Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


08:20 AM

I've Been Chipped

The technology behind my new RFID-equipped US passport has been thought out remarkably well

I don't travel all that much, but most of the travel I do is international. Living here in Cambodia there just aren't that many places to go, so even short trips usually wind up crossing international borders.

Perhaps this is why passports are really interesting to me. We just got new U.S. passports for our whole family, and they all have RFID tags embedded in them. They are really quite impressive looking documents, with many different types of anti-counterfeiting features, but they are the first documents I've seen that have an electronic component embedded. Actually, I should say the first documents I've noticed, since it is entirely possible that I've handled other documents that had some form of RFID tag (not counting the shoplifting protection things that bookstores used).

I must confess that I haven't paid much attention to the long process of working toward these electronic identity documents. So when I was issued one I felt a bit hesitant. It clearly is cool in the technical sense. If they hadn't increased the rigidity of the covers to protect the chip, I'm not sure I'd even know that the thing was in there. But whether I know it is in there or not, do I really want random people in the airport being able to read my passport as they walk by?

So I did what any self-respecting security-minded person would do and searched "RFID passport" on Google. I happily found that Bruce Schneier has written on this, along with essentially all other topics in the world of security. To summarize his positions, he started out worried and then as new privacy features were added, he got more comfortable with the designs. After reading his summaries, I agree.

There was a very good idea developed, and that is to use the optically-readable strip of numbers that includes the passport number as a key, and encrypt the data on the RFID chip using this key. That way, without physical possession of the passport, the chip is essentially unreadable. Good. Now I only broadcast the fact that I have one of these swanky new passports, not what is in it.

So then the question is, why have the RFID system in the first place? Currently the passport is scanned by officials, and that will continue. Just holding the passport next to a reader is cool, no doubt, but is there a good reason to have this system in place? Well, storing more data on the card (as is planned, including fingerprints and the like) is a good reason, right? That makes it more difficult to forge, assuming the small number of passport centers can sign all the data and keep control of the signing keys.

But here's where the plot really thickens. As this article points out (with quotes from Schneier again; is there anywhere the man doesn't turn up?) the technology is cool, but why isn't it contact based? Aren't smartcards cool too? Is it good to have American tourists, or even just foreigners, remotely detectable? You can normally pick out Americans based on the loud shirts and tube socks, but this is a bit more, um, automated.

I do think, however, that there are some advantages to the non-contact based RFID chips over a contact based solution. In the real world, contact points get dirty. A contact system needs, by definition, an exposed chip, or at least contact for the chip. That's going to reduce reliability and require more robust readers at points of entry. That's not a good thing. Simplicity is great, but if we're going to have biometric data in our passports, this system does seem to me to be pretty reasonable.

That being said, I haven't been back to the U.S. since I got the new passport. It will remain an open question in my mind until I actually start seeing these passports in use. I'm sure there will be some sort of attacks based on the RFID chip, but I do think that perhaps, just perhaps, the State Department has made a decent choice here. Any new system containing interesting data will of course be subject to attack, and there are some scary possible scenarios here, but for me at least, I'm going to sit solidly on the fence for a while longer.

Do any of you have experiences with the new e-Passports? Do they make things better or worse upon entry? Let me know.

— Nathan Spande has implemented security in medical systems during the dotcom boom and bust, and suffered through federal government security implementations. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
10 iOS Security Tips to Lock Down Your iPhone
Kelly Sheridan, Staff Editor, Dark Reading,  5/22/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-05-28
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
PUBLISHED: 2020-05-28
node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.
PUBLISHED: 2020-05-28
Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 through, and possibly R6120, R7800, R6220, R8000, R6350, R9000, R6400, RAX120, R6400v2, RBR20, R6800, XR300, R6850, XR500, and R7000P.
PUBLISHED: 2020-05-28
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 175484.
PUBLISHED: 2020-05-28
A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, causing an error to be displayed and preventing printer from functioning until the printer is rebooted...