Feeds

Industry group defends e-passports

Counter-attack follows cloning demo

Using blade systems to cut costs and sharpen efficiencies

A demonstration that the chips on upcoming electronic passports can be cloned does not add up to a threat to either border security or citizen privacy, according to an industry group backing the development of the technology. The Smart Card Alliance argues that e-passports planned for the US rely on multiple layers of security.

Lukas Grunwald, CTO of German security consultancy DN-Systems Enterprise Internet Solutions, demonstrated reading and copying the electronic information in his German e-passport at a security conference at the Black Hat conference in Vegas last week. Grunwald said the data held on RFID cards within e-passports can be copied simply, which he reckons undermines claims by governments that e-passports will help stamp out forgeries. He argues the e-passport design will make no contribution to added security and is, in his words, "totally brain damaged". Not so, says the Smart Card Alliance, whose members are heavily involved in developing the technology.

"Even if someone could copy the information on your e-passport chip, it doesn’t achieve anything, because all of the information is locked together in such a way that it can’t be changed. It’s no different than someone stealing your electronic passport and trying to use it. No one else can use it because your photo is on the chip and they’re not you," said Randy Vanderhoof, executive director of the Smart Card Alliance.

The Smart Card Alliance said the standards adopted by the global electronic passport program makes passports "virtually impossible" to counterfeit. Furthermore nobody other than the passport user will ever be able to use them. The Smart Card Alliance details the security measures incorporated into e-passports. The information on the printed page, including the bearer’s photograph, is stored on the chip and displayed on a screen at passport control. By comparing the digital information, the printed passport and the person, customs officers can confirm everything matches. Discrepancies can be spotted if someone is attempting to use someone else’s e-passport chip information, a possibility raised by Grunwald's chip demo.

Data on the chip is not encrypted (at least for now) but it is digitally signed by the issuing country’s passport authority. Any changes to this data would therefore be detected at passport control. Unlike paper passports, where a photo can potentially be replaced, the digital photo and other information on the e-passport chip cannot be changed.

Shielding controls mean that (at least in theory) a passport needs to be handed over and opened before any information stored on the chip is communicated. All information exchanged between the reader and the e-passport chip is encrypted. "Together these capabilities mean that no one could use a lost or stolen passport, or even a copy of one, to illegally enter the country. They also prevent anyone from spying on US e-passports when the passport cover is closed," the Smart Card Alliance argues.

The Alliance makes a good case but some experts, such as security guru Bruce Schneier, question whether these security measures will withstand the test of time, especially considering the longevity of passport use (typically 10 years). Our analysis of Grunwald's demonstration shows how easily it was performed, which does little to assuage concerns that e-passports are not as foolproof as their industry backers would have use believe. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.