1. They do use a smart card chip, it's just contactless, or RFID if you will. It's not a dumb RFID tag. The most time consuming operation at the border control is reading the face image from the chip. The protocols available in contact chips have almost an order of magnitude slower communication speeds than in the protocols for contactless chips. It matters.
2. In the case of basic access control, as specified by ICAO, being able to read the chip means that you are able to clone the chip. It's a weakness in the protocol. Basically the big secret is printed on the passport (passport number, date of birth, expiration date), so it's not difficult to obtain. And even if you don't have physical access to the passport, the key entropy is low, which helps eavesdropping considerably. You don't have to compromise the manufacturer or anything. The big challenge is coming up with a passport book that passes as a real one.
The encryption and message authentication keys for the so called basic access control, specified by ICAO, are based on the machine readable zone of the passport. It's the funny lines at the bottom of the passport, with a lot of filler characters '<'. Passport number, date of birth, and expiration date are the only fields that have a check digit, which is why they were chosen as the base for the keys. The entropy is not very high, especially because the fields are not random.
The machine readable zone was chosen for key seed, because it is already there, and the readers are already there. I guess the idea is that it's better than nothing. It makes eavesdropping and cloning slightly harder than without. But just slightly. It is indeed possible to do both without very much effort. Forging (i.e. creating a passport with phony information but with a correct digital signature) is another story, very hard.
The EU is going to mandate the use of so called advanced security mechanisms, a.k.a. extended access control, for biometric passports that contain sensitive data, such as fingerprint or iris images. Such passports will have a Diffie-Hellman key exchange for encryption and message authentication, and a PKI based terminal authentication for granting access to sensitive data. The EAC spec is available from German BSI by request.
Oh, and before someone shouts that all RFID tags should burn in hell, I'll just say that the passport chips are contactless, or RFID, smart cards, and have next to nothing to do with RFID tags. The chips can, among other neat things, perform RSA operations using 2K-bit keys in reasonable time. Cracking the actual chip is very difficult.
The benefits of reading this is twofold: 1) you can say that you've actually read it, and 2) you can refer to it in any programming related argument: "Look it up in Knuth!"
Seriously speaking, the books I've found useful (more so than Knuth, anyway) in improving my programming or software engineering skills (in no special order):
You'll notice that programming is not just about programming. Seeing beyond one programmer, one team, one language, one operating system, one tool, one method, one project, etc. gets you to another level.
Contactless smart cards can do just as much processing as contact cards, also in terms of cryptography (e.g. use of 2048 bit RSA keys is reasonable). The Speedpass you refer to uses a different technology, as explained in the Wikipedia article. This is the common fallacy of confusing RFID tag or transponder technology with contactless smart card technology.
Contactless (or RFID, if you prefer) smart cards are passive in the sense that they don't have a power supply. Due to the power consumption, the operating range from the reader is quite limited, usually less than 10 cm (4 inches). Look up ISO 14443 for more info.
Yes, it is a shame that we have a spec that allows skimming, eavesdropping and cloning of electronic passports. However, instead of bashing the technology (contactless/RFID smart cards) we should bash the application (ICAO specs).
To be pedantic, the vulnerabilities of the passports are mostly privacy and safety concerns for their individual holders. And I'm not saying that this is a minor issue. It's not. But the passports do increase border security. It is possible to clone the chip (due to protocol vulnerability) but it is very difficult to forge the chip because the data, including face image, is digitally signed.
Due to the above mentioned vulnerabilities, the EU is going to mandate use of advanced secure mechanisms (that avoid the vulnerabilities) for electronic passports that contain other biometric data than the face image.
All of the biometric passports and electronic identity cards use the same technology, namely smart cards, i.e. tamper resistant integrated circuit cards. There are contact and contactless cards, the latter of which are often referred to as RFID cards. Note that RFID smart cards have next to nothing to do with RFID tags. Smart cards have a processor, persistent and volatile memory, often cryptoprocessors and many kinds of shields for tamper resistance. Hacking them is quite difficult.
Contactless cards offer significantly faster communication speeds than contact cards and also the option to pick one card from many cards within the range of the reader.
What comes to security, there are two main vulnerabilities in contactless cards: eavesdropping and accessing the card without holder's knowledge is easier than in contact cards. In both points, the vulnerabilities can be overcome with protocol design. The card need not broadcast anything without setting up a secure channel and requiring holder verification (e.g. PIN). This is really not a fault in the technology itself, but rather in how it is applied.
memset(s, c, n) places character c into first n characters of s, and the programming error referred to is about mixing c and n with each other. The original search looks for n == 0, because it makes no sense, and is thus an indication of this mixup.
David Heinemeier Hansson (Rails Framework) - Yeah right, sure
Who knows. I've never heard of him before, but I know I'm getting old for sure. His answer on how he learned programming:
I learned programming by starting to put together my first web page in HTML. Then I wanted to make some dynamic pieces and picked up first ASP then PHP. After I already knew how to program, I then started on a joint computer science and business administration degree.
If he wants to interview COMPUTER SCIENTISTS, I can think of a ton of people that actually belong on that list and are not just the revered creators of some popular application. Professors and researchers in the field, not creators of popular languages.
So let me get this straight: You think he should've interviewed Andy Tanenbaum instead of Linus Torvalds? Get outta here! This is/. for crying out loud!
That's the only part of the interview that truely [sic!] surprised me (when he said he was 24). Either he's much younger or the educational system is clearly failing.
One thing that I'd like to see in the future is the possibility to expand and collapse articles in the home page, to show/hide the scoop. Then, if I see a headline w/o scoop that interests me, I could expand to show the scoop, and then decide whether I'd like to open the whole discussion or not.
The supported r/w speeds of the Toshiba drive are 56x/32x/16x/8x/48x/32x/8x/48x/4x/16x. Rumor has it there's a new device coming soon which supports 48x/32x/8x/48x/4x/16x/56x/32x/16x/8x.
See my other reply. I'm not saying it was okay to post the mails. He's an idiot for doing that, and he will regret it, for sure. And he too can't take back what he posted.
However, people should be more careful about what they do online. You refer to sending "confidential and personal information by mail". Yes, everyone does that - but usually with people they know. What makes you think it's a clever idea to send pictures of your penis with your real name and company email address to some stranger? Even if you know that it's illegal of this stranger to abuse the information. That is asking for trouble, no matter how you look at it.
I would like to point out that I never said I thought it was okay for this guy to do this. I think he also should have realized he can't take back what he just did. It's out there, and he can't do anything about it. Everyone knows now he's a jerk, but that'll be the least of his concerns when all these people he screwed start suing him. And he'll be lucky if they merely sue him. This has potential for a Darwin Award.
Slashdot Mirror
2. In the case of basic access control, as specified by ICAO, being able to read the chip means that you are able to clone the chip. It's a weakness in the protocol. Basically the big secret is printed on the passport (passport number, date of birth, expiration date), so it's not difficult to obtain. And even if you don't have physical access to the passport, the key entropy is low, which helps eavesdropping considerably. You don't have to compromise the manufacturer or anything. The big challenge is coming up with a passport book that passes as a real one.
The machine readable zone was chosen for key seed, because it is already there, and the readers are already there. I guess the idea is that it's better than nothing. It makes eavesdropping and cloning slightly harder than without. But just slightly. It is indeed possible to do both without very much effort. Forging (i.e. creating a passport with phony information but with a correct digital signature) is another story, very hard.
The EU is going to mandate the use of so called advanced security mechanisms, a.k.a. extended access control, for biometric passports that contain sensitive data, such as fingerprint or iris images. Such passports will have a Diffie-Hellman key exchange for encryption and message authentication, and a PKI based terminal authentication for granting access to sensitive data. The EAC spec is available from German BSI by request.
Oh, and before someone shouts that all RFID tags should burn in hell, I'll just say that the passport chips are contactless, or RFID, smart cards, and have next to nothing to do with RFID tags. The chips can, among other neat things, perform RSA operations using 2K-bit keys in reasonable time. Cracking the actual chip is very difficult.
Seriously speaking, the books I've found useful (more so than Knuth, anyway) in improving my programming or software engineering skills (in no special order):
You'll notice that programming is not just about programming. Seeing beyond one programmer, one team, one language, one operating system, one tool, one method, one project, etc. gets you to another level.
Contactless (or RFID, if you prefer) smart cards are passive in the sense that they don't have a power supply. Due to the power consumption, the operating range from the reader is quite limited, usually less than 10 cm (4 inches). Look up ISO 14443 for more info.
To be pedantic, the vulnerabilities of the passports are mostly privacy and safety concerns for their individual holders. And I'm not saying that this is a minor issue. It's not. But the passports do increase border security. It is possible to clone the chip (due to protocol vulnerability) but it is very difficult to forge the chip because the data, including face image, is digitally signed.
Due to the above mentioned vulnerabilities, the EU is going to mandate use of advanced secure mechanisms (that avoid the vulnerabilities) for electronic passports that contain other biometric data than the face image.
Contactless cards offer significantly faster communication speeds than contact cards and also the option to pick one card from many cards within the range of the reader.
What comes to security, there are two main vulnerabilities in contactless cards: eavesdropping and accessing the card without holder's knowledge is easier than in contact cards. In both points, the vulnerabilities can be overcome with protocol design. The card need not broadcast anything without setting up a secure channel and requiring holder verification (e.g. PIN). This is really not a fault in the technology itself, but rather in how it is applied.
Good for you. A colleague of mine had to install WinXP to someone, and the box was owned before the update downloads had finished.
(It just had to be said.)
And in the "know your language" category: sizeof(char).
memset(s, c, n) places character c into first n characters of s, and the programming error referred to is about mixing c and n with each other. The original search looks for n == 0, because it makes no sense, and is thus an indication of this mixup.
Let's not forget that this should never happen.
*sigh*
I wish my office walls weren't made of glass.
An extension cord! An extension cord! My kingdom for an extension cord!
It Came From the Desert anyone?
Yes, engineering.
Finland is 130,558 square miles (and certainly not 305,470 square miles!) The EU is 1,535,286 square miles. The average gas price in EU is roughly 1.3 EUR per litre, i.e about the same $6 per gallon as in Finland.
It appears that your proportional-area math is not proportional on this side of the ocean.
One thing that I'd like to see in the future is the possibility to expand and collapse articles in the home page, to show/hide the scoop. Then, if I see a headline w/o scoop that interests me, I could expand to show the scoop, and then decide whether I'd like to open the whole discussion or not.
The supported r/w speeds of the Toshiba drive are 56x/32x/16x/8x/48x/32x/8x/48x/4x/16x. Rumor has it there's a new device coming soon which supports 48x/32x/8x/48x/4x/16x/56x/32x/16x/8x.
However, people should be more careful about what they do online. You refer to sending "confidential and personal information by mail". Yes, everyone does that - but usually with people they know. What makes you think it's a clever idea to send pictures of your penis with your real name and company email address to some stranger? Even if you know that it's illegal of this stranger to abuse the information. That is asking for trouble, no matter how you look at it.
I would like to point out that I never said I thought it was okay for this guy to do this. I think he also should have realized he can't take back what he just did. It's out there, and he can't do anything about it. Everyone knows now he's a jerk, but that'll be the least of his concerns when all these people he screwed start suing him. And he'll be lucky if they merely sue him. This has potential for a Darwin Award.