RFID Passports

BLOG ^ | 10/04/2004 | Bruce Schneier

[Yo-Yo]

Ah, so you have a single key to decrypt every passport the US issues? Hmmm... There might be a problem with that. Would we allow other nations to read our passports? If so, it might as well not be encrypted. Would we want to be able to read the passports of other nations? Judging from this article, I'd say so. Again, crypto wouldn't be useful in such a case because the "secret" would be known by far too many untrustworthy parties.

What exactly do you think will be stored on these RFID tags? The passport number, which is perferated through the top of the passport already. The person's name and address, which is already printed on the first page of the passport. The person's fingerprint, which is already on the person's finger. That's it. An RFID chip makes it very difficult to forge or alter a passport for someone else's use, and it makes the entry of the passport number into the Immigration computer to track entries and exits less error prone.

It's not as if you're storing your entire credit history on the darn thing. And yes, I would want other countries to include a compatible RFID system in their passports, or else the system is pretty much useless. That would imply that other authorities would also be able to read our passports and upon entry to their country verify my fingerprint matches the one stored in my passport, just as they make sure the picture matches my face.

[DelphiUser]

Just a question, how often do you walk around with your passport? (I pretty much only carry mine when traveling)

I keep mine in a lock box that just happens to be metal...

[zeugma]

Well, I'd say that when you are travelling is the time that you would be most at risk of having someone scan it unbeknownst to you. When I go to the local grocery store, I figure that most of the folks there are American. The times that some nefarious evildoer would most likely be interested in knowing someone's nationality is exactly when someone would be most likely to have it on their person.

[zeugma]

If all it is that they are storing on it is your number, name, and some biometric like a fingerprint, then encryption is not necessary and would, in fact, be a hindrance to the system, as you'd have to deal with the messiness of distributing the key, (which wouldn't be able to change without difficulty).

So, now you are travelling through Europe with a passport that is broadcasting your identity and biometrics to anyone who wants to read the information. Still not a good idea IMO. Not that it matters because people will use whatever they are given even when their government is doing something terminally stupid.