Podcast on RFID Passports
I was interviewed on the subject of RFID passports.
Comments
js • November 23, 2006 2:05 PM
@Roy
You could of course set fire to your visa and/or passport at the moment, and there’s not much can be done about that. Presumably the issuers would have some record of who they issued to, though they might not want to share that information with just anyone. Of couse this deprives you of the use of your passport, the cost of replacement, and would make the issuing authority suspicious if repeated.
I guess the more interesting question is could a writeable area on a passport be erased without rendering the password as a whole useless? Undetectably?
One has to assume that against anyone who can undetectably replace the chip, or undetectably open it up and physically manipulate it, the game is already lost regardless of the capabilities of the passport. So keep to an attacker with access only to an external device that can communicate with the chip in its own language. Worst case is that the chip has a bug which can be used to bypass any internal software checks in the chip and allow the attacker (using only an external communications device) to persuade the software running on the chip to do anything which the hardware of the chip is capable of.
Flash memory is right out – we assume the attacker can persuade the chip to overwrite any region with whatever they like.
You could place an area of fuse-PROM (bits are stored as a metal link which is either present, or can be irreversably melted by passing sufficient current through it to flip the bit) or similar technology. Initially it will be empty. “Visas” are signed message blocks which are written, one after the other, to this block. Any as-yet-unwritten bit is clear, so it is obvious on reading that, here are the visas, this is free space.
You could of course overwrite a visa by setting all the bits in its area, or otherwise damage it. It is signed, so minor damage will be detectable, and no genuine writer will leave large blocks of set bits, so any tampering will also be detectable.
How about a variation where each bit is represented by two fuse links. Both present means unused. Blow one for a set bit, the other for a clear bit. Allow both to be read independently for verification purposes if you’re paranoid. Arrange that the control signal for blowing a single fuse must pass through the twinned fuse, such that blowing one link, at the hardware level prevents you from ever blowing the other bit.
You can of course still write whatever additional information you like, but only to the unused area of memory. It won’t be signed of course, so it’s no use to you. You can’t erase or overwrite any existing data.
Rob Mayfield • November 23, 2006 5:44 PM
“If the memory is alterable”
What can’t be altered ? we can put safeguards in place, minimise risk, make it unlikely, improbable or impractical (for today) – but with the right time, resources, motivation, there’ll always be people ready to prove you can’t make an unalterable record …
Bruce Schneier • November 23, 2006 10:13 PM
“Bruce, in the interview you say you envision digital visas, so that data must be added to the passport chip.
“If the memory is alterable, then visas can also be deleted. The guy who regularly travels between Switzerland and Bermuda can have his very interesting side trips to the Middle East, Indonesia, and China deleted.”
My assumption is that future visas will have both a paper and digital component, so deleting the visa won’t be that easy — but having it on the chip will speed up your processing.
Clive Robinson • November 24, 2006 5:33 AM
@js
“place an area of fuse-PROM (bits are stored as a metal link which is either present, or can be irreversably melted by passing sufficient current through it to flip the bit)”
No it won’t work for a couple of reasons,
First of as you correctly put it,
“So keep to an attacker with access only to an external device that can communicate with the chip in its own language.”
With an embedid RFID the offical and the criminal have the same access to the RFID so they could both burn out the links as and when they felt the need.
Secondly it gives an obvious denial of service attack, you just blow the spare links and the passport becomes usless for future use. Blow any of the used links and it becomes invalid…
On a more technical issue although it would be possible to design such a system the level of RF power required to blow the link is likley to be a little to much for other parts of the circuitry. Which in turn gives rise to a much more expensive design with probably a lot lower reliability (not good for a consumer device with atleast a 10 year expected life).
Ricky • November 24, 2006 5:33 AM
“If the memory is alterable”,
then anything can be altered.
supersnail • November 24, 2006 5:35 AM
Has anyone out there got a “passbook” savings account, or, even seen on in the last 10 years.
I would suspect that for most people the answer is no. There is a very good reason for this. What seemed like a simple and effective system in 1890 was deeply flawed. It was labour intensive, prone to erros and prone to fraud. These problems were exacerbated in the digital age designing a system to keep a database and a remotely held piece of paper in sync was an expensive nightmare, it took banks nearly 30 years to phase out the d**m things.
Whats this got to do with passports. Well they look like passbooks. The various immigration authroities are trying to keep the rubber stamps on the paper in sync with thier databases etc. etc.
Rather than using the passport as an ID token and holding the data centrally they are using the passport as a paper data store. They are now extending this deeply flawed system to use the passport as a digital datastore.
When you computerise a flawed system the result is usually a worse system because you are eliminating the one thing that allowed it to work — the flexibilty and common sense of the people using the system.
This one is going to run and run.
js • November 24, 2006 6:56 AM
@Clive Robinson
To answer your points:
Yes, with the single-link implementation an attacker can in theory write to any memory area an authorised user could. However since writing is one-way, this is detectable thus will raise a red flag. The two link implementation works around even the possibility of erasure/damage.
I was considering that the chip would have two separate memory areas: one preconfigured that would be (in hardware) unmodifiable after issue, to store the main passport data, and a second zone available for post-issue addition of visas. Thus the effect of malicious damage is constrained at least a little.
Writing a visa is a rare operation – I assume requiring sending the passport off for endorsement and requiring somewhat more specialised equipment than a checkpoint would require. It can take time. Power could be stored locally until sufficient charge to blow a limited number of links has build up. The links would have to be tiny so it shouldn’t take that much power.
In any case, metal fuse links is just one possible implementation – I assume if required it would be possible to devise an alternative technology which was much lower power yet had the same single-write/immutability properties.
Tarkeel • November 24, 2006 7:16 AM
@js: “Writing a visa is a rare operation – I assume requiring sending the passport off for endorsement and requiring somewhat more specialised equipment than a checkpoint would require.”
In certain countries border visas are the norm, and is as much a receipt for entry-fee as it is a visa. Just ask anyone who has done some backpacking in Africa or Asia.
skizmo • November 24, 2006 7:30 AM
“Podcast on RFID Passports”
there has to be alot of memory on the RFID to store a podcast on it.
Clive Robinson • November 24, 2006 8:14 AM
@Bruce,
Glad you mentioned that the RFID is attackable at a no-security level (via antenna detection) below that that most RFID security models start.
You appear to be the only “public Security Guru” who has picked up on this fundemental flaw, even though it has been talked about on your blog several times before.
Just a technical niggle though, you go on to say “when three Americans ” to do that you would need to actually detect the chip stepping etc. which would need a fair level of sophistication in the detector and would only work at quite a short range due to the signal processing required.
However detecting a passport for a mugging or for stealing a passport would only need a few USD of components from Radio Shack / Tandy / Maplin / other high street electronic component retailer and would work at a geater distance.
Of the two your attack is a way off in time yet, mine is however here and ready to run and is much more likley to happen on a regular basis (criminals need to eat, and the higher the rewards for the lower risk the better).
However my nasty little mind has been thinking again 😉 and has come up with a new attack that is also quite likley and shock horror is less secure than existing Passports without RFIDs,
1) Assume you are a terrorist and have an ID shopping list (that is you are looking for people who look like other people in your cell / organisation).
2) you have your Passport detector in your pocket (it is after all a cheap throw away item) and you go on an ID shoping trip (ie looking for somebody who matches an ID on your shopping list).
3) You see somebody of the right physical charecteristics at a tourist spot etc, you walk by them and look for a hit on your detector (lets say it vibrates like a mobile phone).
4) No hit goto step 3 otherwise “tag your victim” and drop back / handover to other terorist to follow them.
5) call an acomplice to bring in the Passport Reader (which is expensive and therfore not throw away).
6) IF you have good pick pocketing skills lift the passport. Otherwise mug the victim, photo the picture page, put the Passport on the reader, type in the details and slurp the signed Digital ID into your reader.
7) IF you pick pocketed then put the passport back in the victims pocket. If you mugged them then take only their cash, and drop their wallet&passport in a very public place (or give to a patsy to hand in to the Police as lost property or even back to the victim though that takes more “front”).
The Passport is only lost to the victim for a short period of time and if you have a good pick pocket who can put it back then it’s loss will be unknown to the victim.
The victim has little or no reason to think their ID has been stolen as they have the passport back in a very short period of time…
You as the terorist however have all the info you require (picture of ID page & copy of signed data) to pass onto a passport forger/changer to give you a nice new ID page and clone the RFID…
Opps wheres the security gone… It’s actually worse than not having an RFID in the passport in the first place as you do not need to mug people who are not carrying their passports.
So the Police do not see a lot of “three foot red haired people with an olive complextion and beards” being mugged in a short period of time, or accidently catch you whilst mugging your tenth victim of the day to give the game away.
rfid • November 24, 2006 9:17 AM
Regarding Switzerland: Did you know that you can still buy original Swiss Army Knives in the duty free shops at airports in Switzerland as long as your flight ends in the EU? Who needs liquids on the plane when you can bring your brand new knife? 😉
Bruce, You recommend in the US that people get a new passport. I don’t know when this was recorded, I’m seeing news stories that the date had been moved up to October for all new passports to have RFID chips. Has this new deadline slipped? I’m interested specifically in the Chicago office. Thanks.
Anonymous • November 24, 2006 12:11 PM
There are write-once technologies with lower power than fusible links. OTP (One Time Programmable) is the thing to look for from any number of memory chip makers.
I’m not sure what technology RFIDs in passports use, but I strongly doubt it’s a one-off custom masked chip. More likely, it’s some OTP technology and the passport office buys millions of blank chips, then writes them once with each person’s data. Any other strategy would be insanely expensive. Or maybe they use lasers.
mitch • November 24, 2006 7:52 PM
So how does one tell if a passport received in the last month is one of the new RFID-enhanced passports, or the old non-RFID-enhanced passports?
Roger • November 26, 2006 8:45 PM
@mitch:
RFID enabled passports have a special logo on the front. It is gold in colour, and looks like a rectangle divided horizontally in two, with a circle in the middle. Like this:
http://travel.state.gov/images/e_ppt_logo.jpg
mitch • November 27, 2006 9:28 AM
Ha! Excellent — Thanks.
I appear to have renewed my passport before the “improvment” was fully implemented, then. Ten years of breathing easier before I have to worry about it again.
ben • November 27, 2006 9:47 PM
I renewed my passport just a month ago. I got one without RFID, but I did notice something interesting due to a mistake on my part. I made an error on the form I was originally given (which had a date of 11-2004 and did not mention RFID.) So I picked up a replacement form – and noticed that this renewal form had a 2005 date on it and a section on the back describing the RFID logo.
The interesting thing was that the address printed on the old form was not the same as the address on the newer form. I already had the envelope filled out with, and now I wonder if that was why I did not get a passport with the RFID tag, or if they are just still behind schedule on rolling them out.
X the Unknown • November 29, 2006 10:14 AM
@Rob Mayfield: “… but with the right time, resources, motivation, there’ll always be people ready to prove you can’t make an unalterable record …”
The already-demonstrated RFID cloning should suffice for “erasing” unwanted Visa entries. Just revert to a prior “backup”.
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
Roy • November 23, 2006 12:58 PM
Bruce, in the interview you say you envision digital visas, so that data must be added to the passport chip.
If the memory is alterable, then visas can also be deleted. The guy who regularly travels between Switzerland and Bermuda can have his very interesting side trips to the Middle East, Indonesia, and China deleted.