Fingerprinting RFID Chips

This research centers on looking at the radio characteristics of individual RFID chips and creating a “fingerprint.” It makes sense; fingerprinting individual radios based on their transmission characteristics is as old as WW II. But while the research centers on using this as an anti-counterfeiting measure, I think it would much more likely be used as an identification and surveillance tool. Even if the communication is fully encrypted, this technology could be used to uniquely identify the chip.

Tags: , , , ,

Posted on December 1, 2009 at 1:25 PM • 34 Comments

Comments

Jason! • December 1, 2009 2:07 PM

What’s interesting is that they don’t talk about the effects of age and environmental weathering on this “fingerprint”. The frequency response curve is a very analog thing, and even if the RFID is sealed from the elements, seems likely to change subtly over time. While it’s neat that every chip is special, I don’t know how useful it’d be to white or black hats.

HJohn • December 1, 2009 2:08 PM

@kashmarek: “Well, then couldn’t it be used to clone the chip as well?”

Perhaps, but not likely, at least not yet, based on my understanding. Recognizing the characteristics and frequencies of the chips is not the same as being able to replicate their source, to say nothing of the encryption.

Dutchman • December 1, 2009 2:29 PM

Funny. First thing I thought of reading this title was the ridiculous act of storing fingerprints on RFID chips, which is exactly what the EU is doing right now.

DavidE • December 1, 2009 2:33 PM

I would like to see more detail on this, such as how large the differences actually are. And I would love to see details of the work described in the last sentence of the press release. Tough task…

Tim Spinney • December 1, 2009 11:03 PM

Bruce,

The blog is no longer appearing properly for me when I visit using Firefox. The title of each post is displaying over the top of the first line of the post’s content.

This didn’t happen in the past. Has there been a change in CSS, or some other change in the mechanics of the site?

Clive Robinson • December 2, 2009 1:40 AM

@ Bruce,

Time to say “I told you so” (again 😉

If you look back on previous of your blog pages when RFID chips where being proposed for passports I brought up the issue of fingerprinting them.

And I said at the time doing fingerprinting would show not just who’s chip but steping info as well.

So just to make the point again

YOU CAN TELL WHERE AND WHEN AN RFID PASSPORT COMES FROM WITHOUT HAVING TO DO ANYTHING WITH THE DATA.

So much for security…

Lars • December 2, 2009 2:48 AM

@Clive: You almost nailed the point. But not completely. Identification, or rather re-identification, is not the same as mapping some pattern to someones identity (or nationality). While you are able to re-identify a certain RFID passport by fingerprinting, you are not able to map it magically to the nationality of the holder.

Although I remember having read of a flaw in the protocol that discloses the nationality. Not sure if this hole is closed already, but in times where departments of foreign affairs warn against disclosing ones nationality abroad it is quite interesting that the same government issues passports which broadcast this information.

Clive Robinson • December 2, 2009 3:22 AM

@ Lars,

“While you are able to re-identify a certain RFID passport by fingerprinting, you are not able to map it magically to the nationality of the holder.”

Saddly that is not true.

I’ll explain.

Although there are very few chip makers around thus some smaller countries etc end up using the same chips.

They are usually bought in “production” batches not “of the shelf”.

As nations do not invariably trust each other a large number of countries make their own passports.

In the case of passports RFIDs the frequency is very low (13 not 900 MHz) which necesitates putting the antenna in the passport.

The difference in the antennas and the was they interreact is small and subtal (belive me I’ve done the tests 😉 in most cases but it is there.

However for some large nations they “roll their own” chips and don’t sell them to other countries.

Although not 100% you can reasonably identify the country and in the case of US pasports which part of the US it was issued from.

All you have to do is build up your own database of the information. Which is not that difficult (think how major hotels in some countries take your passport into the back office etc).

It would be reliable enoughj for “ID Shopping” to work which is why I say that RFID Passports can actualy aid terrorism.

As Bruce frequently notes “you have to think hinky”. To which I would add “like a good chess player several steps down the game” to spot this sort of problem at the very initial stages of an idea.

And it is at that point you need to make your security design choices. Various people raised this type of issue but it was as usual “poo pooed” by vested interests.

So we add it to the list of things where the science knows better than the politics. But the politics win for financial reasons…

Clive Robinson • December 2, 2009 3:34 AM

Oh and for those interested in doing this sort of thing you don’t need expensive test equipment.

Go look up the principle of the Grid Dip Osc (GDO) Direct Convertion, Harmonic Mixers and 24bit PC sound cards. Oh and the wonderfly new fangled world of “Software Designed Radio” for which there is an Open Source Project for *nix platforms on PC’s.

You could build the 13MHz front end with bits from the likes of “Tandy” or “Maplin” for cash (nicely non tracable) or from many other outlets (PCP DigiKey etc etc) for less on plastic.

When I last did it it cost me under $30. The expensive part was obviously the PC and the software time, but back when I did it you had to “roll your own” with Open Sorce SDR a lot of the heavy lift is done for you.

I fully expect such a design appear on the web any time soon…

interesting • December 2, 2009 4:23 AM

nice. Now we can track passports and individuals even without knowledge of the actual encrypted data. All it takes is the sample which can be collected at hotel receptions or elsewhere. and according to Clive Robinson even without prior knowledge of the individual passport we can predict the nationality.
I remember a video some time ago demonstrating a remote controlled roadside bomb (in a garbage bin IIRC) which was triggered by the passport of the bypasser.
This will make specific assassinations much more convenient. Either target an individual or just retreat to take “anyone from nation x”. What can possibly go wrong…

Clive Robinson • December 2, 2009 4:37 AM

And whilst I’m at it I’ll make another point that should be a major wake up call to system designers and those involved in EMsec (TEMPEST).

This fingerprinting technique is very very general and is ages old going back atleast as far as WWII (see Prof R.V.Jones’s book and other information about early traffic flow analysis CCM).

There are also many old Amature Radio / Constructors mags an books that tell you how to tune up the coils in an unpowered (thermionic) valve receiver or transmitter.

And it also goes back further into a compleatly non technical field, to “lamping” which is hunting by night with a light. You cannot see the rabit/hare/fox etc but their eyes light up (think camera red eye etc). The way the eyes light up tells you not just what the prey is but quite often it’s age or in some cases sex.

A similar “high tech” process is used to discover hidden CCTV cameras etc (you can actualy do it with a mobile phone camera and one of those LED tourches where you have replaced the “clear water” LEDs with “IR LEDs from TV remote controls.

It is the principle behind something Bruce posted about where a Uni was developing a system to stop photos being taken or illegal videoing of films.

Basicaly all physical objects effect the EM spectrum somewhere. As do forces as well. In fact you can show one EM energy source acting on another with an appropriate medium.

Simply take a metal pipe and make a rig up to spin it very fast around its longditudanal axis, but allowing you to look down it’s length at a distant object.

Now apply heat from a blow torch to the outside of the pipe. When sufficiently hot you will find that on looking down the pipe the distant object is out of focus.

With the use of an appropriate glass lens you can bring it back into focus… voila your very own “heat lense”.

We actually see this effect of EM energy (heat) effecting the visable EM spectrum quite frequently think about tarmac roads producing “heat shimer”. The whole purpose of spinning the pipe is to turn the shimer effect into a lense.

As I said all “tangable” objects effect the EM spectrum in one way or another. All tangable objects are unique. Thus they have unique EM spectrums.

It is a fundemental rule of physics get used to it.

Importantly similar objects have similar EM Spectrums that classes of objects can be identified.

The problem for security is that all security equipment pasive or otherwise has an EM Spectrum that tells you a lot about it.

For instance getting back to hidden cameras you can easily tell if the camera is digital or film simply by the radicaly different EM spectrum.

Further with a little more effort you can tell which lenses and which CCD sensor are used by the response in the returned EM Spectrum.

Oh and the reason for the wake up call. All survalence equipment including TEMPEST kit can be found by their Spectrum charecteristics.

Oh and what applies to the EM spectrum also applies to the sound spectrum, and also to the gravity spectrum.

Clive Robinson • December 2, 2009 5:01 AM

Oh and here’s a security idea I give it away free to anybody that want’s to put the work in.

Human eye’s have their own EM Spectrum and itis highly directional.

There for you can design a device to “fingerprint” all those that look at the device.

Make it store and compare the signitures and you can tell the difference between ordinary casual glance and more coninuouse looking.

The more continuous looking could easily be someone doing a reconosance.

Now make it small enough to fit into a hat and you can also use it for bodyguarding, not just against terrorists / kidnappers but the paparazzi as well.

Likewise putting it on a veihcal could also potentialy detect people pointing anti tank or anti aircraft missiles at you.

I suspect that getting funding for a well writen proposal is not going to be difficult.

If you do get funding send Bruce the price of a couple of beer’s so he can buy me one at some point and not feel left out 8)

Thomas Heydt-Benjamin • December 2, 2009 5:01 AM

Bruce,

I just wanted to pop in with a quick response to the issue of identification via RF fingerprint versus anti-counterfeiting applications.

It is really hard to identify these tags by RF fingerprint alone. In all of my experiments I have only been able to identify tags under strictly controlled laboratory conditions. Jason is absolutely correct that the fingerprint will change over time. We have not studied exactly how much and in what way, but we have observed that normal wear will impact the fingerprints.

The bigger issue, however, is antenna polarization. In my experiments I took great care to achieve as close as possible to identical polarization between observations. This is realistic in an anti-counterfeiting use case. In the case of a card form factor, for example, the card may be inserted into a reader that can position the card appropriately. Believe me when I tell you that to identify cards in the wild without a-priori knowledge of the antenna polarization would require some entirely new math. (again, I am speaking only about identification from RF fingerprint, not by other means).

As to identifying the country of issuance, our preliminary results are that this is possible, but again, in a laboratory setting. Besides, there are much easier ways to determine place of issuance than by RF fingerprint.

@HJohn, you are absolutely correct. It would be very difficult to duplicate the RF signature of a passive transponder. I can imagine adversaries with sufficient technology to do this, but I do not believe that any such adversaries currently exist that can do so in the same form factor.

As to the question of whether these signature were intentionally introduced by three letter agencies: That is completely nuts. These devices have signatures because of inescapable laws of physics. One can imagine strategies for making the fingerprints harder to read, but it isn’t really worth it because the fingerprints are so hard to read already. It took me almost a year 🙂 (although it certainly wasn’t my only project during that time)

Finally, @Clive I do not believe that the techniques are yet sufficiently refined to be done at home. Please try! I would love to read about your results. The reason why it is hard is that many aspects of the signature are at a much higher frequency than the intended communication frequency. To obtain our results we had to record radio traces with a high bandwidth instrument. I do believe that once we understand more about the fingerprints, in particular once someone refines our feature extraction algorithms, that this wide bandwidth will become less important. Such refinement, however, has not yet been done to my knowledge.

Clive Robinson • December 2, 2009 5:25 AM

@ Cicek,

“according to Clive Robinson even without prior knowledge of the individual passport we can predict the nationality.”

If you think about it it is easier than fingerprinting an idividual document.

We all know what a car looks like, most of us can recognise a particular make/model at quite a distance long before it’s close enough to read the number plate or recognise individual differences.

Or another way of thinking about it most people who are not tone deaf can tell the diference between say a piano and a harpsicord, a flute or a clarinet or recorder etc.

That is not just the specific class of instrument but the more general class of woodwind -v- brass etc.

Some few people with very good hearing can recognise an individual instrument makers work and the actual instrument.

What these guys have done is show how to do the very dificult part of identifing fine details that identify the individual instrument. Recognising the difference between chip manufactures and stepping is a much easier task and can be done at a longer range and with less precision of placment required.

Clive Robinson • December 2, 2009 5:53 AM

@ Thomas Heydt-Benjamin,

“The reason why it is hard is that many aspects of the signature are at a much higher frequency than the intended communication frequency.”

First of consider what you are doing which is identifing the difference between two almost identical items. See my above post to Cicek as to why it is easier to identify a class of item rather than an individual item.

Secondly you where working withj 900Mhz devices the pasport works at 13.5Mhz this makes life a lot lot simpler.

To do with the problem of orientation have a think about how an EMC G-Tem cell works. Then consider puting two coils appart in the same way as they do for RF anti-theft devices you see at shop doorways

As for knowing that it works I did it back in the 80’s with electronic purse cards and a few other things like electronic hand held gambaling devices in plastic cases.

You might be surprised to know that you can use the fingerprinting in reverse to inject faults into electronic components such as random number generators. Have a look over at the Camb Labs sight for an example of this.

My problem with “results” is I did the work on somebody elses dollar under a non disclosure agrement to protect their “comercial good name”.

And whilst I never tried to get the precision you are looking for to tell one almost identical item from another I certainly got enough precision with quite simple equipment.

Have a look at Direct Conversion (DC) receivers and putting the baseband into a spectrum analyser.

You can also by a simple sampling technique as used in software designed receives for “channal banks” fold the harmonic spectrum back on it’s self into an IQ DC receiver and use software to do the heavy lift.

As for directionality use one of those three axis EMC antennas etc.

You’ve done the hard part of proving it can be done, now all it takes is a little further knowledge and the application of well known techniques sometimes in reverse.

Clive Robinson • December 2, 2009 6:59 AM

@ Thomas Heydt-Benjamin,

A thought has occured.

Don’t get me wrong but you are probably a little under 30 years of age?

If you where over fifty you would probably have made your own test kit like I had to because the lab where you worked could not afford more than a couple of items.

If you have a look in the likes of the third edition of the RSGB “Vhf Uhf Manual” or it’s ARRL equivalent or their magazines you will find lots of articles on how to build your own test kit.

For instance you may not know that you can make a “poor mans” spectrum analysers with a simple XY display osciloscope a 741 opamp sawtooth wave generator two 1n1418 silicon signal diodes (one as a detector one reverse biased as a varicap) and a length of wire above a bit of unetched PCB material as a high Q quaterwave line.

In the modern world you would ditch the O/scope and use the two inputs to a PC sound card.

Have a hunt around for “anti parralle diode strip line mixers” and “stripline harmonic mixers” like wise “rat race mixers”.

Now if you have a little think about 6.28F=1/(LC)^-2 and varicaps wired in series and parrallel you will realise you can using 4 matched varicaps and 2 matched striplines make an oscilator that tracks a tuned circuit at either twice or half the frequency. Use that with a couple of Mod Amps a PC with 24bit sound card and a cheap digital frequency meter with USB output and you have the potential of a spectrum analyser with a 90db range and a couple of octives coverage. With appropriate software you can have the equivalent of a mid range low frequency microwave spectrum analyser with near profesional capabilities for just a few dollars and a lot of software time.

Now you may not of heard of spectrum folding or you might have done. Either way I’m sure a lot of this blogs readers have not.

If you look in any undergraduate electronics or physics text you will see information on the frequency spectrum of a step or pulse signal with “infinate” rise time.

When you get into the early stages of Signal Processing the tell you you have to have band filters infront of a sample and hold circuit to prevent issues with high frequency components.

What they don’t always tell you is that the sample and hold circuit is a receiver with a frequency response like the transmitted spectrum of a pulse signal of the same rate as the sample signal.

It is sometimes called a “de-convolving receiver” and in ordinary analoge electronics does not have many uses.

Welcome to the world of Software Defined Radio. It has an amplifer and sample and hold IQ receiver. The two baseband IQ signals are fed into the inputs of your PC’s sound card. DSP software does the rest.

As you will apreciate after reading up on SDR and stripline mixers the only reason you pay large sums for lab equipment is the “calabration certificate” which is not required for what you want to do 8)

interesting • December 2, 2009 9:08 AM

@Clive: just to mention it – Cicek did not write a single word – he copied my text (the posting at 4:23) and his name links to a website. Probably just a spambot. Maybe Bruce should use some sort of captcha or the like to prevent this…

Thomas Heydt-Benjamin • December 2, 2009 10:01 AM

@Clive,

Interesting discussion Clive. You apparently didn’t read the abstract to my paper. I was actually working with passports, not 900MHz devices. You seem to be a technically minded person. Perhaps you would enjoy reading the paper? I hopefully explained my methodology better in the paper than in my brief post above.

If you have an improvement on our techniques I would be delighted to learn!

Clive Robinson • December 2, 2009 11:44 AM

@ Thomas Heydt-Benjamin,

“I was actually working with passports, not 900MHz devices.”

Sorry yes I read several bits this morning and got interupted by a nurse mid reply (and no I don’t like having blood drawn 8( and mixed bits up a bit.

“If you have an improvement on our techniques I would be delighted to learn!”

As they used to say in the X-files “it’s out there somewhere”…

More seriously if you make two door sized coils (using ribbon cable is easiest) and mount them about the same distance apart as they are wide, you get a nearly linear field between the two of them. You can see the field absorbtion at low levels and harmonic radiation at slightly higher levels.

Similar effects happen in an EMC test chamber the design of the plates etc give a nearly linear field.

Now if you know how to make a directional coupler you can make the equivalent of a circulator which means you can use the one antenna for both RX and TX, more importantly you can use a phase delay line from your TX source (prior to an antenuator) and use it to generate a quadrature signal to make the IQ DC receiver, the outputs of which get fed into the audio ports of the PC (after suitable amplification).

Have a scan around the lab you work in you can probably find enough bits to make a scale size mock up in an afternoon. Intel used to provide a fairly niffty set of FFT and other transforms in a library you could download.

Remember though it is more orientation sensitive than other setups but once you have one coil working correctly you can add the other two and a comutating switch to select them rapidly in turn.

If I was not stuck in this hospital bed I could dig out some refrences for you.

HJohn • December 2, 2009 11:47 AM

@Clive Robinson: If I was not stuck in this hospital bed I could dig out some refrences for you.

Ouch. If you mentioned this previously, I missed it.

I hope you have a speedy recovery and are home and healthy in time for Christmas. Best wishes to you and your family.

Clive Robinson • December 2, 2009 12:39 PM

@ HJohn,

“I hope you have a speedy recovery and are home and healthy in time for Christmas. Best wishes to you and your family.”

Thank you for the wishes.

However a quite time in hospital avoiding all the excitment of my son jumping on me at “Oh M’god it’s early”, the 4 hours of kitchen work cooking the dinner (yup I used to be a cheif many moons ago when a student) etc might be a better wish if you know what I mean 😉

Clive Robinson • December 2, 2009 1:09 PM

@ interesting,

“just to mention it – Cicek did not write a single word – he copied my text (the posting at 4:23) and his name links to a website.”

Sorry, yes the “florest bot” was quick off the mark. Usually they spam pages that are weeks if not years old and many pages at a time (which Bruce or the Moderator normaly pull out)

Cleaning it up can be time intensive which is just one of the many many reasons I don’t run my own blog (I like to sleep occsionaly 😉

“Maybe Bruce should use some sort of captcha or the like to prevent this…”

They don’t realy work anylonger. There are people in China and other countries paid one or two cents per capatcher they fill in. For the money they can make (if they type quick) against their local economic norm it’s slightly better than average wages in the warm and dry with comparitivly low health risk.

It’s one of those “oh so obvious” in hindsight things I had not spoted in advance (Hey I’m not perfect 8)

Which is mildly embarasing as I had sugested them as a way to implement a side channel authentication along with a token to get around “end run” attacks.

HJohn • December 2, 2009 1:25 PM

@Clive: “However a quite time in hospital avoiding all the excitment of my son jumping on me at “Oh M’god it’s early”

LOL. I’m sure I’ll soon learn. I had identical twin daughters born in June. First two and only two, at age 35 (when my energy isn’t what it used to be and isn’t getting better).

Clive Robinson • December 2, 2009 3:27 PM

@ HJohn,

“I had identical twin daughters born in June.”

I’m not sure who should get the Gongrats you or your “other half” 8)

Just make the most of the bathroom while you can in a few years and three ladies in the house you won’t be able to get in there unless you get up at 5AM.

Oh and remember within a very short while you will find yourself wrapped around a pair of little fingers your wallet empty and the car doing an extra 12,000miles a year to dance classes etc etc etc then there will be pimply faced hormomnal boys coming around making your “inner caveman” surface.

Relax it’s normal take up model railway making in the shed at the bottom of the garden or better still rod and line fishing 😉

HJohn • December 2, 2009 3:36 PM

@Clive Robinson at December 2, 2009 3:27 PM

LOL. I had a mom and two sisters growing up, so I’ve lived the bathroom nightmares.

I’ve already got a plan for pimply faced boys. First, my girls will both be black belts in karate by the time they are old enough to date.

Second, and most importantly, I’ll be sizing them up for shirts that say “that red dot on your chest means my daddy is watching.”

I may also rid them with RFID chips to track their movements. (Okay, probably not, but I wanted to bring it back on topic somehow.) 😉

Nick P • December 2, 2009 5:40 PM

Oh dear, the criminals would just have to start hiring desolate folks with the right RFID tags as proxies to do their dirty work. Oh wait, isn’t that what street thugs do today?

Some measures fix a problem, some simply move it. I figure an identification scheme would likely move the problem, much as public keys did.

Frank Bitterlich • December 3, 2009 4:33 AM

I wonder… could this technique be used the other way around? I mean to fingerprint the reader instead of the chip…?

That, in turn, could be used for anti-counterfeiting purposes (you can’t clone a chip that doesn’t answer to your unauthorized reader), and in general could tie a certain chip to a certain reader….

interesting • December 3, 2009 5:40 AM

the purpose of the card is to authenticate against multiple readers. Otherwise one could simply use a key on a chain. But if you have n possible readers how do you implement a white list?

Roger Wolff • December 28, 2009 3:02 AM

Obviously someone found out that bad guys can take the 64-bit ID which is transmitted in the clear from RFID to the reader and put it into a fresh RFID chip, so that a clone of the original card is generated.

Of course the 64-bit unique ID is claimed to be an “unforgeable fingerprint” until someone figures out how to clone it. Similarly, a slightly more advanced RFID chip will be able to forge the exact fingerprinting bits of the original card.

Also the false-rejects are likely to increase. Does the RFID card provide the same fingerprint when 20 degrees as when it’s -20?

Robert • May 10, 2010 6:17 AM

Sorry I missed this topic earlier, because it is actually very easy to tell which manufactures tags are used for both 13Mhz and 900Mhz.

The trick is to use a strong TX signal and a very fast rise time on the Tx amplitude modulation and step the amplitude from 10% to 90% modulated. The tag backscatter under these conditions will depend on how the internal maximum power control circuit is implemented. Some limit the input power by controlling the charge-pump input power, other manufactures use an internal shunt regulator controlling a regulated power clamp on the antenna. In both cases the tag creates an unintentional backscatter associated with the load modulation caused by maximum power control.

There is a spec limit for unintentional backscatter caused by regulation but it is still easy to measure. This measurement can be done without the tag ever intentionally acknowledging your signal. So even tags that are rejecting your signal because they have determined that you are not an approved reader still need to power-limit correctly (otherwise they will be damaged by excessive voltages at the antenna).

If I were trying to further identify individual chips I’d probably try FM sweeping the high power across the 800Mhz to 900Mhz band where the antenna are tuned. power limiting would try to maintain a constant power at the chip. As seen from the TX reader this inverse function is antenna sensitivity diagram. For those with an RF background you have just done a tag S22 measurement. The same trick works with 13Mhz tags which typically have a much higher Q. so the exact Q and center frequency can be used to identify individual tags.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.