Kaliski not convinced on electronic passports

Better but not perfect…

By John Oates, 19th October 2005

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

RSA Europe 2005 RSA's cryptography guru Burt Kaliski has warned the US' planned introduction of electronic passports represents a long-term challenge for the security industry.

The US government will begin trialling the passports containing an RFID chip in December before the full introduction early next year. United Airlines staff have been testing one version of the technology since June.

Speaking at the RSA Security conference in Vienna, Kaliski, chief scientist at RSA Security, Kaliski told the Reg: “You have to look the whole deployment over its lifetime to make sure you don't introduce new problems and it must improve on the prior generation.”

“A passport obviously contains personal information so you need fine-grained access control. But with a chip you don’t know what information you are giving away. You don’t know where and what data you are giving away.”

Kaliski said: “There’s been good public dialogue – it’s good to see it getting this attention. But it’s important not to just stop with release number one.”

Kaliski said there was a tendency in the security industry to look at the early stages of any effort but then move attention on to the next “new” thing.

RSA began working with other companies on a specification for one time passwords in February. Workshops were held in May and earlier this week. The informal collaboration has one specification ready for formal acceptance and five more in draft form.

Looking back at the conference Kaliski said he enjoyed Dame Stella Rimington’s endorsement and appreciation of the industry because the intelligence services had initially been so suspicious of encryption technology.