Rfid Tag Security

Building Radio frequency IDentification for the Global Environment

White Paper RFID Tag Security

Authors: Manfred Aigner (TU Graz), Trevor Burbridge (BT Research), Alexander Ilic (ETH Zurich), David Lyon (GS1-UK), Andrea Soppera (BT Research), Mikko Lehtonen (ETH Zurich)

1

2

PREFACE About the BRIDGE Project BRIDGE (Building Radio frequency IDentification for the GlobalEnvironment) is a 13 million Euro RFID project running over 3 years and partly funded (€7,5 million) by the European Union. The objective of the BRIDGE project is to research, develop and implement tools to enable the deployment of EPCglobal applications in Europe. Thirty interdisciplinary partners from 12 countries (Europe and Asia) are working together on : Hardware development, Serial Look-up Service,Serial-Level Supply Chain Control, Security, Anti-counterfeiting, Drug Pedigree, Supply Chain Management, Manufacturing Process, Reusable Asset Management, Products in Service, Item Level Tagging for non-food items as well as Dissemination tools, Education material and Policy recommendations. For more information on the BRIDGE project: www.bridge-project.eu

Disclaimer: Copyright 2008 by (TUGraz,BT Research, ETH Zurich, GS1 UK) All rights reserved. The information in this document is proprietary to these BRIDGE consortium members. This document contains preliminary information and is not subject to any license agreement or any other agreement as between with respect to the above referenced consortium members. This document contains only intended strategies, developments, and/orfunctionalities and is not intended to be binding on any of the above referenced consortium members (either jointly or severally) with respect to any particular course of business, product strategy, and/or development of the above referenced consortium members. To the maximum extent allowed under applicable law, the above referenced consortium members assume no responsibility for errors or omissions in thisdocument. The above referenced consortium members do not warrant the accuracy or completeness of the information, text, graphics, links, or other items contained within this material. This document is provided without a warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, ornon-infringement. No licence to any underlying IPR is granted or to be implied from any use or reliance on the information contained within or accessed through this document. The above referenced consortium members shall have no liability for damages of any kind including without limitation direct, special, indirect, or consequential damages that may result from the use of these materials. Thislimitation shall not apply in cases of intentional or gross negligence. Because some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. The statutory liability for personal injury and defective products is not affected. The above referenced consortium members have no control over the informationthat you may access through the use of hot links contained in these materials and does not endorse your use of third-party Web pages nor provide any warranty whatsoever relating to third-party Web pages.

3

CONTENTS 1. Executive Summary 2. Introduction 2.1. The BRIDGE project 2.2. Objectives of The Security Research Group (SRG) 2.3. Scope of the SRG 2.4. Description of Work - Security Analysisand Requirements 2.4.1. RFID Tag Security 2.4.2. Anti-cloning of RFID Tags 2.4.3. Development of an RFID Trusted Reader 2.4.4. Supply Chain Integrity 3. Security Case Studies 3.1. Authentication 3.2 e-Pedigree 3.3 Track and traceability 3.4 Returnable transit units 3.5 Enabling After-Sales and Returns Whilst Protecting Consumer Privacy 4. The Background to RFID Security 4.1 Tag & System Security...