Feeds

Industry group defends e-passports

Counter-attack follows cloning demo

The Essential Guide to IT Transformation

A demonstration that the chips on upcoming electronic passports can be cloned does not add up to a threat to either border security or citizen privacy, according to an industry group backing the development of the technology. The Smart Card Alliance argues that e-passports planned for the US rely on multiple layers of security.

Lukas Grunwald, CTO of German security consultancy DN-Systems Enterprise Internet Solutions, demonstrated reading and copying the electronic information in his German e-passport at a security conference at the Black Hat conference in Vegas last week. Grunwald said the data held on RFID cards within e-passports can be copied simply, which he reckons undermines claims by governments that e-passports will help stamp out forgeries. He argues the e-passport design will make no contribution to added security and is, in his words, "totally brain damaged". Not so, says the Smart Card Alliance, whose members are heavily involved in developing the technology.

"Even if someone could copy the information on your e-passport chip, it doesn’t achieve anything, because all of the information is locked together in such a way that it can’t be changed. It’s no different than someone stealing your electronic passport and trying to use it. No one else can use it because your photo is on the chip and they’re not you," said Randy Vanderhoof, executive director of the Smart Card Alliance.

The Smart Card Alliance said the standards adopted by the global electronic passport program makes passports "virtually impossible" to counterfeit. Furthermore nobody other than the passport user will ever be able to use them. The Smart Card Alliance details the security measures incorporated into e-passports. The information on the printed page, including the bearer’s photograph, is stored on the chip and displayed on a screen at passport control. By comparing the digital information, the printed passport and the person, customs officers can confirm everything matches. Discrepancies can be spotted if someone is attempting to use someone else’s e-passport chip information, a possibility raised by Grunwald's chip demo.

Data on the chip is not encrypted (at least for now) but it is digitally signed by the issuing country’s passport authority. Any changes to this data would therefore be detected at passport control. Unlike paper passports, where a photo can potentially be replaced, the digital photo and other information on the e-passport chip cannot be changed.

Shielding controls mean that (at least in theory) a passport needs to be handed over and opened before any information stored on the chip is communicated. All information exchanged between the reader and the e-passport chip is encrypted. "Together these capabilities mean that no one could use a lost or stolen passport, or even a copy of one, to illegally enter the country. They also prevent anyone from spying on US e-passports when the passport cover is closed," the Smart Card Alliance argues.

The Alliance makes a good case but some experts, such as security guru Bruce Schneier, question whether these security measures will withstand the test of time, especially considering the longevity of passport use (typically 10 years). Our analysis of Grunwald's demonstration shows how easily it was performed, which does little to assuage concerns that e-passports are not as foolproof as their industry backers would have use believe. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.