attack

Innovation

• algebraic cryptanalysis
• lightweight RFID authentication
• variable matrix encryption
• structural weakness
• multi-session attack