RFID Fingerprints To Fight Tag Cloning 59
Bourdain writes with news out of the University of Arkansas, where researchers are looking for ways to combat counterfeit RFID tags. Passive tags typically wait for a reader to transmit a signal of the appropriate strength and frequency before sending their own transmission. The scientists found that the amount of power required to trigger this varies quite a bit from one tag to the next, especially when many different frequencies are sampled. This and other physical characteristics give the tag its own "fingerprint" that is independent of the signal information stored in its memory, which the researchers say will facilitate the detection of cloned tags.
Security enhancement at best (Score:4, Insightful)
So what's to stop a dedicated attacker from reading the fingerprint when they read the tag contents, and then devising a method to duplicate all the data?
An active tag might even be programmed to emulate the fingerprint characteristics.
Re:Security enhancement at best (Score:4, Funny)
Simple; they'll keep the algorithm a secret! ;^)
Re: (Score:1, Informative)
Those fingetprints are physical charactistics due to manufacturing process. You can't duplicate them in software.
Re: (Score:1, Interesting)
Re:Security enhancement at best (Score:5, Informative)
I don't know if it will be that easy. These fingerprints seem to be based on the fact that all RFID chips have flaws, and they are all flawed in different ways.... including the device that is trying to act as the clone of the RFID. What this means is that this clone RFID has to be able to mimic EXACTLY the flaws of the real thing without giving itself away by its OWN flaws. Without knowing more details about the flaws they are trying to measure, it is hard to say whether that would be possible. If the flaws are easily mimicked in the sense that you can create a clone whose own defects are not detected because they are all superseded by the original's flaws, it may work. If they vary so much that every clone will have some flaw that is severe enough to shine through, it would be impossible.
Re: (Score:2)
It would ideally force fake goods vendors to buy or steal the genuine RFID tags to forge, that's all. Given that the RFID tags themselves, like bar tags, must remain far less costly than the actual goods, this means very little to the economics of forging the tags unless the vendors can be bothered to very closely monitor sales of the genuine tags. Somehow, this seems unlikely for such bulk items which are also manufactured primarily overseas.
Re: (Score:3, Insightful)
It just means the clone will have to be a bit more expensive.
Cloned tags aren't using the same cheap chips that the common passive tags do. An attacker can afford to carry batteries with him and make the tag completely locally powered. Then he has much more powerful electronics at his disposal and can simulate whatever frequency response the original tag had due to its cheap (few cents per tag) design.
This fingerprinting will do no more than to force the attacker to pay a few bucks more to create a clone.
Re: (Score:2)
So what's to stop a dedicated attacker from reading the fingerprint when they read the tag contents, and then devising a method to duplicate all the data?
An active tag might even be programmed to emulate the fingerprint characteristics.
I RTFA and I feel like I'm missing something.
They have a fingerprint of the RFID... and?
Are they proposing to embed the fingerprint in the RFID's data as a CRC/encrypted check?
Are you going to create a database of fingerprints and query it when the tag gets scanned?
I can't be the only one wondering what's the practical application of the discovery.
Re: (Score:1)
> Are you going to create a database of fingerprints and query it when the tag gets scanned?
I guess this is the case. So when the RFID chip is initially embedded in whatever (box/device/etc...), it gets this 'special' scan, and the data would need to be stored/transmitted separately/securely to the receiver (basically, wherever they want to perform a 'copy' check) at various points of the items travels.
This would help enable the ability to detect both replacement of the product (so you can tell if your
Re: (Score:1)
If you can read the fingerprint, so can anyone... So what's to stop a dedicated attacker from reading the fingerprint when they read the tag contents, and then devising a method to duplicate all the data? An active tag might even be programmed to emulate the fingerprint characteristics.
If you can read the fingerprint, so can anyone
-true, that's not the point, no one can WRITE the fingerprint (or at least it would be prohibitively difficult to do so currently)
An application of this could include:
-Secure building entry; the building could maintain a database of both the RFID fingerprint and the RFID data and only grant admission to those with that combination (the RFID data would, in theory, also contain information about its fingerprint as well)
-RFID isn't meant to be an encryption system, it's meant to be more like a more effic
Potentiometer (Score:3, Interesting)
So if I have a pot wired across the power receiver, I can twiddle it until it matches. If people know the factors being sampled, they can adjust them.
Does this say the same at 55-70+ mph or just at (Score:4, Interesting)
Does this say the same at 55-70+ mph or just at much lower walking speeds?
Re: (Score:2)
Please excuse my ignorance, by why would a difference of 50 mph matter to an rfid signal?
Re: (Score:2)
I'll take Doppler-shift [wikipedia.org] for $50, Alex.
Don't take me too seriously. I'm just guessing that was what he was referring to.
Re: (Score:2)
HAHAHA, I'm hoping not. The Doppler shift is a function of proportional velocity, that is, it isn't until you are moving at a fraction of the speed of LIGHT are EM waves effected. A conservative estimate puts that at about c/1.003/1000 = 186 miles per second.
So when you have a car that goes that fast [at or away from your receiver/transmitter], your EM frequencies might get noticeably shifted, but on this planet, you'ld also probably be on fire.
Re: (Score:1, Redundant)
Perhaps a Redshift [wikipedia.org] then? C'mon, have some fun. :)
Re: (Score:2)
I'm not sure why you were modded redundant this deep, fuck that guy.
But the only reason I know about redshift/blueshift speeds is that (years ago) after reading "a brief history of time" I wanted to calculate how fast a car would have to be moving for the red light to actually be green...and then I was dismayed when I found that no man-made vehicle had ever gone that fast or was even an order of magnitude close to going that fast.
Re: (Score:2)
Considering that police radars, use and have always used Doppler shift, for finding out the speed of the target vehicle
What you've said, is not true. Higher frequency radar are used because they have less dispersion. These LASER speed guns do not rely on Doppler shift.
Instead the take a series of accurate distances, and solve r=d/t.
Re: (Score:2)
Re: (Score:2)
It is my fault for not explaining properly. I'll try again. Either, the target is moving so fast that the frequencies are shifted out of band (not likely), or any shift can be compensated for because range-rate of the device can estimated.
Even so, Realistically none of this matters. Because detector for things like this can be placed orthogonal to the direction of motion so that the doppler effect is non-existent.
What's the point? (Score:3, Interesting)
Just use a sensible crypographic authentication mechanism and be done with it. I guess that it is interesting from a "pure science" point of view but I'm not quite sure that this should be used to detect fake passports.
Re: (Score:1, Interesting)
Re: (Score:2, Interesting)
These are passive tags, i.e. ultra-low power consumption. You can't put any decent crypto on it.
Re:What's the point? (Score:5, Insightful)
Crypto wouldn't work... the cloner doesn't have to break the encryption to copy the chip.
Imagine in this way.... you have an encrypted hard drive, and someone wants to pass off their hard drive as yours. They don't have to break the encryption... they can copy the drive byte for byte, and hand it to the person who if verifying that is the original. The person checking the data is the one who does the decrypting.
Re: (Score:1, Offtopic)
If your hard drive only sends data when it has authenticated the motherboard how do you plan on reading the hard drive to copy it in the first place?
Re: (Score:1)
bit by bit
Re:What's the point? (Score:4, Informative)
Depends on the chip. If you include ISO 14443 processor cards then you can have crypto, combined with secure on chip storage of the key of course. You are giving away this chip, so you must make sure that the chip storage and on board crypto is sufficiently protected against attacks. E.g for passports you can have active authentication or chip authentication to verify that the chip is not cloned.
Re: (Score:3, Informative)
Replying on myself here, but the original article does not seem to include processor chip technology.
That and it should have read ISO 14443 processor chips of course, not ISO 14443 processor cards. It's Saturday morning over here - need cafeine.
Re:What's the point? (Score:4, Insightful)
Encrypting a hard drive protects the confidentiality of its data. It does not prevent you from cloning the hard drive i.e. it does not protect the authenticity of the hard drive.
In many applications that use RFID tags, authenticity is much more important than confidentiality. Those researchers seem to propose a way to authenticate the RFID tag using its "fingerprint". What I'm saying is that a dynamic challenge-response scheme is much more practical and more reliable.
Crypto is not only about encrypting data.
Re: (Score:2)
I think RFID crypto involves things like challenge-response. They can still do that on passive tags.
Also, what do the US passport RFID tags use that prevents copying?
Re: (Score:2, Interesting)
Re: (Score:2)
An active RFID tag (i.e. a battery powered tag) is not required. Just look at DESFire cards: probably not as cheap as passive RFID tags but they can handle a simple challenge/response mechanism. If you want something more beefy, look at the DDA mechanism specified by EMV and used by Visa and Mastercard: it uses RSA with 3 levels of public keys. It works just fine on simple microprocessor-based
Are we actually fixing anything here? (Score:2, Insightful)
So... we're now looking into methods of physical authentication for digital authentication data that was intended to replace physical authentication?
Wouldn't it be easier (and cheaper) to go back a step?
Passive tags will never be secure... (Score:3, Informative)
Solving the wrong problem (Score:5, Insightful)
RFID tags are not security devices, they are hyped barcodes. They do not provide any authentication.
If you're worrying about your RFID tags being cloned for a malicious purpose, you are using them for the wrong thing.
Re: (Score:1)
Can anyone give me an example of a situation where someone would want to clone RFID tags ?
Who would be using them for authentication ?
Re: (Score:1)
-Oz
I think I get it... (Score:2)
Ok, at first, this made no sense to me. The trouble I had was understanding how the flaws(uncontrolled manufacturing artifacts) would be of any use. I think I finally figured out what that poorly written article was trying to get across.
Say, for example,you have 200 million different passports. They should have 200 million different PROGRAMMED sets of information. At the time the passport is issued, the RFID is scanned to detect the FLAWS in it. This is recorded and filed away somewhere. The FLAWS are recor
This is nothing new (Score:5, Informative)
In mag stripes, the magnetic remanence of the strip is different from card to card, in EEPROM, differences in the voltage levels and speed of reading of the cells are used.
The general principle is that it's no point having unbreakable crypto if the data can simply be copied to a new medium. Consider a card (of whatever type) that stores monetary value for public transport or photocopying or whatever: Put $100 on it and copy the data, not knowing which bits are what. Copy that data onto a heap of cards bought with $5 of credit on them and sell them in the grey market for $50 each and pocket the profit.
With this sort of technique, though, part of that encrypted data is a fingerprint based on the physical characteristics of the original card. The new cards will generate a fingerprint in the reader that doesn't match the original, making the copies invalid.
Sure, if you can crack the encryption, this method is useless, but that's not the point. Crypto can be pretty good and costs more than a cheap reader/writer to break to duplicate cards/RFIDs.
full clone (Score:2, Interesting)
well, they'll just have to clone that parameter too.
Unless of course the industrial process used to create the tags makes each one of them a bit different,
hence defeating the identification in the first place.
Re: (Score:2)
well, they'll just have to clone that parameter too. Unless of course the industrial process used to create the tags makes each one of them a bit different, hence defeating the identification in the first place.
Yes, the individual nature of the devices is the whole point of the exercise.
No, that doesn't defeat the identification, it allows/enhances it. It means that, unless the copier can decrypt the data and encrypt with a new fingerprint, the fingerprint parameter on the copied device won't match the value generated by the reader using the physical characteristics.
Fingerprinting capability very limited..... (Score:3, Insightful)
given what the article says.
What they're measuring is the minimum power level that a given RFID will respond to. This opens up two major issues.
1. A database of the response curves is needed in order to uniquely identify the RFID chip in question.
2. Since the power received follows the inverse square law, one of the major advantages of an RFID chip is negated. Namely the ability to scan for it's presence without having to have exact location. They need to precisely control the distance from the RFID chip and the reader in order for that technology to work. And if they need that level of control, why not use a contact based technology?
Observation looking for relavence (Score:1)
Re: (Score:2)
Actually, the detectable set of flaws doesn't have to be globally unique.
Say you have a population of 1 million RFIDs that you consider suitable for this higher level of authentication. And assume that you have a set of 1000 detectable "fingerprints" of potential flaws.
That means that if someone were to attempt to duplicate one of the protected RFIDs, they would only have a 1 in a thousand chance of doing so successfully.
How reliable is this? (Score:1)
Given that the fingerprint is due to "radio-frequency and manufacturing differences" and "significantly different for same-model tags," isn't it also possible that a tag's fingerprint may vary over time?
And if the idea is "to detect counterfeit tags," how can they do that if tags of the same model have different fingerprints?
Quantum tags? (Score:2)