Skip Links

Network World

  • Social Web 
  • Email 
  • Close

State Department's RFID passport proposal gets complex

State Department could add layer of complexity to RFID passports
Security: Identity Management Alert By Dave Kearns , Network World , 05/02/2005
Kearns
Sign up for this newsletter now!

Dave Kearns provides the information you need to evaluate, install and maintain your corporate identity management system.

I read a story on Wired News' Web site (see link below) about changes the U.S. Department of State is making to its proposal for RFID chip-embedded passports after privacy advocates demonstrated that RFID chips could be read at distances of 30 feet or more. According to the story, the government agency had claimed that the chips could only be read if they were no more than 10 centimeters (about 4 inches) from the reader.

Those opposed to the RFID-enabled passports claimed that terrorists and criminals could easily identify tourists and Americans by surreptitiously reading the chips on their passports from a distance. After Barry Steinhardt, director of the Technology and Liberty Program for the American Civil Liberties Union, demonstrated a chip being read from 2 to 3 feet away at the recent Computers, Freedom and Privacy conference, the State Department announced it would look once again at Basic Access Control (BAC), a privacy technology it had originally rejected.

According to the story, BAC would protect the RFID chip from being read by unauthorized people:

"The data on a passport would be stored on an RFID chip in the passport's back folder, but the data would be locked and unavailable to any reader that doesn't know a secret key or password to unlock the data. To obtain the key, a passport officer would need to physically scan the machine-readable text that's printed on the passport page beneath the photo (this usually includes date of birth, passport number and expiration date). The reader would then hash the data to create a unique key that could be used to authenticate the reader and unlock the data on the RFID chip."

Does anyone else think that this is a Rube Goldberg (http://www.rube-goldberg.com/html/gallery.htm) design for a passport?

The idea behind using RFID technology is to be able to read the data from the chip when it is in proximity to the reader. No need to position the chip "correctly," no need to touch the reader with the chip, no need to actually remove the chip from your pocket, purse or backpack. But now, in order to protect the data on the RFID chip, the chip's holder (the passport) will need to be properly positioned in contact with a reader in order to create a key, which can then be used to decode the data on the chip.

Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask to prospective vendors to get the right endpoint solution.

Download the white paper.

Unauthorized applications: Taking back control

Employees installing and using unauthorized applications like IM, VoIP, games and peer-to-peer file-sharing applications cause many businesses serious concern. How do you control these applications?

Download the white paper.

Comment
Login
Forgot your account info?
Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed
Get instant email notification when white papers, webcasts, executive guides are added to our library. Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.

Whitepapers

Advancing the Economics of Networking

Aging network systems and old habits have dictated how businesses spend their IT budgets. As a...

Implementing HA at the Enterprise Data Center Edge to Connect to a Large Number of Branch Offices

This paper reviews the problem of creating a network where the dynamic availability of services is...

Enterprise Data Center Network Reference Architecture

Using a High Performance Network Backbone to Meet the Requirements of the Modern Enterprise Data...

Webcasts

PoE Plus: Impact on the PoE Market

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Harnessing the power of communications to increase workplace performance

Due to the convergence of IT and telecommunications technologies, the business workplace has been...

Stay out of the headlines: Detecting and preventing network intrusions

How do YOU stay out of the headlines? There is no denying that risk exists in our computer-driven...

Special Reports

The Evolution of Network Security

We have so many holes punched in our firewalls today that many industry insiders question the value...

IP address management in 2008 - six things to know

Read this Network World Special Brief to learn how Enterprise IT managers must update their...

The self-managed network

We aren't there yet, but advances in network and systems management tools are making it possible to...