Subject: [NEXTEL-1] RSA Seeks to Fix RFID Worries

From: [email-masked]
Date: Tue, 26 Aug 2003 20:57:45 -0400

RSA Seeks to Fix RFID Worries

By Dennis Fisher

August 25, 2003

Researchers at RSA Security Inc.'s (See http://www.rsasecurity.com  lab have come
up with a technique they said will eliminate many of the privacy concerns
surrounding the use of RFID tags and enable enterprises and consumers to use the
technology without worry.

The solution, which involves fooling RFID (radio frequency identification) readers
into believing all possible tags are present at any given time, is an inexpensive,
elegant answer to a number of the privacy and security questions being asked about
RFID technology, security experts say.

RFID tags are being used in a quickly expanding array of industrial and corporate
applications, most notably inventory control and tracking and security and access
control.

The tags are tiny integrated circuits coupled with antennas. Each tag is
programmed with a unique identification number, which it sends to a reader on
request. The tags can be embedded in just about anything, including clothing,
consumer goods, money and credit cards. Tags will be embedded in large euro notes
within two years.

Privacy issues have surfaced because any reader can read the numbers on any tag.
This means a reader in a department store, for example, could not only see what
items a shopper has in her cart but could also see what other items she has
purchased at competing stores, as well as how much money is in her wallet and what
credit cards she's carrying.

The technology that RSA Labs is proposing would make it simple for corporations
and consumers to decide which tags could be read by which readers and when. The
solution uses what's known as a blocker tag to simulate all possible tag serial
numbers. In doing so, it prevents the reader from discovering whether a specific
tag is present.

"The conceptual basis is reasonably simple, and the blocker tags should cost no
more than twice what normal tags cost," said Ari Juels, principal research
scientist at RSA Labs, in Bedford, Mass., and co-author of a paper on blocker
tags. RFID tags typically cost about 5 cents each.

RFID readers can't talk to more than one tag at a time, so when multiple tags
reply to a query, the readers detect a collision and revert to what's known as a
singulation protocol to communicate with each tag individually. To accomplish
this, the reader queries each tag for its next bit, which identifies which portion
of a binary tree the tag resides on. When queried, a blocker tag responds with a
'0' and a '1' bit. This causes the reader to start over and explore the entire
tree.

Such a tag could be programmed to block only a certain range of RFID serial
numbers. This would still allow for benign uses of RFID tags while enabling users
or corporations to control which tags are readable.

"This is a brilliant idea. I'd like to see one of these blocking tags attached to
my wallet or car keys so that all RFIDs would be blocked," said Avi Rubin,
associate professor and technical director of the Information Security Institute
at Johns Hopkins University (SEE http://www.jhuisi.jhu.edu/), in Baltimore. Rubin
has been researching some of the privacy implications of RFID tags. "This is
increasingly important as the tags get embedded in clothing and other personal
items," he said.

RSA is in discussions with RFID manufacturers about developing the blocker tags.

"We're going to need a range of solutions here," Juels said. He and his
co-authors, Ron Rivest, one of the founders of RSA, and Michael Szydlo, also of
RSA Labs, plan to present their paper on the blocker tags at the Association for
Computing Machinery's Conference on Computer and Communications Security in
October.
 
 http://www.eweek.com/article2/0,3959,1229567,00.asp

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Buy Ink Cartridges or Refill Kits for Your HP, Epson, Canon or Lexmark
Printer at Myinks.com. Free s/h on orders $50 or more to the US & Canada. http://www.c1tracking.com/l.asp?cid=5511
http://us.click.yahoo.com/l.m7sD/LIdGAA/qnsNAA/61FxlB/TM
---------------------------------------------------------------------~->

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

---

From: "Dylan Bromby" <[email-masked]>
Date: Tue, 26 Aug 2003 21:45:35 -0700

I'm not so smart, but I don't get the brilliance of the proposed solution.
What happens when XYZ inc. sells a RFID reader capable of scanning multiple
tags at once? I guess, in my ignorance, this seems like a temporary -
possibly VERY temporary - end-run more than a solution to the privacy
concerns.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Tuesday, August 26, 2003 5:58 PM
To: [email-masked]
Subject: [NEXTEL-1] RSA Seeks to Fix RFID Worries

By Dennis Fisher

August 25, 2003

Researchers at RSA Security Inc.'s (See http://www.rsasecurity.com  lab have
come
up with a technique they said will eliminate many of the privacy concerns
surrounding the use of RFID tags and enable enterprises and consumers to use
the
technology without worry.

The solution, which involves fooling RFID (radio frequency identification)
readers
into believing all possible tags are present at any given time, is an
inexpensive,
elegant answer to a number of the privacy and security questions being asked
about
RFID technology, security experts say.

RFID tags are being used in a quickly expanding array of industrial and
corporate
applications, most notably inventory control and tracking and security and
access
control.

The tags are tiny integrated circuits coupled with antennas. Each tag is
programmed with a unique identification number, which it sends to a reader
on
request. The tags can be embedded in just about anything, including
clothing,
consumer goods, money and credit cards. Tags will be embedded in large euro
notes
within two years.

Privacy issues have surfaced because any reader can read the numbers on any
tag.
This means a reader in a department store, for example, could not only see
what
items a shopper has in her cart but could also see what other items she has
purchased at competing stores, as well as how much money is in her wallet
and what
credit cards she's carrying.

The technology that RSA Labs is proposing would make it simple for
corporations
and consumers to decide which tags could be read by which readers and when.
The
solution uses what's known as a blocker tag to simulate all possible tag
serial
numbers. In doing so, it prevents the reader from discovering whether a
specific
tag is present.

"The conceptual basis is reasonably simple, and the blocker tags should cost
no
more than twice what normal tags cost," said Ari Juels, principal research
scientist at RSA Labs, in Bedford, Mass., and co-author of a paper on
blocker
tags. RFID tags typically cost about 5 cents each.

RFID readers can't talk to more than one tag at a time, so when multiple
tags
reply to a query, the readers detect a collision and revert to what's known
as a
singulation protocol to communicate with each tag individually. To
accomplish
this, the reader queries each tag for its next bit, which identifies which
portion
of a binary tree the tag resides on. When queried, a blocker tag responds
with a
'0' and a '1' bit. This causes the reader to start over and explore the
entire
tree.

Such a tag could be programmed to block only a certain range of RFID serial
numbers. This would still allow for benign uses of RFID tags while enabling
users
or corporations to control which tags are readable.

"This is a brilliant idea. I'd like to see one of these blocking tags
attached to
my wallet or car keys so that all RFIDs would be blocked," said Avi Rubin,
associate professor and technical director of the Information Security
Institute
at Johns Hopkins University (SEE http://www.jhuisi.jhu.edu/), in Baltimore.
Rubin
has been researching some of the privacy implications of RFID tags. "This is
increasingly important as the tags get embedded in clothing and other
personal
items," he said.

RSA is in discussions with RFID manufacturers about developing the blocker
tags.

"We're going to need a range of solutions here," Juels said. He and his
co-authors, Ron Rivest, one of the founders of RSA, and Michael Szydlo, also
of
RSA Labs, plan to present their paper on the blocker tags at the Association
for
Computing Machinery's Conference on Computer and Communications Security in
October.

---

From: [email-masked]
Date: Wed, 27 Aug 2003 01:46:05 -0400

Temporary is right! Did you know their is a RFID hacker group? I did not know until recently. These guys are slick,
real slick.
They have devised a wide area device to circumvent RFID in warehouses, ports and airports. They performed a demo at a
500'X1500' warehouse full of high tech consumer devices. The owner bragged that his system was Bullet Proof and
nothing goes in or out with out his knowledge. 20 Mins after the commencement of the test the owner  turned red like a
tomato and stomped off after the RFID hackers removed $10K of electronics with out breaking a sweat. The two RFID
hacker guys were wired head to toe with covert devices that allowed them to remove the electronics effortlessly.
Presently they are not saying how they did it but they promise a full report soon.

---

From: Rick Parrish <[email-masked]>
Date: Wed, 27 Aug 2003 00:58:11 -0500

Dylan Bromby wrote:

>I'm not so smart, but I don't get the brilliance of the proposed solution. What happens when XYZ inc. sells a RFID reader capable of scanning multiple tags at once? 
>
They do that now - although you can run into collision problems with 
multiple tags talking on top of each other. Also, the data transfer rate 
for these devices is very slow - it would take a while for the 
hypothetic RSA tag to exhaust all the possible response code 
combinations. Since it's energized by the reader it would likely be 
de-energized long before coming close generating all possible response 
codes.

Actually, I'm disappointed that the RSA guys (who've brought us some 
very, very good encryption) are proposing this.

>I guess, in my ignorance, this seems like a temporary - possibly VERY temporary - end-run more than a solution to the privacy concerns.
>
It's an obsolete solution - automobile key fobs already employ a hopping 
code technique. For RFID, the tag would produce a different response 
every time. The reader/tag combination could implement 
challenge-response where the reader identifies itself first. If the tag 
doesn't recognize the reader, it won't respond.

I think there are a number of other, better solutions to this little 
problem.

-rick

---

From: Rick Parrish <[email-masked]>
Date: Wed, 27 Aug 2003 01:03:12 -0500

[email-masked] wrote:

>The two RFID hacker guys were wired head to toe with covert devices that allowed them to remove the electronics effortlessly. Presently they are not saying how they did it but they promise a full report soon.
>  
>
Oh, so THATS what that was all about ...

-rick