February 01, 2006

Why passports will have RFIDs

The Register revealed the scandalous behaviour of the Dutch promiscuous passports. Quickest description is on EC:

The secret key is made up of the passport expiry date, birth date and the passport number stored in the passport's Machine Readable Zone. The Dutch passport numbering scheme proves to be sequential and has a relation with the passport expiry date. Further, the last digit of the number is a checksum introducing additional predictability. The selection of a new and unpredictable passport numbering scheme would considerably improve the security.

Oops. History does not reveal how it is that the Dutch - normally a country steeped in deep privacy and cryptography that they run things like WhatTheHack where it was first announced - managed to make such a blunder.

One quibble. Adam goes on to say "The radio has no function." I think that's a bit tough to sustain. The point of using RFIDs and so forth comes from long hard-won experience. The experience pans out roughly like this:

  • smartcard people wanted to do money
  • smartcards are too expensive for money
  • only mass transits had the wherewithall to finance smartcards as money
  • mass transits also have mass queues
  • only very fast systems work in mass transits
  • contactless smarts are the only ones that are fast
  • smartcard money therefore had to be RFID.
  • people thinking smartcards therefore think RFID

From there, the decision to add smart cards to passports means they more or less had to include RFIDs. All experience points in that direction, and experience is everything in the smart card world (mostly because there is so little of it).

So the question then reduces to ... how applicable is mass transit experience to the passport issue? This might be considered to be the LAX factor - the answer is "quite a lot" if you've ever been stuck in a queue at a major US airport carefully calculating the time to the gate close on your connection.

Which does nothing to answer the next question: does the LAX factor - the benefit of radio-enhanced fast entry - outweigh the downsides? That seems to be the experiment that the various passport offices are intending to run on their captive subjects, so we will know for sure in about 10 years.

Posted by iang at February 1, 2006 08:17 AM | TrackBack

They already have it in the passports in the US.

Posted by: Jimbo at February 1, 2006 08:27 AM

hi ian. i've always wondered why it would take so much longer to insert a passport containing a chip on the last page into a reader. passport officials already usually swipe the machine-readable section of this page through a reader. takes away pretty much all of the rfid security problems.

Posted by: IanB at February 1, 2006 09:12 AM

Well, the devil is in the details. The problem with using the experience of the masstransits is that they are only interested in LOW VALUE transactions.

Whereas the passport people are inherently after HIGH VALUE transactions.....

Which means the experience is not as valid as all that, and the need to for fast throughput is actually not that relevant.

Posted by: IanG at February 1, 2006 09:13 AM

Except, as I pointed out, tests showed that RFID-enabled passports were processed more slowly. So the LAX factor is the inverse of your claim.

Posted by: Adam at February 1, 2006 10:12 AM

Some related posts...

Contactless Cards Tipped To Displace Cash In US
a lot of work was done on AADS chip strawman in the 98 time-frame to
support proximity, selecting solutions and components that could meet
proximity power profile requirements
Popularity Of Prepaid Cards Triggers Fraud Growth
recent observation on gift card skimming

Posted by: Lynn at February 1, 2006 01:05 PM

"The problem with using the experience of the masstransits is that they are only interested in LOW VALUE transactions."

That's right. Some London Transport season tickets aren't worth more than a few thousand pounds :)

One thing missing from the experience bullet points: the experience of the mass transit folks is that contactless has a much lower lifetime cost of ownership.

Posted by: Dave Birch at February 12, 2006 02:58 PM
Post a comment

Remember personal info?

Hit preview to see your comment as it would be displayed.