RFID Analysis
Posted in Uncategorized on May 30th, 2006 by BergoInteresting, Pragmatic and real world look at the Texas Instruments RFID chip and its security. Available at RFIDAnalysis.org.
These chips are used for:
- Vehicle Immobilizers
- Electronic Payment
The site talks about practical concerns relating to actual exploits (it’s worth reading), as well as providing videos of the exploits and the equipments used to do it. The research paper draft is from January 2005, I am not sure of the actual dates of the research.
A quick excerpt about the type of attack:
The encryption algorithm used in the TI DST tags is an unpublished, proprietary cipher that uses a 40-bit key. The algorithm was designed in the early 1990′s by engineers at Texas Intruments, but is still being deploying in current systems. By today’s standards, a 40-bit key is unacceptably short: advances in computing power have made such keys succeptable to brute-force key guessing attacks. Therefore, the actual security of the DST system rests with the secrecy of the proprietary algorithm used in the tags.
This raises some concerns that if there is mass acceptance of a product, and the strength of security is not great, then there is potentially a lot of systems that may be vulnerable. Mind you this is probably similar to household keys ? I guess there are not millions of different keys for houses or desk drawers or filing cabinets.
I think the important point they make about the electronic payment is that the cryptographic security is one layer, they mention other systems in place to try and detect fraud.