At Crypto?05, Juels and Weis introduce HB+, an enhancement of the Hopper and Blum (HB) authentication protocol. This protocol HB+ is proven secure against active attacks, though preserving HB?s advantages: mainly, requiring so few resources to run that it can be implemented on an RFID tag. However, in a wider adversarial model, Gilbert, Robshaw and Sibert exhibit a very effective attack against HB+.
We here show how a modification of the HB+ protocol thwarts Gilbert et al?s attack. The resulting protocol, HB++, remains a good choice for RFID authentication.