My post on tagged passports has caught the ire of one reader who has pointed out the security features of the new passport. So, are RFID passports safe?
Anti-RFID devices are coming: Vrije University, Amsterdam, is developing the “RFID Guardian”, a device which beeps warnings to a person when a RFID scanner is near and trying to read a chip embedded in a piece of clothing the person might be wearing, for example.
“The RFID Guardian runs on a 550-Mhz XScale 32-bit processor with 64 MB of Ram that functions as the central nervous systems. XScales are often found in PDA and cellular phones”, said Tanenbaum, the university’s anti RFID advocate. The protocol stack was written in C to run on top of eCos, an open-source operating system.
Getting into the anti-RFID act is RSA Security Inc. with an RFID blocker similar to the RFID Guardian. According to Jeff Woods, the research Vice President of Gartner Inc., "The RSA blocker is a system that 'confuses' an RFID reader and prevents it from reading personal or private tags. The challenge for RSA was to define which tags were private and who had access to them."
Back to my reader’s suggestions - Passports if encased in a Faraday cage is safe from being “skimmed”. A Faraday cage or (in the case of passports) wallet is a metal or foil-lined container that is impenetrable to radio-frequency waves. An RFID tag in a Faraday cage/wallet is effectively unreadable.
A blocker may be the first line of defense, the next will be proper encryption and if Passports use 2048-bit ECC. About Elliptical curve cryptography (ECC) my informed reader says, “Not even the best hackers in the world can break 2048-bit ECC.”
Today ECC provides the most security per bit of any public-key algorithm and require less storage, less power, less memory, and less bandwidth than other systems. This allows you to implement cryptography in platforms that are constrained, such as wireless devices, handheld computers, smart cards, and thin-clients. Perfect for passports.
Finally, I admit - it’s not as bad as I thought it would be - IF PASSPORTS HAVE THESE FEATURES. However, I still believe that if some hacker does get past the Faraday wallet, he may be able to save the encrypted reading – and still device some way to hack the information.
Comments