Breaking LMAP

In this paper, we present a passive attack resulting the complete break of LMAP (Lightweight Mutual Authentication Protocol), which is an authentication protocol between RFID tags and RFID readers. We describe an algorithm that breaks the protocol after eavesdropping a few consecutive rounds of communication. Assuming that the attacker can eavesdrop successive authentication rounds of the same RFID tag, after a small number of rounds (the expected number is about 10) the attacker learns the identification number of the tag and every common secret shared by the tag and the reader. This means that in the subsequent rounds the attacker can successfully impersonate the targeted tag.