Radio frequency identification is a part of the present and may well be a major part of our future. This situation is, at best, a mixed bag.

It would not be quite so bad if vendors of RFID products and companies that say they want to use them better understood security and privacy.

For those of you who have been cave dwellers over the last few years, RFIDs are small electronic devices, normally with no battery or power supply, that can interact wirelessly to identify themselves to a scanner.

The best-known examples are the very simple devices that companies such as Wal-Mart are asking suppliers to put on pallets of goods and that drug companies are beginning to attach to containers in the distribution chain (see Privacy as an afterthought ). These RFIDs are basically wireless bar codes that respond with a unique serial number when queried by a wireless scanner. Companies with large database infrastructures, like Wal-Mart, can keep track of where individual cartons of goods are in their supply chain or, someday far too soon, what individual products are in a shopper's physical cart.

But not all RFIDs are that simple. Some, like those being considered for the next generation of U.S. passports, can report back a bunch of passport-holder-specific data. Others, like the electronic key used in some cars and the ExxonMobil SpeedPass, include a cryptographic challenge-response interaction in an attempt to make sure that the RFID is not counterfeit.

These have not been particularly good days for the RFID business. Researchers at Johns Hopkins University and RSA Laboratories have shown that the RFID used in the SpeedPass and in the keys for some Ford vehicles can be spoofed reasonably easily (see rfidanalysis.org). The researchers demonstrated that the RFID chips used weak encryption keys that can be broken within a few hours. Imagine thieves scanning for car owners' encrypted keys while standing next to the car owners on elevators. The thieves then could break the encrypted keys and steal the car using normal car burglary tools, knowing that they could fool the electronic interlock into thinking they had the right key.

Texas Instruments, which makes the circuits used in the Ford keys and the SpeedPass, makes similar circuits with longer and harder-to-break keys. But Ford and Exxon decided to use the less expensive, weaker chips. Texas Instruments is not immune from blame here, as it is using a secret encryption algorithm, which violates the most basic of good encryption rules.

Whitepapers

• Gene Kim's Practical Steps to Mitigate Virtualization Security Risks
• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports