Epc Rfid Tag Security Weaknesses And Defenses: Passport Cards, Enhanced Drivers Licenses, And Beyond

EPC (Electronic Product Code) tags me industry-standard RFID devices poised to supplant optical barcodes in many applications We explore the systemic risks and challenges created by the increasingly common use of EPC for security applications As a central case study, we examine the recently issued United States Passport Card and Washington State "enhanced drivers license" (WA EDL), both of which incorporate Gen-2 EPC tags We measure multiple weaknesses, Including susceptibility to cloning, extended read ranges, and the ability to remotely kill a WA EDL. We study the implications of these vulnerabilities to overall system security, and offer suggestions for improvement We demonstrate anti-cloning techniques for off-the-shelf EPC tags, overcoming practical challenges in a previous proposal to co-opt the EPC "kill" command to achieve tag authentication Our paper fills a vacuum of experimentally grounded ! evaluation of and guidance for security applications for EPC tags not just in identity documents, but mole broadly in the authentication of objects and people