NFC Chips In New US Passports Less Secure - Why?
Feb 8, 2013, 9:38 pm
#1
Original Poster
Join Date: Jul 2000
Posts: 3,746
NFC Chips In New US Passports Less Secure - Why?
In the past, I had tried using my Android phone with NFC chip to read US passports but was unable to do so (I was however able to read German passports and I think UK.)
A family member has a new US passport issued this month. I can hold the phone up to the back cover of the passport and easily read the NFC chip and even see the photograph on my phone (after typing in the passport number, DOB, and DOE.)
I'm not certain that this creates any risk as you don't see any info you don't see in the passport itself - it just confirms on the phone what you see in the passport. It certainly allows anyone, government affiliated or not, to verify the passport as genuine.
The US passports that I was unable to read were both issued in 2008 (and I still can't read them.) The old passports do not appear to be detected in any way by the reader.
Any ideas out there as to why this change?
(perhaps the old chips were RFID and now they are NFC?)
A family member has a new US passport issued this month. I can hold the phone up to the back cover of the passport and easily read the NFC chip and even see the photograph on my phone (after typing in the passport number, DOB, and DOE.)
I'm not certain that this creates any risk as you don't see any info you don't see in the passport itself - it just confirms on the phone what you see in the passport. It certainly allows anyone, government affiliated or not, to verify the passport as genuine.
The US passports that I was unable to read were both issued in 2008 (and I still can't read them.) The old passports do not appear to be detected in any way by the reader.
Any ideas out there as to why this change?
(perhaps the old chips were RFID and now they are NFC?)
Feb 9, 2013, 9:29 am
#4
Original Poster
Join Date: Jul 2000
Posts: 3,746
Feb 9, 2013, 9:50 am
#5
Join Date: Apr 2010
Location: ORD
Programs: AA, UA, GE
Posts: 5,123
Originally Posted by BigFlyer:20215429
NFC Taginfo: http://bit.ly/YMFG3g
Feb 9, 2013, 9:57 am
#6
Original Poster
Join Date: Jul 2000
Posts: 3,746
After you do the read/scan, you need to click on "ePassport (MRTD)", then click on the white field that has the phrase "Did you setup the correct access keys?" and fill in the information.
QUOTE=cheltzel;20215527]I tried that one ... mmm ... I'll try again[/QUOTE]
QUOTE=cheltzel;20215527]I tried that one ... mmm ... I'll try again[/QUOTE]
Feb 9, 2013, 10:22 am
#7
Join Date: Apr 2010
Location: ORD
Programs: AA, UA, GE
Posts: 5,123
But I don't see how it is really that insecure. You need to know a fair amount of personal information about someone to scan their passport.
To get that information you would need to have physical access to the passport.
Maybe if you posses some advanced crypto busting software you could break open the data.
Feb 9, 2013, 11:30 am
#8
Original Poster
Join Date: Jul 2000
Posts: 3,746
I don't know that it creates a security problem - my point was that I couldn't read the 5 year old passports at all, but the newer one seems readable, so less secure in some theoretical way. What's the date of your passport?
Can you read the chip with the passport book closed?
Apparently the intent of the chip is for authentication purposes by one who has access to the passport:
Can you read the chip with the passport book closed?
Apparently the intent of the chip is for authentication purposes by one who has access to the passport:
We have adopted Basic Access Control (BAC) to minimize the risk of “skimming” and “eavesdropping.” Basic Access Control requires that the initial interaction between the embedded microchip in the passport and the border control reader include protocols for setting up the secure communication channel. To ensure that only authorized RFID readers can read data, Basic Access Control stores a pair of secret cryptographic keys in the passport chip. When a reader attempts to scan the passport, it engages in a challenge-response protocol that proves knowledge of the pair of keys and derives a session key. If authentication is successful, the passport releases its data contents; otherwise, the reader is deemed unauthorized and the passport refuses read access. This control would require the receiving state to read the passport machine-readable zone (MRZ) to unlock and read the data on the chip. The MRZ information is used for computing the encryption and message authentication keys used for the “secure” exchange. BAC mollifies the possibility of both “skimming” and “eavesdropping.”
http://travel.state.gov/passport/pas...88.html#TwelveI just did that and am now able to read the extended data.
But I don't see how it is really that insecure. You need to know a fair amount of personal information about someone to scan their passport.
To get that information you would need to have physical access to the passport.
Maybe if you posses some advanced crypto busting software you could break open the data.
But I don't see how it is really that insecure. You need to know a fair amount of personal information about someone to scan their passport.
To get that information you would need to have physical access to the passport.
Maybe if you posses some advanced crypto busting software you could break open the data.
Feb 9, 2013, 11:34 am
#9
Suspended
Join Date: Dec 2012
Programs: A3, AA. Plasticy things! That give me, y'know, Stuff!
Posts: 6,293
To give you another perspective, the first year encryption & security classes in the CompSci dept at my old university use UK passport RFID chips as their end of year project for breaking encryption. If a bunch of mildly over-achieving 18 year olds with ~6 months of instruction can do it in the two weeks they're given then it's not exactly good security.
Feb 9, 2013, 12:32 pm
#10
Original Poster
Join Date: Jul 2000
Posts: 3,746
Well, I'm looking forward to the Android app that incorporates that decryption technology so I can read passports without having to type in the information.
The State Department website I linked in my post is also incorrect when it says that the chip cannot be read with the passport closed - it can be easily read with the passport closed.
The State Department website I linked in my post is also incorrect when it says that the chip cannot be read with the passport closed - it can be easily read with the passport closed.
The encryption most countries use was broken within ~3 days of the first passports coming out. It's (intentionally, IMO) a very low level of security on those things. The very first passports didn't even bother with encryption because, well, the people developing the passports were stupid.
To give you another perspective, the first year encryption & security classes in the CompSci dept at my old university use UK passport RFID chips as their end of year project for breaking encryption. If a bunch of mildly over-achieving 18 year olds with ~6 months of instruction can do it in the two weeks they're given then it's not exactly good security.
To give you another perspective, the first year encryption & security classes in the CompSci dept at my old university use UK passport RFID chips as their end of year project for breaking encryption. If a bunch of mildly over-achieving 18 year olds with ~6 months of instruction can do it in the two weeks they're given then it's not exactly good security.
Feb 9, 2013, 2:19 pm
#11
Original Poster
Join Date: Jul 2000
Posts: 3,746
I've done some Googling and found that people have been able to break encryption by using or guessing correctly some of the information that is necessary for the BAC encryption and then using brute force to decrypt. For example, knowing the date of birth, guessing the expiration date, and then brute-forcing the passport number.
However, I have not seen anywhere that it is possible to decrypt without having any information - in other words, I have not seen that anyone can access the information simply by taking the passport, having no information about the passport holder, and scanning.
Do you believe it is possible to read the chip with no information about the passport holder? If so, do you have a link anywhere where that is documented?
However, I have not seen anywhere that it is possible to decrypt without having any information - in other words, I have not seen that anyone can access the information simply by taking the passport, having no information about the passport holder, and scanning.
Do you believe it is possible to read the chip with no information about the passport holder? If so, do you have a link anywhere where that is documented?
.
To give you another perspective, the first year encryption & security classes in the CompSci dept at my old university use UK passport RFID chips as their end of year project for breaking encryption. If a bunch of mildly over-achieving 18 year olds with ~6 months of instruction can do it in the two weeks they're given then it's not exactly good security.
To give you another perspective, the first year encryption & security classes in the CompSci dept at my old university use UK passport RFID chips as their end of year project for breaking encryption. If a bunch of mildly over-achieving 18 year olds with ~6 months of instruction can do it in the two weeks they're given then it's not exactly good security.
Feb 9, 2013, 3:59 pm
#12
Join Date: Apr 2010
Location: ORD
Programs: AA, UA, GE
Posts: 5,123
I've done some Googling and found that people have been able to break encryption by using or guessing correctly some of the information that is necessary for the BAC encryption and then using brute force to decrypt. For example, knowing the date of birth, guessing the expiration date, and then brute-forcing the passport number.
However, I have not seen anywhere that it is possible to decrypt without having any information - in other words, I have not seen that anyone can access the information simply by taking the passport, having no information about the passport holder, and scanning.
Do you believe it is possible to read the chip with no information about the passport holder? If so, do you have a link anywhere where that is documented?
However, I have not seen anywhere that it is possible to decrypt without having any information - in other words, I have not seen that anyone can access the information simply by taking the passport, having no information about the passport holder, and scanning.
Do you believe it is possible to read the chip with no information about the passport holder? If so, do you have a link anywhere where that is documented?
Feb 10, 2013, 10:13 am
#13
Join Date: Feb 2008
Posts: 1,154
My wife's I can't read with the passport closed using my phone. No idea if a better reader would be able to or not. Not sure if I'd consider anything that it's pulling off to be all that sensitive either.
Feb 11, 2013, 9:56 am
#14
FlyerTalk Evangelist
Join Date: Sep 2001
Location: FW, TX, USA, Earth, Milky Way
Programs: 2008 FT1 Fantasy Football Champion
Posts: 10,584
I downloaded the app and all I got were the tones that it was reading something, but the app didn't actually show me anything, even after I put in the passport info. Of course, I have no clue if I was even using the app correctly.
My PP was issued late 2011.
My PP was issued late 2011.
Feb 11, 2013, 10:08 am
#15
Join Date: Feb 2008
Posts: 1,154
I found that I had to leave the app and reload it to get it to re-read the tag after I'd read it without the passport info. You can tell it's working because it takes a *lot* longer than it did for the initial read.