Comments

Alan • November 17, 2006 12:24 PM

I see two problems here. First, a criminal can create a passport containing forged digital data. In fact, it might eventually be easier to do this than forging a paper document. One solution would be to store all passports in a database, and look up the information in the database rather than retrieving it from the passport. This changes the problem to one of securing the database rather than securing the passport.

A second vulnerability is the potential ease of cloning passports. This would allow one person to travel using another’s credentials. One possibly solution to have all use of the passport be reported to the passport holder, via email, SMS, a website of telephone IVR system, etc.. This would allow misuse of the passport to be flagged, and the imposter arrested if he continues to use the passport. The security then becomes dependant on preventing an attacker from altering the passport holder’s contact information without being detected.

taeda • November 17, 2006 12:42 PM

Before anyone gets excited about this, take note: the encryption system uses a key created from the printed information on the passport. Its purpose is not to prevent cracking the data on the smart-chip; that is impossible, given that it must be readable by passport stations around the world. Its only purpose is to prevent attacks by an RFID scanner, because a scanner could not also read the printed information.

A'kos • November 17, 2006 1:25 PM

What stops me from disabling the chip in the stolen passport, and have another valid chip (with my biometrics) taped to the back of the passport ?

Mark • November 17, 2006 1:29 PM

“faeda” is correct about the reason for data encryption in ICAO passports.

While nothing about this scheme prevents cloning a passport, the digital data is protected against forgery by a public-key digital signature. ICAO has selecteded Singapore-based Netrust to set up the public key directory.

The whole point of a digital passport is to avoid the universal database Alan posits. Of course none of this provides any protection against a perfectly valid passport issued to a malefactor by a corrupt official – or corrupt government. Nor does it protect against valid passports held by previously unknown attackers – contrary to the Guardian article, most or all of the “9-11” attackers had valid identity documents and had come to the US legally, though some had lapsed visas.

Identity has nothing to do with intent.

Dave Engberg • November 17, 2006 2:06 PM

A’kos –

The signed data pulled from the passport includes a facial image. If a machine is reading your passport and displaying this for inspection by the officer, then it doesn’t matter if you copy the literal bits, unless your face matches the image. Same goes for (future) biometrics, which will also be in the signed block.

This, of course, requires verification of the signature on the data blob, which requires trust in the blob signing agency at the other country, etc.

derf • November 17, 2006 2:20 PM

It’ll be interesting to see if each country’s passport system is unique in any way. Since the information can be read by anyone within a few feet, any difference in the passports would create the possibility attacks based on the nationality of the passports near the rogue reader. These could be anything from picking out a victim on the streets of a foreign city to automatic remote explosive detonation once a certain number of the target nationality are near.

DoxAvg • November 17, 2006 2:58 PM

This seems much ado about nothing. The summary of the crack is that you can read the digital portion of the passport if you have the key – physical access to the passport. As I recall, this was a design goal of these passports – digital representation of the printed information that could only be read if you had the physical passport in-hand. The potential breaks in the article seem very spurious – if somebody has physical access to your passport, they can make a copy of the information contained within. I suppose this could be referred to as the “Reflexive Break Principle,” but that’s about it.

In summary, the RFID information is just a digitally signed replica of the printed information. It has no added privacy protection than the physical passport, but also (and I think they did a very good job with this), no less privacy protection either.

Andy • November 17, 2006 3:14 PM

It seems like this RFID idea is missing the point. Obviously the security flaws in it could be fixed, but here’s a better and less scary idea that doesn’t even really require new technology. Put a unique ID on each password (a long one with plenty of entropy). Make it optically readable (hrm… looks like the optically readable numbers that are already on the edge of a passport). Now let the passport reader authenticate itself to some central server and ask the server to give the contents of the passport. They wouldn’t even have to issue new passports for this to work.

For even better security, use an RFID chip that will digitally sign the verify-my-passport request, so long as it is presented with the passport ID and some nonce. Now you need to see the inside of the passport and have it physically present to verify it. Plus, you can add new biometrics and revoke readers without reprinting the passport.

avi • November 17, 2006 3:25 PM

So what I don’t get is why didn’t they use a contact-based data transfer (smart-card)? I don’t see what benefit the wireless data transfer offers, especially if passport control has to take the additional step of entering data printed on the passport to access the RFID data (or hold the passport within a few cm of the reader).

And, do we know if the data on the RFID is digitally signed? If not, as A’kos says, one could steal a passport, clone the digital data, alter the biometrics to fit the attacker, disable the built-in chip (cover it with foil), and put his own RFID chip near enough to get read. Voila, attacker enters the country using someone else’s passport.

Dwayne • November 17, 2006 4:06 PM

The site quotes Ross Anderson:

“There isn’t even a defence against the brute-force attack. In much the same way as you are only allowed three attempts to feed in your PIN number at an ATM, the passport chip could have been made to stop allowing repeated incorrect attempts to contact it. As things stand, a computer can keep trying until it gets the numbers right. To say this doesn’t matter displays a cavalier lack of concern.”

Wouldn’t that open up a nice denial-of-service attack? Using a portable device, you’d make all the passports around you lock up while you’re standing in line. Border guards would blame it on a technical glitch in the reader, and ignore the fact that your chip is nothing more than a dummy that always answers “access denied”.

js • November 17, 2006 4:13 PM

@avi “why didn’t they use a contact-based data transfer”

I can see this being less rugged than contactless, though the data transfer rate ought to be higher.

One thing I had thought of is using a small solar cell/led combo to do optical power and data. The electronics are potentially slightly more expensive (and may need further research), but the capabilities ought to be at least as good as RF and has an obvious method of access control – if you can’t see it, you can’t use it.

Dave Engberg • November 17, 2006 4:20 PM

Avi –

A contact interface might make sense, although the form factor of a passport wouldn’t support existing (ISO 7816) readers, so you’d need to come up with something new. You’d also want something more rigid than a passport in order to get reliable contact. Contact readers also wear out a lot faster than OCR+contactless would.

The data is signed by the issuing country, although trust between national issuers is via out of band “trust lists” not cross-certification, etc.

Dwayne –

Key length is long enough that you shouldn’t be able to brute force learn the key (unless the input data from the MRZ is too constrained, which it may be).

If your intent is to DoS the reader, you’d have an easier time just jamming at 13.56MHz rather than bothering with protocol attacks.

A'kos • November 17, 2006 5:47 PM

@Dave Engberg
“The signed data pulled from the passport includes a facial image. If a machine is reading your passport and displaying this for inspection by the officer, then it doesn’t matter if you copy the literal bits, unless your face matches the image. Same goes for (future) biometrics, which will also be in the signed block.”
Yes, but if I’d use a different chip, I’d program it with my face.
The question is how difficult it is to get the original signing key.

“The data is signed by the issuing country, although trust between national issuers is via out of band “trust lists” not cross-certification, etc.”
So if I understand it right, if the signing key is disclosed somehow all the passports of that country have to be reprinted and the chips in the new passports signed with a new key.
And this would also mean that the previous passports have to be exchanged or treated as if they had no chip in them.

antibozo • November 17, 2006 7:23 PM

DoxAvg> In summary, the RFID information is just a digitally signed replica of the printed information. It has no added privacy protection than the physical passport, but also (and I think they did a very good job with this), no less privacy protection either.

Apparently you missed the part where it explained that by using a lot of data that is otherwise predictable or discoverable, they /did/ provide less privacy protection.

And they didn’t go all the way with this. One can look at an individual and reasonably guess his age, so the date of birth only adds perhaps 11 bits of entropy assuming that one can guess within six years or so of the correct age. Passport expiry dates for the near future, since the passports are good for 10 years and are only just starting to be issued, are highly predictable, down to a window of a few months (less than 8 bits), and after five years, that still adds less than 12 bits of entropy. Passport number is the least predictable piece of information, and according to the report it’s pretty predictable, at least for now.

But we shouldn’t even have to discuss how much entropy is in these data. It’s simply wrong to use a key that is related to the person or document. Instead, they should be generating a random key per passport, and printing it in a barcode or optically readable font inside the passport. Then one really would have to look inside the passport to learn the key.

One suspects there are timing-based attacks as well.

Hal • November 17, 2006 8:10 PM

I agree that it would have been better to use a longer key, printed within the passport, to protect the data. At the same time, the present system takes 24 hours to brute force assuming that everything is known except 5 digits of a 9 digit number. This means that some of the scary scenarios listed, such as people pressing up against you in the subway and cloning your passport, are not realistic.

antibozo • November 17, 2006 8:36 PM

Hal> the present system takes 24 hours to brute force assuming that everything is known

No, the article states that the worst-case time is 23 hours for five digits at 12 attacks per second. This is off by a factor of ten–at 12 attacks/s, 100000 attacks take 8333 seconds, less than 2.5 hours. The average time at that rate is 1 hour 10 minutes.

Ian • November 17, 2006 8:43 PM

Here’s an idea: Make it so that the RFID circuit is broken by default. Either put a little switch in that completes the circuit, or for even better security just have two exposed contacts that have to be bridged to complete it, with some simple mechanism for doing that built in to the passport.

John Gray • November 17, 2006 9:23 PM

I think it’s clear that Sterling’s worst-case scenario brute-force attack doesn’t take very long – but is it actually a very useful attack compared to the value that you gain? It is an attack that you have to target against an individual and as people traditionally only renew their passports every ten years, you might have to wait some time (note that he relies on knowing the renewal date, so he needs to use a corrupt postman – it’s not a very good general-purpose attack). He’s also plain wrong about the renewal date – you can renew up to 9 months before your existing expiry date and carry forward the credit. So his attack works for new passports only…

Sterling seems desperate to demonstrate that the world is about to end – but if the government just started randomising the 9-digit number the feasibility of his attack would pretty much vanish (and going back to his perversely overcomplicated postman – why doesn’t the postman just open the envelope and read the data using the key if he’s part of an organised crime gang? Surely resealing the envelope or faking a new envelope is easier than brute-forcing the RFID key??).

What is very worrying in terms of security awareness is that several commenters here have alluded to validating the passport against a central server, thereby providing an assortment of attack vectors and denial-of-service options, and leading down the route of a centralised, database-driven society. I don’t consider the detail on my passport to be especially sensitive – and if someone can clone it… are we really worse off than we are at the moment?

While on DoS – yes, jamming the RFID frequency is possible, it is easily detected and traced in a controlled area (to overwhelm a reader a centimetre away when you are several metres away is going to take a fairly powerful transmitter and you’ll look rather suspicious waving your directional antenna around at passport control). The DoS on an individual passport if you could lock it out is a much more effective attack – pick someone famous, deny their passport through repeated attempts just before they need to present it…

However, this makes me wonder whether most of the RFID attacks could be foiled by keeping your password in a random 13.56MHz noise-generating wallet – only when you removed it would the noise drop enough for a reader to interrogate it!

bob dole • November 17, 2006 10:57 PM

This is the exact same “problem” as last time and it’s still a non-issue. They get physical access to your passport and it’s game over, the same way it is with current systems. It’s never less secure than old “normal” passports and it most cases it’s more secure. Meanwhile Schneier cops out with the “someone will break the crypto implementation some how some time” argument. The same argument I DON’T hear him applying to cell phone networks or openssl. Clearly he’s backing his current stance since you can’t prove that they did their PK implementation well (unless you pay bruce a bazillion dollars to analyze it…and even then, see the IPSEC complaint below) and therefore you can’t disprove him.
Actually, now that I think of it, this reminds me of his IPSEC cop out of “it’s too complex for to analyze, therefore it’s insecure.” You can’t prove in any mathematical way that the entire system does not have unintended interactions and therefore you can just be like “it’s not secure” which is really rediculous.

Christoph Zurnieden • November 18, 2006 8:25 AM

This is the exact same “problem” as last time and it’s still a non-issue.

That was my first thought too, but it isn’t. The possibility to clone a passport allows for a DoS of an individual:
Who is the right person: the first one passing with that passport or the second? That is probably cleared within minutes, but that time can be enough to miss a flight, that means miss a date which may mean that the competition gets the multi-million-dollar contract/partner/window seat. The same you can do with a more traditional passport except that you are now able to do that without physical access to the original passport under certain circumstances.
With the current error rate of facial recognition (human and machine), easily cheated fingerprint readers and unsanitarily iris identification all of the “extras” in the RFID memory is quite useless. The processing power is not used either: a good portion of the key is public and the rest is quite short so a simple 2d-barcode would have been sufficient (the area of a passport page is quite big and can hold a lot of bits).

So, please tell me: what are the advantages of a passport with an RFID? Or more directly: cui bono?
Another question: is the mentioned public key the single key or are there more?

CZ

Anonymous Mark II • November 18, 2006 8:54 AM

@DoxAvg

“In summary, the RFID information is just a digitally signed replica of the printed information. It has no added privacy protection than the physical passport, but also (and I think they did a very good job with this), no less privacy protection either.”

Let’s assume that we accept your assertion that there was no privacy loss or gain (I don’t but hey, who cares?).

Just what has been achieved then? Why bother spending all that taxpayers cash to build something that will not make any difference?

My understanding is that the new passports are supposed to be harder to forge than the old ones i.e. you can just swipe the passport over a reader to verify that your document is legitimate.

Unfortunately, this will only be a short-term benefit unless you believe that forgers will never create fake passports with RFID because once forged RFID passports appear, then you are back to square one. If I had to bet one way or the other, I’d say that new methods for forging passports will be developed.

Unless airport security staff check the photograph on chipped passports just as carefully as they do for non-RFID passports, then nothing has been achieved because if you trust a chipped passport more than a normal one then you are actually creating a new security weakness.

It seems to me that the new passports will be harder to forge (but not impossible), facilitate yet more private data collection and open up new possibilities for data theft.

The attackers methods will only get better with time but it will be ten year before you change your passport.

Jef Poskanzer • November 18, 2006 10:33 AM

What I don’t get is why they put data into an RFID chip and then protected it against remote reading with an optical scan code, instead of just putting the data into the optical scan code. The storage capacities of the two media are similar. And obviously the just-optical system will be cheaper to make the passports, cheaper to make the scan equipment, need replacement passports less often, etc.

John Gray • November 18, 2006 11:44 AM

@Anonymous Mark II: Of course a forger can create a fake passport with a chip – but assuming that the digital signature is secure, they can only clone an existing passport’s chip – and have to ensure that the optical (“MRZ”) data on their fraudulent passport matches the data on the chip (only way to have it decrypt). So you can’t simply swap the chip on a passport with another (cloned or otherwise). Changing the MRZ information is obviously possible, but it makes the passport more difficult to forge. The issue of the photo remains – the bearer must match the printed photo and the chip photo (current vulnerability – steal a passport from someone who looks like you).

We can’t produce a 100% secure system – but we can produce one that makes forgery more expensive and more complex.

@Jef Poskanzer: It’s a good question – presumably because you need to have the photo in a fully digital form if you want to digitally sign it – and it’s suggested that the contents of the chip would be around 30K. The ICAO paper hints at further applications running on the chip – not sure what those would be, but could be interesting to require the user to present a PIN to their passport to unlock it…

Automation – the requirement to scan the MRZ data to access the chip means that some intervention will be required – a completely automated passport swipe system still requires photo comparison or you could just travel on any passport. I don’t think that there’s a significantly enhanced risk here over the current system, if the appropriate inspection model is adopted (cf. airline boarding pass discussion here previously)

Stavros • November 18, 2006 11:59 AM

Just a comment to those who say “so what?” to the ease of data extraction and potential ease of cloning:

Since the passport RFID chip is so easy to read, and the German study indicates they are easy to clone as well, we have to assume it is very easy for an attacker to make a physically inferior but electronically perfect duplicate of the passport. Let’s assume a hypothetical organization of “evil doers” that has the brains to harvest passport contents at various tourist spots via desk clerks (or any of a large number of other simple attack vectors). Tourists wil generally be from the countries against which the organization has a grudge, and also will have passports that are the best access document to enter the target country. If harvested when the tourist arrives in the foreign country, there will be a one to two week window of validity for the information, during which no simple cross check like duplicate border crossing will arouse suspicion.

Now let’s consider human nature for a moment. When the Passport reader beeps and turns on the green light, is a border guard going to check the physical passport?

Short answer: No.

The evil-doer forges just the RFID chip, but the rest of his forged passport is a poor knockoff. The border guard thinks: “The machine says it’s valid amd didn’t turn on the red terrorist warning light, so he’s OK.” He won’t look at the passport.

Add to this the usual bureaucratic nonsense and you’ll find some bean counter figuring out just how short a time can be spent on a passport check, assuming the RFID is perfect and unforgeable and presto: the number of border guards drops to the point where they don’t have time to check the physical passport. Now where is the security?

Security in banking has already taught us this obvious danger: physical counterfeiting is difficult, but electronic counterfeiting is usually close to trivial. Given the options of counterfeiting some digital information or counterfeiting a physical object, the evil-doer will always go with the former.

John Gray • November 18, 2006 12:44 PM

@Stavros: I agree with what you say but that’s a weakness of system implementation rather than passport implementation. It’s a training issue.

If the guard doesn’t check the passport properly you could just as easily be using someone else’s passport (who looks a bit like you) – the guard’s training needs to incorporate checking of the overall document integrity i.e. they need to understand the limitations of the chip.

Human nature and bureaucracy are indeed risks – but the corollary to “your security is only as good as the weakest link in the chain”, is that providing disproportionate protection to the stronger links is no better than security theatre, as it doesn’t make things any better…

On a practical level, how do you make a data chip uncloneable while having it easily readable – without recourse to a centralised database or requiring the use of a private key infrastructure to ensure all border points can issue digitally-signed requests to the passport chip? Giving border points a “special” machine is just another weakness in the system when someone steals one!

Anonymous Mark II • November 18, 2006 2:50 PM

@John Gray

“… assuming that the digital signature is secure”

What are talking about? Read Bruce Sterling’s comments again:

“Fatally, however, the ICAO suggested that the key needed to access the data on the chips should be comprised of, in the following order, the passport number, the holder’s date of birth and the passport expiry date, all of which are contained on the printed page of the passport”

I think it’s a given that the forger knows what these information are because the forger is making the passport. The big idea was that an attacker has to be be able to physically inspect the passport to get the data to talk to the RFID chip – this is the optical scanner’s job.

the problem I mentioned earlier is that once the technique required to create a RFID chip for a fake passport has been mastered, then repeating the (automated) process will be relatively trivial. This new passports design buys a bit of time but in the long run, I suspect forgers will find a way and exploit this new system. Several commentators have noted that in practice, security personnel will tend to trust RFID passports more than the older type because in at least 99.9% of the time, the passport and data will be legitimiate; it’s human nature.

Just to make it worse, these passports are being produced by lots of countries all around the world. What chance is there that the RFID manfufacturing techniques will remain secret? Will foreign intelligence agencies be denied access to the information? I don’t think so.

Anonymous • November 18, 2006 4:50 PM

@Anonymous Mark II: I think you’re mixing up two seperate bits of crypto used in the process.

The “key” Sterling is talking about is the access code required to read information from the chip. The items of information on the chip include a repeat of the basic MRZ data, the digital photo and a digital signature of the data created using a government private key. The public key for this private key will be widely distributed and available in the airport reader to validate the data. The private key will obviously be kept securely.

My assumption (which is not totally unreasonable, I think) is that the forger will not know the matching UK Passport Service private key (the passport signing key is recommended to be changed fairly frequently) and that the signature algorithm (DSA or RSA etc. – not sure which it is for UK passports) will not be broken.

There’s nothing clever or sophisticated about creating a new chip at all (which is why the Sterling article is overhyped) – the catch is the data needs to be signed using a government private key for it to be recognised as valid. That is the obstacle – you can reuse existing signed datablocks, but you can’t change them without breaking them. That leaves you with a much reduced range of attacks – many of which are essentially the same as current vulnerabilities of the system.

The human factors issue is always a problem – it applies to safety as well as security. Extra automated security measures can reduce manual care – but everything is a tradeoff, and I’m not yet convinced that this particular case is as bad as Sterling wants me to believe!

My question about uncloneable chips above still stands. How would you make passports more secure?

MinorityReport • November 18, 2006 7:12 PM

Another interesting document should be:
http://www.icao.int/mrtd/download/documents/TR-PKI%20mrtds%20ICC%20read-only%20access%20v1_1.pdf

Especially the final chapter addresses foreseeable issues with the e-passport architecture. All the currently reported e-passport hacks were actually mentioned there before they got later published by hackers. This includes the reduced entropy in the passports of the Netherlands (causing the break of the encryption on an eavesdropped legitimate communication between reader and e-passport) as well as the cloning of the german e-passport chip. Regarding to that, the document actually explicitely states that “compared to paper based MRTDs copying the signed data stored on the RF-Chip is easily possible in general.”, together with advise on how to work with that.

I concur with John Gray, “bob dole” and others that the now mentioned UK passport “crack” is actually less of an issue, and even less a surprise. What was performed is simply the Basic Access Control mechanism, as described in the official specs. Basic Access Control is intended to work that way and there was nothing to crack, only the normal functionality of the e-passport was used.

On that note, at least for the European Union, Basic Access Control delivers only the digital mirror of data presented on the data page (including the signed hash value). Any data that is not on the data page (like fingerprints) is considered to be much more sensitive and will be protected by Extended Access Control, which, from what was communicated, includes actual terminal authentication etc.

Therefore, the attack possibilities described in the article did not get possible now with the “crack”, but are known for quite some time, with obviously different perspectives on how feasible it is to perform them. (Personally, I would not dismiss the fact that you can not only get the digital copy of the data page, but also signed hashes, making that data more worth than the data from the data page alone.)

Hal • November 18, 2006 8:05 PM

Good catch on the timing of the brute force attack, antibozo. Still if it takes 1.2 hours of querying the chip to break it, most of the attack models where someone stands next to you in a crowd won’t work. And randomizing a couple more digits of the passport number will fix that.

A more interesting question IMO is what happens if they start putting fingerprints on the chip. That would eliminate the “clone a chip of someone who looks like you” attack. What does it mean for privacy though?

antibozo • November 18, 2006 9:16 PM

Hal> Good catch on the timing of the brute force attack, antibozo. Still if it takes 1.2 hours of querying the chip to break it, most of the attack models where someone stands next to you in a crowd won’t work.

They won’t be guaranteed to work, but they may still work in some cases. Of greater concern is that the attacker sitting next to you on an airplane or bus may have plenty of time.

I’m not saying randomizing a couple more digits would make that much difference. I’m saying randomizing /the entire key/ would be the correct way to do it, and the fact that the key is based on the data shows that the system was designed by poor cryptographers.

A similar situation exists here with people using the last four digits of a Social Security number as a password to a web-based system. Not only does this fail to provide access control–enumerating a four-digit password against a web application only takes a couple of minutes–but it exposes the last four digits of the SSN. These are in fact the most difficult digits to guess; all the other digits are potentially guessable from other knowledge of the individual. In this case, a successful attack not only gains access to the protected data, it also reveals the subject’s date of birth, passport number, and passport expiry date, even if the attack stops with successful authentication.

When designing any system with a key, one of the basic principles to follow is that the key should be unrelated to the thing protected, so that it may easily be changed. The conclusion we may draw here is that, once again, a very expensive system has been designed and deployed without basic knowledge of crypto. This suggests there are other potential problems, which is why I also mention timing-based attacks.

antibozo • November 18, 2006 9:23 PM

I think some people are confused about the authorship of this report. The writer is Steve Boggan. Bruce Sterling posted an annotated version with his own comments interleaved, but he is not the original author. Sterling could have done a much better job of making the attribution clear, not to mention formatting his comments to be easily distinguished from the original text. The Guardian could have done a much better job of making clear who the author is as well.

yRFID • November 19, 2006 3:15 AM

In summary, the RFID information is just a digitally signed replica of the printed information. It has no added privacy protection than the physical passport, but also (and I think they did a very good job with this), no less privacy protection either.

Roy • November 19, 2006 6:23 AM

I’m with Stavros. A fake passport takes only just-good-enough electronics, as the rest of the passport can be crappy. As long as the scanner lights up the green light, and some picture shows on the operator’s screen, the rest of the passport will be ignored, along with the face on the screen.

The color could be off, the size not quite right, the dimensions a little off, and both the word ‘PASSPORT’ and the name of the issuing country mispelled — and no one would notice.

Any of us, after viewing 10,000 normal RFID reader responses, will have long since stopped making observations and will be just going blindly through the motions. We will still have occasions where a man breezes through a control point unaware his passport was left at home and the one he’s travelling on is his wife’s. Adding photographs to ID long ago ran its course as a failed safeguard.

Enough valid passports will be misread that operators will soon be in the habit of attributing any failed readings to ‘a computer glitch’, with the default response becoming accept the passport that the machine rejected.

BTW, has anyone addressed the question of what it takes to sabotage RFID passports, rendering them inoperative? Setting up chip-killers at airport choke points would create an instant stream of passports that don’t scan, and the logical conclusion would be that ‘we have a computer problem’. The airport won’t shut down until the problems get fixed, so they will have to start passing people through with passports that don’t scan at all. The fact that the problem starts going away a while later, will be seen with more relief than perplexity, even though the fact is that the system has been completely hornswoggled.

andy m • November 19, 2006 12:55 PM

Several posts essentially pose the question why RFID?

(This may be a bit mad) but perhaps the RFID is all about the delivery (by post) of the passports.

I know the (UK) Post Office are using RFID for tracking certain items (I have seen mailing test packages containing RFID tags).

Perhaps the RFID is supplying a limited set of info for a limited purpose – ensuring the passport gets where its supposed to.

Eric Vétillard • November 20, 2006 3:04 AM

A problem with the post office attack is that, without opening the letter, the attacker canont be sure that the passport is actually an interesting one (i.e., with the appropriate look if a picture is used). Similarly, I am not sure that it is possible to recreate a fingerprint from fingerprint data.

However, there may be simpler ways to get the required information (in particular, name and passport number), from an appropriate person.

All the forms required to enter a country (for instance, the I-94W in the US) include this information. This may be a very easy way to find a person with the right look and “steal” this information from them.

I have posted an entry on my blog with a full description of this attack.

antibozo • November 20, 2006 7:57 AM

Again, the difficulty of finding out the passport number, in my opinion, is a red herring. Whether it takes 1.2 hours or two weeks on average, and how much of the key we can determine from other observation shouldn’t be issues. If the system were well designed, no attack on the key would be possible other than brute force against the entire key or physical access to the inside of the passport. An 11-digit, completely random key would withstand 12 attacks/second for 132 years, on average. With a ten-year expiry period, this would be sufficient to render any attack against the key pointless.

It wouldn’t have cost anything more to build the system this way, and it wouldn’t have added any inconvenience to the use of the system. That this system was built in an obviously broken fashion is enough evidence to suspect other problems, and to hold the designers responsible for any problems that result.

Anonymous Mark II • November 20, 2006 1:27 PM

@John Gray

The third blog topic after this one (http://www.schneier.com/blog/archives/2006/11/rfid_passports_1.html#comments) “RFID Passports Less Reliable than Traditional Passports” perhaps offers a partial answer to your question “How would you make passports more secure?”

Here is an extract from “The Use of RFID for Human Identification A DRAFT REPORT from DHS Emerging Applications and Technology Subcommittee to the Full Data Privacy and Integrity Advisory Committee Version 1.0” (http://www.dhs.gov/xlibrary/assets/privacy/privacy_advcom_rpt_rfid_draft.pdf)

“The anti-forgery benefit provided by the use of RFID in identification documents is not a product of its use of radio, but rather the fact that the data is in a digital format. Any data in digital format can be encrypted. Thus, RFID as such offers no anti-forgery or antitampering benefit over alternatives such as contact chips, bar codes, or pixelization.”

Such a simple idea! I was kicking myself for not thinking of this. Depending upon the quantity of data that is required to be stored, why not just barcode the data and security signature on the page that the optical scanner reads from? Then there is no need for radio chips. This would also hamper attempts to store more and more detailed private information on future chips – I understand that this is on the way – which you could consider to be a sort of privacy bonus effect.

Just a thought.

John Gray • November 20, 2006 6:13 PM

I agree that optical storage as a barcode would give you the same kind of digital storage capacity (though I think it would be even easier to clone the data if you ever saw that page of the passport).

I don’t see it as being a very different concept from the chip – there is not the risk of remote interrogation when the passport is closed. The tradeoff is that when the passport is open, the data can be captured readily from a distance.

I imagine the rationale for the chip is the prospect of additional data and providing “applications”[] which validate access to that (not possible with a purely passive datablock) – I don’t disagree with the criticism of governments accumulating excess private data or turning travel documents into something else – I just felt there was some misinformation about how significant an attack this was and what the implications of using a chip to store *this data were.

[*] These extra biometrics and applications being exactly what many people don’t want, of course…

antibozo • November 20, 2006 6:27 PM

Anonymous Mark II> Depending upon the quantity of data that is required to be stored, why not just barcode the data and security signature on the page that the optical scanner reads from?

Not meaning to detract from your cleverness, but if you read back in the comments, this is exactly the sort of scheme Jef Poskanzer already suggested. As author of the PNM suite (among other things), he may be regarded as something of an expert in this area.

Peter T • November 21, 2006 8:01 AM

Unless my memory is failing me:
– at the first meeting in London hosted jointly by ICAO and ISO/IEC SC17 it was indeed clear that ePassport security was not really being designed in the way that the heavies here want
– the original intent was that the ePassport data (the Logical Data Set, LDS) would be freely readable, and the access key was bolted on later, making use of existing technology to read the machine-readable personal data that is combined to derive the key
– you can’t walk around with a 14443 reader in your pocket and read all the passports around you from feet away, because the 13.56 MHz technology uses near field conditions and has to provide power to operate the ePassport chip; the coil in the reader and the coil in the passport are effectively a very loose coupled transformer, with power transfer falling off very rapidly at 5 to 10cm distance between the coils; what you can do is sniff from a distance the transactions between an open reader and an ePassport (i.e. if the reader and its immediate environs are not screened from prying electronic ears)
– legally the existing printed passport data has primacy, and the electronic data in the chip is only a secondary feature; any country that screens people only electronically at border points, trusting only the integrity of the chip and automated facial feature recognition (using one-to-one match between the photo in the chip and the image that the border point camera captures) is not going to be very secure; I think that the UK is also going to have on-line checks at any screening booths that it installs at border points (which means that people in the UK’s database will thereby be vetted)

In Europe we are developing a pre-standard for a European Citizen Card (prCEN/TS 15480), intended to be usable as a travel document across the EU – and its very likely to have the passport LDS in it. Fingerprint will very probably be added (EC decision), with the intention that thereby screening electronically can be used (i.e. unattended authorisation to proceed). 15480 parts 1 and 2 should be out for ballot soon.

X the Unknown • November 21, 2006 1:25 PM

@A’Kos: What stops me from disabling the chip in the stolen passport, and have another valid chip (with my biometrics) taped to the back of the passport ?

As I understand the system, all of the pertinent data on the chip is digitally signed. You can’t change any of the data without the (presumably secred) signing key. Thus, while you could simply clone your own ID onto the new Passport, that really doesn’t do what you want. You want to use your biometrics with his/her ID. That requires the ability to manufacture the dataset whole cloth (or alter it), including the creation of a new digital signature.

Anonymous • November 21, 2006 1:59 PM

@ John Gray: (the passport signing key is recommended to be changed fairly frequently)

This implies a massive key-distribution issue. You can’t just burn the relevant keys into tamper-resistant hardware. Instead, you have to maintain and secure an active database at each checkpoint, as well as communications channels to each of these checkpoints, worldwide. I think that it is a BIG assumption to make that all sites that need to be able to check data-validity (using the secret key) are also trustworthy to protect these keys.

After all, you clearly have to send the keys to all foreign countries that you expect to honor your RFID passports…including various Eastern-European, Middle-Eastern, and African countries with questionable security track-records.

John Gray • November 21, 2006 5:00 PM

@Peter T: I know the conversation between the reader and the passport is encrypted, but I don’t know how secure the encryption is.

@Anonymous:

I think you are confused between public and private keys – verifying the digital signature only requires a public key (as with PGP). The host countries hang on to their own secrets.

The public keys (like SSL keys) will come with a certificate that forms part of a hierarchy. The important challenge is that the root certificates must be distributed securely, but the machines need not be any more tamper resistant than the host nation desires – if they let in someone with a fake passport who has injected a key (by injecting a trusted root certificate) into their reader, that’s their problem. In other words, there are local attacks possible on readers, but just as stealing a PGP keyserver doesn’t break the system, stealing a reader PC with a full complement of keys doesn’t hit anything other than your budget.

In this case, the state takes the hit for its own poor security (as it should, so it has the incentive) so it doesn’t matter to the passport issuer what the security record of the countries is – just as you can publish a signed PGP key on a keyserver and all your enemies can grab a copy.

The signed public keys could readily be stuck on a web server somewhere (though I think I saw a hint that they might use LDAP?). The root certificates (which change very infrequently) are distributed through diplomatic channels – they are not secret, you just need assurance that the CD-ROM handed to the US authorities in Washington purporting to be the UK root certificate contains only the certificate that the UK authorities issued. This is not a very difficult problem to solve given the security considerations given to diplomatic communications anyway.

RFID-Question • November 22, 2006 1:55 AM

I don’t understand why anyone would want or need to “crack” the RFID encryption as long as you can just clone the chip. Why wouldn’t you just buy CDs of valid pasport chip data off the black market and take your pick of who you want to be? There will be plenty of these available. After all, the reason you have a passport is so you can travel all over the world and show it to people you don’t know. Somebody somewhere is going to be selling the information after they record it at the border or hotel or car rental agency. The only question will be how low the price will go after the market gets flooded with all the data for sale.

Having the data available electronically will make it much easier to forge a passport, as you will have a perfect copy of the passport information in electronic form. A copy of a “genuine” passport would be a lot more valuable than a completely “fake” one because the the original the copy was based on really does exist and represents a real person whose existence can be verified. You won’t need to look exactly like the photo in the passport, just close enough to pass.

The problem with trying to copy exising paper passports without RFID chips is that you have to either get your hands on the passport or on all the information in it. The only reason why people would want to make a completely “fake” passport rather than copying a genuine one is that it isn’t currently practical to get your hands on enough passport data to pick out one that would be suitable. If you can simply buy databases with all the information you need, the task simply becomes one of producing a reasonable looking copy – something which has been solved for years.

It’s true that the electronic information is the same as the printed information, but having it in electronic form lowers the cost of making good copies of it, which changes the economics of passport copying. This is just like having music available in digital form made it much easier to copy it on-line. RFID is going to make passport forgery far easier and create a whole new black market online business – RFID passport data.

iCowboy • November 22, 2006 8:43 AM

Peter T cleared up a few things when he said ‘legally the existing printed passport data has primacy, and the electronic data in the chip is only a secondary feature; any country that screens people only electronically at border points, trusting only the integrity of the chip and automated facial feature recognition (using one-to-one match between the photo in the chip and the image that the border point camera captures) is not going to be very secure’

I wonder if ‘legally’ has any relevance to actuality? Before Chip and PIN came along I was always amazed how little interest shop staff had in authenticating my signature. Go to the US and you find stores where you don’t even need to countersign once the card is swiped. Tests with photos on credit cards have shown that they are routinely ignored so long as the card itself is cleared by the issuer.

Know-nothing ministers are saying the system is foolproof and completely secure – they are building implied trust of the technology into our culture, so will we get a policy at border control which says ‘it’s genuine so long as it goes beep and the green light comes on’?

Anonymous Mark II • March 4, 2007 6:46 AM

Here’s an article that claims that the RFID chips have a two year warranty and may be damaged by normal wear and tear.

“New e-passport may not travel well”
http://travel.timesonline.co.uk/tol/life_and_style/travel/article1343191.ece

One of the comments to the article suggests that this may be a real problem:

“On entering the US recently, the (surprisingly pleasant) Immigration Officer explained to me how he has been given instruction on stamping the new e-passports in a particular way to avoid damaging them.”

So what happens if lots of passports start failing after a few years use?

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.