4) Upon receiving message Kn Gn+1 and the modified
message K0n
Gn+2nx, R first verifies whether Kn
Gn+1 is the expected one. Since the message is correct,
R updates IDS = F(IDS Gn) and Gn+1 = K0n
Gn+2 nx K0n
= Gn+2 nx.
5) The server has Gn;G0
n+1 but the the tag has Gn;Gn+1
where Gn+1 6= G0
n+1. In the next session, the tag will
be able to authenticate the server but the server will not
be able to authenticate the tag.
In the next section, we describe how the privacy can be
compromised due to the misuse of LFSR in the protocol.