Slashdot Mirror
British "Secure" Passports Cracked
hard-to-get-a-nickna writes "The Guardian has cracked the so-trumpeted secure British passports after 48 hours of work:
'Three million Britons have been issued with the new hi-tech passport, designed to frustrate terrorists and fraudsters. So why did Steve Boggan and a friendly computer expert find it so easy to break the security codes?'"
> So why did Steve Boggan and a friendly computer expert find it so easy to break the security codes?
He helped issue them in the first place? No, just joking.
But seriously, he didn't, did he?
"You can justify anything by putting it in quotes, adding a famous name and making it a sig" - Albert Einstein
Cracking the passports was inevitable, as is the cracking of the ID cards when they come in. Computer security on such a large scale is very, very difficult to get right.
Many large companies have invested huge sums of money into trying to prevent their systems being cracked. Take cable/satellite TV providers for example. Looking at the government`s record on IT projects, it was obviously doomed to failure from the start.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Wait for a few minutes and you'll see ;) In the meantime, you might want to read the FAQ
"When I first heard Daydream Nation it quite frankly scared the living shit out of me." -- Matthew Stearns
Governments fail. Shocking!
Remember, kids: government intervention is good.
Global warming is a cube.
technology. So in a sense, they've already been hacked. The word "DOH" springs to mind.
Deleted
Home Office spokesman.
"If you were a criminal, you might as well just steal a passport."
Missing the point dude.
If my passport gets stolen, I report it. It gets cloned, I've no idea somebody is impersonating me, screwing up my life (and others).
Please people, support NO2ID and tell Blair where to shove his flawed ID cards and CCTV cameras.
Anyone quoted by a reporter knows how little they understand
Don't believe what you read is the truth.
I just finished reading the article.
In short, the weakness lies in the fact that although DES3 is used to encrypt the communication between the passport chip and the reader, the key is based upon data that's available on the passport:
I hear there's rumors on the Slashdots
The dumb thing is that the personal information is SUPPOSED to be unencrypted - it's part of the spec. Thus, the 3DES (Ha Ha) encryption of the "hello" connection is irrelevant; though if the key really is based on public information it looks like someone really has lost the plot.
In any case, isn't 3DES being phased out because the cost of cracking it has fallen dramatically recently?
What fundamental principle of encryption are they breaking? If anything, a fundamental principle of encryption is that there can't be such a thing as a "secret key" if you're either putting it in the passport or if you're deploying it to everybody that needs to scan passports (remember DVD encryption?).
What's important is to have the data in the passport (along with the picture) digitally signed, in order to avoid tampering. The article claims that these passports are indeed signed and they didn't break the signature. Big surprise, since all they did was get a RFID reader and decrypt 3DES with the key right in front of them.
Don't see how you can... but anyway an exploit would be a problem with the reading software, not with the passports. And it could be more easily patched after deployment.
The article then presents some more valid points... but these have nothing to do with the basic encryption being broken. FUD mostly, surprise, surprise.
As a Slashdot discussion grows longer, the probability of an analogy involving cars approaches one.
Maybe they know something you don't?
slashdot troll = you make a compelling argument I do not like the implications of.
The world, QED.
Acting stupid isn't much fun when there's someone around who knows better
Is this true? I had the impression that the 911 terrorists had valid ID, but I haven't read the 911 commssion report...
Can somone point me to some information confirming or disproving this assertion?
It means you can get away with all sorts of stuff and then claim "It wasn't me mate", someone must have cloned my passport.
We do have some complete fuckwits in charge. Of course, we do have some complete fuckwits voting for them, so it kind of balances out. Someone care to suggest an improvement on democracy?
Deleted
FTA: "Remember, information - such as a new picture - cannot be added to a cloned chip."
I believe the missing word is "yet".
SIG: TAKE OFF EVERY 'CAPTAIN'!!
As usual, the RFID passport leaks information and is easy to clone.
I don't want to sound trollish, but the major force behind biometric passports worldwide is Homeland Security in USA: "You want visa free entrance to US? Make biometric passports!". Honestly, this is plain bullying.
Besides, if the border guard thinks the passport is "secure", then he'll spend less time thinking about that person and just rely on the big "OK" that pops on his screen when he swipes the thing instead of evaluating the person with his brain and guts.
TFA mentions brute-force protection. For a thing, like credit card, that can be replaced within 3-5 days, it's ok, but for a passport, that some joker "brute-forced" and now it is locked, it is really tragic, especially if You are away from home and this is Your only ID.
I think that the ID should be un-trivial to counterfeit. It should deter "common" people from tampering with it for some small, petty crimes. For well funded operations, obtaining a real passport isn't a problem - bribe the migration official and he issues You one on whatever name.
My slightly watered point is - ID should be used for "some" identification. Trust is a human thing and not machine solvable.
Heck, Your motherboard may be bugged right now by some weird conspiracy and no matter what security measures You take, such as bug sweeps or cable checks, You're screwed already since CIA and NSA and Mossad altered the CPU. It's a human thing.
Lone Gunmen crew.
We don't have a democracy, in either the pure form (which is an unworkable ideal anyway) or the popular interpretation (which is much more sensible approach in practice).
Blair has an absolute majority of MPs in Parliament, which effectively means he can force through almost anything. That doesn't mean an absolute majority of the electorate support him. Remember, Labour lost the popular vote in England at the last general election, and even with the support of MPs from our neighbour countries to prop them up, they still only received around 1/3 of the overall popular vote.
Blair and co have gone about forcing laws through and creating legacies, but the simple fact is that they have no mandate to bring in the kinds of sweeping change they are championing, unless at the very least they also have support from the other main parties who brought in other people's votes. Clearly in many of these so-called anti-terrorism matters, they do not.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
The security algorithm was good. The problem was they did not keep the keys secure.
And Again, We the british Public ask, what exactly have we gained from being forced to pay over our hard earned cash for these cards?
You can clone the passport, as the article says the facial biometric is a joke, 20-25% false positives or negatives. Which leaves just the photo, a bit of makeup, coloured contacts, hair dye. So essentially the new passport is no better than the old one but gives people the warm fuzzy feeling that all is right with the world because the computer says so.
Deleted
That would enable very cheap readers to authenticate passports and holders, and no option to fake it.
Even if people were to succeed in faking it, a criminal (let's not go down the terrorist route for once) wouldn't be able to erase his old identity from the books without deep inside help, which would probably be noticed by too many people.
Oh, how I hate this kind of spin: "This doesn't matter," says a Home Office spokesman. "By the time you have accessed the information on the chip, you have already seen it on the passport."
It matters a great deal because what they said couldn't be done can be done.
It transpired a couple of years ago that some models of the expensive Kryptonite bicycle lock could be opened with a BIC pen. The Kryptonite company could have spun this by saying "This doesn't matter, because the security expert who demonstrated this didn't really steal the bicycle, and bicycle owners actually keep their valuables in their safe deposit boxes."
What the Kryptonite company really did was acknowledge that this was a serious problem and recalled all the locks.
Would that the UK government addressed the security problem instead of the PR problem.
"How to Do Nothing," kids activities, back in print!
1. I don't understand why they use RFID. If you are not supposed to read it from further than two centimeters then why not use a contact chip (smartcard) ? It would be as practical to read and you would be sure that no one could read it without your knowledge. 2. The argument in the article that goes "if you can read it you can clone it" it completely bogus and make them sound like idiots. Have they never heard of challenge-request authentication ? The basic idea is that the reader authenticates the chip to ensure it is not a forged one. To do this you have a shared secret in both the chip and the reader. The reader then sends a random challenge to the chip, which encrypts it with the secret and send the result back. The reader does the same operation and compares the result. If it matches it considers that the chip knows the secret and is thus original.
The key idea then is that the chip never sends the secret directly, so a cloner could never guess it, even if it could issue an unlimited number of challenges to the original chip. And without the secret, it cannot produce a clone that would authenticate.
So in short to clone the chip you need more than the chip, you need to compromise the manufacturer of the system to get the secret.
The sooner you fall behind, the more time you have to catch up.
Here I will attempt to abuse a completely overused cliche:
Production value of a typical Hollywood theatrical blockbuster: ~$150M
DVD distribution production costs: ~$7M
Developing an "unbreakable" security algorithm: ~$1.5M
Having some PERL monkee write a few lines code to make you look foolish: Priceless
Some things money can't buy, for everything else, there are retards to spend frivolously on the next big "THING".
A very pretty, pre-customised, credit-card-sized drinks coaster!
What's purple and commutes? An Abelian grape.
May the Maths Be with you!
So how long will it be before someone calls for their arrest and they get thrown in jail?
Skivvy Niner? Email me!
HEY! Look left just ONE MORE TIME!
The basic problem isn't the algorithm they choose. It's that their goal is incompatible with security.
They wish to establish a world where all people can be instantly identified, correlated with commercial profiles, and tracked wherever they travel.
How can this be done "securely"? It cannot.
Let's assume you get these politicians to understand some basics of encryption and physical security (and good luck with that). So, you now have a system where all people can be instantly identified and tracked by the government. Secure from... what, exactly? Secure from being tracked by unauthorized people?
Who is unauthorized, and why? I certainly have no say in who gets authorized to track me. Thousands or hundreds of thousands of random workers have access to the "authorized" level. This doesn't sound very "secure" to me.
It's like an electrocution collar you get to wear around town, "secure" in the knowledge that its encryption protocol is flawless. The only people who can activate it are from the police department, or friends of police officers, or people who sneak into the police building and use a computer there when nobody's looking. It is secure, and cannot be triggered except from the police station. Yet, in the broader sense of security, the mere fact of the collar's existence around my neck is the absolute opposite of security.
It doesn't really matter how secure they make the algorithms. A system whose purpose is to authoritatively track and identify all individual humans "from above" is insecure, by definition.
Hadn't seen articles posted from someone's Slashdot journal to the front page before. Is this a new trend or just a random occurrence?
But just look at history. A better choice always takes more time to create, and is more expensive to design and implement, but in the long run it pays off much better. Take Unix, most of RSA's products, etc. There's no short cut to success, there is no overnight solution. Its just that a lot of people with power can't simply realize that common fact.
Well, to whoever said common sense was common
Microsoft: "You've got questions. We've got dancing paperclips."
How much happier would /. be it they based the security of the nation on a system that assumed you could make it imposible to copy digital data?
For once the experts got it right and realised the chips would always be copyable - and concentraited on making them unmodifiable!
The encription was only to stop people skiming your passpord whilst it is in your pocket (think Tin Foil Hat), and this has certanly not been broken. By using a unique key for each passport and not doing a centerilised lookup for each read makes this a very very secure system.
Why they used a contactless system in the first place, and what they will do when the signing is cracked are totaly diffrent matters.
Have we learned nothing?
The article states that if you can see the human-readable part of the passport, or even just take a good guess at the details, you can extract the rest of the data from the RFID chip -- and clone it. Encryption is used to ensure that nobody can eavesdrop on a transaction once initiated, but that doesn't help the fact that every transaction is presumed legitimate -- and the very nature of RFID means that you aren't always able to know that a transaction is taking place. If there isn't a human being checking passports, just a machine -- and one day, that is exactly how it will be -- one of those cloned RFID chips will be enough to get you past it.
Attempting to automate people out of the loop is asking for trouble, because we can always know what tests a machine is performing and falsify the results. Criminals are not stupid -- and smart people can often be bought. If the anticipated returns are high enough, you can be sure that someone will put up the stake. Security through obscurity is worse than no security, because it leads people to believe that their details are safe when they are not.
By the way, if you want to see how easy it is to commit identity theft, start here.
Je fume. Tu fumes. Nous fûmes!
All RFID passports are compatible and follow the same standard, meaning that all passports issued with RFID in the US and EU have the same flaw.
The problem is they dont keep it simple. Add complexity and the problems start to creep in.
True - provided you're trying to get Alice to talk to Bob! Those two know a thing or two about cryptography by know and can deal with keeping keys secret, using strong passwords etc.
It all gets rather harder if you're dealing with a huge messy system composed of hoardes of busy people who neither understand nor wish to understand the system. And that's just the immigration officers, never mind joe public!
The system that they cracked seems entirely fit for the (obviously intended) purpose of preventing casual sniffing of the RFID information. It makes the perfectly pragmatic assumption that, if the bad hats get physical posession of the passport you're screwed anyway.
They could have used a "secret" key (or something more sophisticated) because every immigration desk in every participating country then needs a secret key to "unlock" the info - and as soon as one of those (inevitably) leaks every passport in a dozen countries would have to be updated or replaced.
The problem is that all any technological change like this can achieve is to make counterfieters work that little bit harder (the article didn't say if the info had been digitally signed - which would really help there and would be totally unrelated to anti-RFID-snooping measures).
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
It would be also really interesting to know if 9/11 attackers had valid of forged ID documents.
http://it.slashdot.org/article.pl?sid=06/08/03/131 4207
How is this cracked?
The passport functioned as designed. The only thing the key is designed to prevent is remote surreptitious downloading of the data from the chip. If you hand someone the passport, what sort of privacy do you expect?
Call me when they can successfully ALTER the chip data and create a valid digital signature. Merely copying the data won't help.
What we really need is some super-advanced alien race to make contact and hand us a totally infallible identification symbol. It might also help cut down on the problem if it made any potential identity thief drop dead on the spot.
The instant telepathic communication feature would annoy the hell out of the cellphone companies, but might make cinemas a bit quieter (shame about all that writhing polychromatic light from people's wrists reflecting off the screen).
Trouble is, we'd probably be dragged into some silly cosmic "war on terror" as a result.
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
person B: cool!
person A sits down beside B
person A: want a duplicate copy of it?
person B: no thank you i've already got it.
See. I told you no one beats the British Government for incompetence for very long:
= 16872562
http://it.slashdot.org/comments.pl?sid=206936&cid
This reporter is clueless. I stoped reading when he/she said that 3DES is "military encryption times 3". DES was a civ cyper by desgin and was "broken" a long time ago due to weak keys and such a small key space. 3DES was quick fix and is still used and is still OK in some situations. But it is not military standard (I think AES is however).
As others above have stated, this is not "cracked" either and they are unable to change the data on the chip. Futhermore they need to read the inside page of the passport to "sniff" for the chip data. I would be happier however, with a contact card rather than contanctless....
If information wants to be free, why does my internet connection cost so much?
Basicly, the machines owned by the various governments would encrypt the data with a key belonging to that government (e.g. the UK has a machine) and then the machines at the airports (if the airports are fancy enough to be able to read the machine readable part of the passport) use a matching public key.
As only the government would have the private part of the key, only the government can encrypt data that the processing machines can read (and for those who say the keys will be stolen, look at things like the RSA signing key for XBOX 1 binaries, that hasnt been stolen, brute forced or otherwise obtained yet.
The question isn't whether it's crackable. You're never going to be able to make a 100% secure passport or any other type of identification for that matter. If you get a smart enough group of people together with the proper resources they will be able to crack it. The question is whether or not the technology in question is a cost effective improvement over it's predecessor.
My non expert analysis of the situation is that the entire system of passport control (whether they be conventional, machine readable, RFID, etc.) depends on the ability of the people chekcing the passports. It is up to them to confirm whether the person presenting the passport is actually the person depicted in the picture as well as confirm the authenticity of the document itself. All these security features, or rather ANY security features that might be added will only serve to make it more difficult and expensive to acquire a fake passport that "works". These new security measures may not guarantee 100% the validity of the passport but it is a move in the right direction and better than nothing changing at all. Given the relatively strict time constraints placed by the US government I have to say that in my mind this particular technology is adequate for the time being. I must admit I have not seen or heard an alternative which might feasibly have been implemented within the same time frame on such a large scale. Do I believe that it is possible for a system to be devised that automatically confirms identity with 100% certainty? Possibly. Do I want that sort of security, no! The better these automatic systems become the easier they can be abused by people who are more concerned by their own pockets rather than my safety & privacy.
As a side note, the article refers to a study where supermarket checkout cashiers were shown to fair badly at the task of matching faces to photos, however I would like to believe that those working in passport control have not only been specifically trained for this task but are also naturally better at it.
The jist of the article is that they don't believe the security added by the RFID chip is worth what was paid for it not that it is inherently making the situation any worse.
OK... so "the information sucked out of the chip is only the same as that which appears on the page", and "By the time you have accessed the information on the chip, you have already seen it on the passport.".
Anyone care to enlighten me what the fucking point is of even having a chip in the first place?
To get to the other side?
The revolution will not be televised... but it will have a page on Wikipedia
However, it turns out they made the same blunder that tyro users of computer systems everywhere do: they chose a key that was easy to guess.
From TFA:
I think it can be convincingly argued that the reason they did this is that commercial product development is inherently prone to security blunders.
Start from this well known cryptography maxim: any fool can create a system he cannot break into.
The implication is that you need bring in outside people to criticize, even break your product. But that's not how businesses operate. Businesses run on sales; you have to convince buyers to have confidence in your product. Sales can't plant confidence in the customers' minds if they have doubts in their own. That's fine for sales, but what about engineering? Well, you don't start into the development of a product without at least a healthy dose of optimism. Businesses run on optimism. And they protect themselves by denial.
Security problems are very easy to deny. There is no such thing as evidence of security; you can only try to find evidence of insecurity and fail. So how hard and long should you look? Most of the time if things look OK, they're taken to be OK.
I think it's no accident that RSA, one of the best companies in the field, was started by academics. The academic approach isn't better in every case, but it does have a lot more respect for the importance of proving the null hypothesis.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
It has not been cracked !
....
As usual the journalist is confusing everything. What these bozos have done is just read the content of the RFID chip exactly in the same way a custom officer would have done: using the key which is *printed* on the passport !
Basically this chip do what it has been designed for: improve the difficulty to create fake passports.
Now of course you have always some neo-luddites like those who are spreading FUD in order to sway opinions who will never read the details of the article and just remember the passports have been "cracked"
Pityfull
http://www.transparency.org
That's a big part of the problem. Whose retarded idea was it to use RFID? Wouldn't, say, a smart card chip like the chip & pin card in credit cards have been MUCH better because then you actually need to physically have the passport in your hand to read it - instead of being able to read it through envelopes, clothing and the like with no evidence that it's been read?
Oolite: Elite-like game. For Mac, Linux and Windows
I suspect it is digitally signed because the article says several times that the data cannot be amended on the copy, only cloned identically.
It is more difficult to look like someone else in color on a screen at a reasonable size than on a 1 inch b/w passport picture.
So you can clone the passport of you twin but the one of your other brother would not do.
It is not exactly the same info on the chip than on the passport.
The article mentions: "(We did not clone any of our passport chips on the assumption that to do so would be illegal.)"
:P
But still, if MPAA can say that "After the DMCA, they (=MPAA) simply argue that "circumvention" of the CSS encryption on DVDs is forbidden by the DMCA, fair use or not."[1] then breaking the encryption of ICAO should be illegal as well! You are not allowed to prove them wrong!
SUE THEM I SAY!
[1] Ref: http://www.eff.org/deeplinks/archives/005010.php
Yeah, right, like you will have access to the logs! You probably won't even be able to get anyone to admit the logs exist. Especially from your cell in gitmo.
They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
Besides, if the border guard thinks the passport is "secure", then he'll spend less time thinking about that person and just rely on the big "OK" that pops on his screen when he swipes the thing instead of evaluating the person with his brain and guts.
Good. I've been evaluated by the 'brain and guts' of a few immigration officials in my life and I haven't acquired much faith in the process. Better a flawed electronic system than a guy who just won't let you in because he doesn't like the way you look.
Whence? Hence. Whither? Thither.
Why would a criminal need to crack the encryption on a passport's RFID chip? An encrypted DVD can be copied bit-by-encrypted-bit to another DVD and get played on any DVD player without the copying process needing to decrypt anything. If the encrypted information on the RFID contains nothing that isn't printed on the passport, what's the point?
I don't know half of you half as well as I should like, and I like less than half of you half as well as you deserve. BB
Yeah, sounds like someone in marketing from RFID-Corp got to them ('them' being the politicians)...
J1M.
Maybe the trouble is that it is far too cheap.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
The option to flee from the Island? :)
Is there any suitable shielding for a passport? I was thinking of making a small pouch with something that would prevent my passport from being sniffed. Would an anti-static bag do the job?
Jumpstart the tartan drive.
This is the same situation as in Holland. The new Dutch passport also contains RFID technology and security experts cracked the system even before it was released. See this article.
Weak encryption keys are the part of the problem.
Anyway, this project cost some millions euros, and solves nothing. It only creates new problems making identity theft much easier to accomplice.
However, it turns out they made the same blunder that tyro users of computer systems everywhere do: they chose a key that was easy to guess.
To be accurate this wasn't so much a tyro "blunder" as it was an engineering tradeoff.
Using a stronger key would have required introducing changes to the basic passport information page that is used by all of the automated passport scanning devices in all of the passport control stations around the world. They used the existing MRZ data to generate the key because it was already there, and they already had scanners to read it, so updating a passport control station to use the new passports became a simple matter of adding the contactless smart card reader.
I suspect they probably didn't put quite enough thought into just how little entropy is in the MRZ once after you know the target's name, though. A quick analysis of the total entropy bits in the MRZ makes it look fine, but if part of the data is known, the regular structure of the rest of it makes the net search space for the attacker rather small.
That weakness could easily be addressed by causing the chip to disable itself down after a small number of failed authentication requests, but that may have lead to higher numbers of chips failing to be readable by legitimate authorities (some will anyway, but obviously they want to keep that number down).
The US solution is a pretty good one. The shielded cover keeps your data safe as long as you keep your passport closed, so you can effectively prevent anyone from getting at your passport data by putting a rubber band around the passport.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Well said!
If people can't be arsed to vote ot to stand to the current political class in elections, there is no excuse, specialy one as lame as the one you are ejaculating.
The problem with the UK system is that if you hate the war in Iraq lets say, you have to balnce out that against many other decision taken by this government.
Also since the government is highly centralized you don't have the option to vote one way for local matters and a different way for national ones. YOu have to take it all or dump it all, no half measures.
But it is still a democracy. The people in the UK have the power to change the system itself and to kick out inept politicians, as they have done in the past.
IANAL but write like a drunk one.
Then it would be perfectly secure, because nobody would bother to read the chip, just pontificate endlessly on what they *believed* was on it.
"My country, right or wrong; if right, to be kept right; and if wrong, to be set right." --Senator Carl Schurz (1872)
More likely the other way around.
The ICAO spec http://www.icao.int/mrtd/download/documents/Biomet rics%20deployment%20of%20Machine%20Readable%20Trav el%20Documents%202004.pdf is pretty vague, but the one thing that confuses me is the capacity for storing datafiles on an RFID chip. ICAO recommends at least 15-20KB (notice the big B as in Bytes) for recognizable images and 30KB for fingerprint bio templates...I would guess that iris bio templates are probably about the same.
When I search for RFID tags, the highest capacity ones I can find a 64Kb (notice the small b as in bits.)
Does this compute?
Next, I am amusing that the passport number, birthdate, and expiry date make up the public key and that the software on the other side of the transaction (the RFID reader) would contain the private key (or at least have the ability to pass the encrpyted data off to the issuing state for decryption) and so, is the article's premise even valid?
But what is the "Experimental Threading" thing about? And why is in an even fucking smaller and more illegible font?
To have a right to do a thing is not at all the same as to be right in doing it
Oi! Less of the 'hard-earned'... ;)
Someone care to suggest an improvement on democracy?
... or Enlightened despot.
There's gotta be someone who won't get corrupted by power... Anyone know of any? Alexander the Great?
Do you want the actual answer?
The US was going to cancel the visa-waiver scheme to nations that DID NOT include biometric information on passports by Oct 26th 2006. So the UK government had to choose between choking up US-UK travel for millions of people or rushing a minimal-requirements biometric ID scheme in. Not a happy scenario.
Given the economic consequences of making *every single passenger* travelling from the UK to the US apply for a visa, it didn't have much choice. Telling them to 'stick it' is fun, but not that practical.
'This writing business. Pencils and what-not. Over-rated if you ask me. Silly stuff. Nothing in it' - Eeyore
There was a specific requirement for a contact-less solution as they were concerned that any contact would potentially wear out after 10 years of frequent travel.
Does a completely unhackable ink print of a fingerprint not qualify as biometric information?
Stupidity is like nuclear power, it can be used for good or evil. And you don't want to get any on you.
It's silly that they've already rolled out as many as 3 million. It would make sense, when using a brand new thing, to be a little more cautious (e.g. 98% of the applicants receive old passports for now, 2% get the nifty new technology). Only after a transition period, when the new technology is proven, would they ramp up adoption. Now that a flaw has been found, the government is responsible for millions of problems instead of, say, a few hundred.
"Microsoft killed my company, I hold a personal grudge. I don't use Microsoft products and neither should you."-JWZ
The US was going to cancel the visa-waiver scheme to nations that DID NOT include biometric information on passports by Oct 26th 2006. So the UK government had to choose between choking up US-UK travel for millions of people or rushing a minimal-requirements biometric ID scheme in.
Thing is that the majority of UK citizens travelling abroad are likely to be going to somewhere other than the US. Requiring those who did to get a visa would have mostly impacted the US. Especially if it resulted in people either going elsewhere or staying home.
Given the economic consequences of making *every single passenger* travelling from the UK to the US apply for a visa, it didn't have much choice.
Economic consequences primarily for the US you really don't think that the visa-waiver scheme was altruistic...
Telling them to 'stick it' is fun, but not that practical.
But having everyone who needed a passport having to pay twice as much for one is? Including people who'd still need a visa anyway!
To be accurate this wasn't so much a tyro "blunder" as it was an engineering tradeoff.
I can't agree that there is a difference. Beginners see their bad password choices as tradeoffs; they are surely aware that a more difficult password would be more secure; however they misjudge the marginal security advantages of a better password.
Otherwise, I generally agree with your analysis. Key management is the achilles heel of systems like this. It's hard to do, therefore they chose to use a trivial system and assumed it would not be a problem.
Some of the obvious nightmare scenarios are probably not practical or are perhaps overblown. Despite this, it's pretty clear the system won't accomplish its goals. If the purpose of the system is to prevent terrorists counterfeiting passports, this particular "tradeoff" leaves the system unable to meet its goals. This happens all the time, why should it be hard to believe in this case?
Perhaps we should consider the possibilty that there is no feasible solution for the money that we are willing to spend. In that case the money would have been better spent elsewhere.
With respect to the US conductive sleeve, it isn't a bad idea in itself, alhtough it is important to remember that a non-grounded conductive cover is not a perfect faraday cage. Also, the sleeve does not protect you from the situation where the passport is out of your immediate posession. Do you carry your passport when you are at work? What happens when the police in Osamastan take your passport into the back room to "check it"?
While I am a frequent quoter of the the prover, "the best is the enemy of the good," I don't think it applies in situations like this. The solution chosen just isn't good enough to do what it is supposed to do. Not only is a not good enough solution a waste of money, it makes a better future solution that much harder to adopt. It also encourages people to rely on it when it should not be relied upon.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Security is never simple, The problem is that when you are securing a system you must secure the hole system against a planned attack. What this means? This means that is not only a choice of witch cryptographic algorithm you are going to use, this means that to create a secure system you must think about how keys are going to be created, how they are going to be exchanged, what side-channels might exists in the transaction and so on.
p df
Just as an anecdote history, ssh was found to be leaking information about passwords, even if the attacker could not decrypt the data passing in the wire. The attacker would time the packets going out and in. If there were packets coming out the client side and none going in, this would mean that the data in this particular traffic was not being echoed and was probably a password. The timing between each packet leaving the client machine would show to the "bad guy" how "far" (in a sense) apart the consecutive keys were in the key board. With these timings he could plan his brute force attack, to try a much lower number of attempts.
The ssh hackers simply changed the software so it will transmit fake echo when you're in a no-echo situation, a simple fix. But this illustrate how something that most people would never think could turn into a bad problem. Secure systems must be very carefully planed and checked by third parties, the more the better. It aways easy to think about something that you would never break, that doesn't imply that it is secure.
sources:
http://www.crypto.com/papers/jbug-Usenix06-final.
http://www.securityfocus.com/columnists/375/2 (see the question "Did you develop any measure to fight timing based attacks?")
[]'s Victor Bogado da Silva Lins
^[:wq
Congratulations - Bad Hat now has a passport on which the electronic photo (and other biometrics) and printed photo don't match. Even if B.H. looks a bit like you, the immigration officer ought to notice that the photos are different and Mr Hat will go straight to Guantanamo (if the official is too overworked/underpaid/thick to notice that then no technology in the world is going to help). Provided that the info on the chip is digitally signed (not encrypted) with a private key sitting in a steel vault somewhere, Bad Hat can't change it - hopefully, he can't even clone it properly.
He'd be far better off using your original passport which (if you recall) he had to physically steal because the 3DES encription had done its (only) intended job of stopping him remotely sniffing the RFID data. Bad hat gets through immigration while you are being strip-searched after presenting the Mickey Mouse passport that he substituted for yours.
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
yep. dead right.
'This writing business. Pencils and what-not. Over-rated if you ask me. Silly stuff. Nothing in it' - Eeyore
The only reason Microsoft came out against it is because they didn't go with the Microsoft solution.
Who is John Galt?
I bought a cheap combo lock for a bike I use on the weekends. Most of the mass is in the cable which is about 10mm thick. It must have a breaking strain of 1E4kg at least.
The lock bit between the ends of the cable is made of plastic and could be broken with a rock, so I don't rely on that lock too much.
http://michaelsmith.id.au
The chips in smartcards and e-passports are a lot more sophisticated. They hold 64 kilobytes of data typically, and they have a processor that can do encryption and stuff. Some of them even run Java.
We don't have a democracy, in either the pure form (which is an unworkable ideal anyway) or the popular interpretation (which is much more sensible approach in practice).
Blair has an absolute majority of MPs in Parliament, which effectively means he can force through almost anything. That doesn't mean an absolute majority of the electorate support him.
And that doesn't mean you don't have a democracy. Just because there exists a majority in a representative body does not mean you don't have a democracy (or republic). The terms Democracy, Republic, and combinations thereof are systems descriptions. They define how it is done, not the result.
What you are describing fits the description of democracy quite well: Tyranny of the majority; two wolves and a lamb voting on dinner.
My Suburban burns less gasoline than your Prius.
Passports are supposed to be easy to read! Airports have to read thousands per hour, without making the lineups any more horrendous than they already are.
The purpose of the encryption is to ensure that it can only be read when you open it up and put it on a passport scanner, and not when you walk past Kevin Mitnick.
The basic problem isn't the algorithm they choose. It's that their goal is incompatible with security.
They wish to establish a world where all people can be instantly identified, correlated with commercial profiles, and tracked wherever they travel.
How can this be done "securely"? It cannot.
It may depend on what the definition of "security" is. Who's security, in particular.
Tracking the populace in order to make it easier for government to identify terrorists or other miscreants can enhance security for government even if at the same time it represents a new exposure for individuals. Sure, the government is made up of individuals, but if you are in control of the primary tracking systems, it may mitigate the insecurity of your own personal ID tag-- and government entities could exempt themselves from the requirement of carrying such a tagged ID, or automatically erase any recorded history of their own IDs movements.
A government would like to have the ability to analyze "who was where when this happened?" Certainly useful in identifying who was associating with what terrorists after an event occurs-- allowing some significant traceback if there is a past record of people's movements.
Then you have to ask, what value would this information have to someone else-- could tracking specific individuals help in committing bank fraud, or simple robbery (hey-- look who's out of the country right now-- good time to break in)? Quite possibly-- but you then have to ask, does the government individual who is in charge of the ID system care all that much if their own personal security isn't affected?
And of course, by this argument, it is government which represents the biggest security threat to individuals...
Looks like The Guardian is smearing its FUD around again. As far as I can tell they have managed to do what the passport was designed for. Firstly, the key is on the inside of the passport for a good reason. It's not there to stop anyone reading the data, it's there to stop everyone reading it. You need to be in possession of the passport to read the key and gain access to the data on it, which is better than having (as someone else said) a "master key" that can read any passport. Nobody can steal your identity by holding a RFID reader next to you on the Tube since the data is encrypted with a key that can only be found by someone in possession of your passport. The postman scenario suggested by the article is quite unlikely and if this is the best way of finding the key they can come up with it's a pretty sorry attempt.
Also, the data that you could actually read is printed on the passport anyway, so if someone stole it they wouldn't need to crack it and read the data to steal your identity. They already stole it by stealing your passport.
It's also good that the data is stored on the passport rather than in a centralised database that could be compromised with catastrophic implications.
It sounds like the passport will allow check in to be more secure and quicker. The 20% error rate in the face recognition is high, but this can be reduced by scanning a set number of times to eliminate any false results. I would be more worried that they're using face recognition in place of a more proven biometric such as a fingerprint.
I would say that this new system presents a more technical hurdle for forgers. They may be able to overcome it in time, but without any ability to rewrite the contents of a passport (at least none yet shown) it seems likely that they would have to create their own RFIDs. I'm sure that forgeries will be produced given time, but right now I don't see this as anything to get worked up about. People fear computers, especially the general public, and they're right to fear government computer projects because they're usually both expensive and flawed due to excessive compromise, but we who read slashdot should be able to look at this with a degree of balance and question any articles printed in the mainstream media that weigh in heavily on one side of a debate.
Wouldn't it be simple to know when an RFID is read by encasing it in a "passive reading device" which will be activated as soon as someone actually requests data from the RFID?
As far as I understoond an RFID broadcasts its data by getting power from the active reader, so the passive reader might pick that up?
People using html in email should be shot.
US Passports are supposed to implement exactly the same technology. Currently, all diplomatic passports already have this feature. All new US passports are, or will very shortly be, getting them. Break out the tinfoil passport condoms! :)
Key management is the achilles heel of systems like this. It's hard to do, therefore they chose to use a trivial system and assumed it would not be a problem.
No, I disagree. Key management is not hard to do in cases like this, and it's not that they chose a trivial system, or that they mistakenly assumed it would not be a problem.
Key management here is easy: The keys (or, rather, the data used to generate the keys) are distributed printed on the inside of the passport. That's a perfectly adequate security model in this case, and there's nothing hard about it.
They didn't choose a trivial system. They chose to use a system that was already in place, for good reasons. That system is in place not because it's trivial, but because it served a pre-existing purpose (and still serves that purpose, actually).
As for the assumption that it's not a problem, I posit that the assumption is valid within the range of the designers' goals (and with the addition of the shielded cover, I posit that it's valid, period). Their error was that they failed to adequately address a wider range of goals which hadn't ever really been their concern before.
Despite this, it's pretty clear the system won't accomplish its goals. If the purpose of the system is to prevent terrorists counterfeiting passports, this particular "tradeoff" leaves the system unable to meet its goals.
The goal is to make it harder for forgers (whether terrorists, dealers in drugs or arms, money launderers, whatever) to forge passports, and this system absolutely meets that goal.
How? While this system does not make it impossible to duplicate a passport, the forger's goal isn't to create a duplicate. The forger's goal is to create a modified version. Your legitimate name and personal information with my photo, for example, so I can pass for you. Or, even more likely, a completely fraudulent passport with entirely fake data -- but with my photo.
Because the data on the chip is digitally signed with strong cryptography, the forger can neither create fake data, nor modify legitimate data. The only think he can do is duplicate known-valid data.
Most of the concerns around these passports are related to privacy, but privacy isn't the state department's goal. Sure, they don't want to create more opportunities for identity theft, but their goal is to reduce or eliminate document forgery. These new passports do that very well.
With respect to the US conductive sleeve, it isn't a bad idea in itself, alhtough it is important to remember that a non-grounded conductive cover is not a perfect faraday cage.
It doesn't need to be perfect, just good enough, and tests show that the shielded covers render the chip deaf and mute. I might be able to dig up a link if you like. It doesn't take much to do that, actually, the chips need fairly high input radiation levels and fairly crisp carrier signals. Attenuate and smear the signal from the reader just a little and the chip can't operate. Keep in mind that the chips are powered via electrical induction, and even a very imperfect Faraday cage dramatically reduces inductive power transfer. They're clocked via regular variations in the induced power, and they actively check for an out-of-spec clock signal. Too fast, too slow, insufficiently sharp level transitions, insufficient level variation, timing irregularities... any of these will trigger logic that shuts down the chip.
Also, the sleeve does not protect you from the situation where the passport is out of your immediate posession. Do you carry your passport when you are at work? What happens when the police in Osamastan take your passport into the back room to "check it"?
Um, if someone has possession of your passport, they have possession of your passport. They don't need to get fancy with RF signals, they can just open the cover and read the printed information directly, and that hasn't changed a bit. If you want a passport that allo
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.