Math Bridge: RFID Listening Asymmetry

← Back to RFID Security and Privacy
Math BridgeRFID securityStruggle-friendly runway

Why can a listener hear the reader far beyond the tag's working range?

Compare the tag's wake threshold with a receiver sensitivity floor on the same ideal one-way free-space equation.

Eddie, the electronics guideEddie guides
The one targetTurn a threshold gap into an ideal range ratio.
The chapter case30 dBm at 915 MHz, -18 dBm tag wake, -95 dBm listener.
What it buys youA reason not to use rated tag range as the privacy boundary.

A field team faces an unresolved physical question: Why can a listener hear the reader far beyond the tag's working range? They must answer it before changing listener sensitivity on the real device. Predict the direction first.

See the relationship before changing it

The figure reads from left to right. The blue card is listener sensitivity. The middle card applies this page's relationship. The green card is wavelength. Walk the arrows once: set the input, apply the rule, then read the result with its unit.

The retained audit below checks several chapter fixtures. This added model holds every other chapter fixture fixed, so the numeric fixture does not switch without explanation.

Listener sensitivity changes wavelength An input card leads through the page relationship to the wavelength result. SET INPUT ONE CONTROL APPLY RULE predict calculate check units READ RESULT
Walk the arrows. Every 20 dB of extra loss budget multiplies ideal range by ten; the 77 dB threshold gap dominates the 9 dBi antenna multiplier.

Derive the baseline in four named moves

  1. 1

    Name the input. The chapter baseline for listener sensitivity is -95.

  2. 2

    Name the relationship. λ = 3.00e8 / 915e6 = 0.3279 m dtag = λ/(4π) x 10^(48/20) = 6.554 m deaves = λ/(4π) x 10^(125/20) = 46.397 km ratio = 10^(77/20) = 7,079; 9 dBi multiplier = 2.818

  3. 3

    Substitute the chapter fixture. Set listener sensitivity to -95. The page ledger gives wavelength as 0.328 m.

  4. 4

    Read the result. Keep m beside the value. Use it only inside the technical boundary on this page.

Predict, then change listener sensitivity

Try Predict the direction of wavelength. Move one control, calculate, then check your prediction.

-95
Chapter baseline
Wavelength

Observe Every 20 dB of extra loss budget multiplies ideal range by ten; the 77 dB threshold gap dominates the 9 dBi antenna multiplier. Reset the control to -95 and compare wavelength.

Explain Only listener sensitivity moves here. The other chapter fixtures remain fixed.

Check yourself

What should you do before trusting a moved-control result?
Answer: Predict its direction, apply the shown relationship, keep the units, and reset to the worked baseline.
What does this small model leave out?
Answer: Only listener sensitivity moves. Field effects named in the page's technical boundary stay fixed.

Honesty note. This teaching model changes only listener sensitivity. It replays the chapter fixture; it is not a field prediction.

1. Start with the physical story

A passive tag needs enough incident power to wake and answer. A separate receiver only needs to detect the reader's outgoing signal above its own noise floor.

Eddie: The enormous ideal ceiling is a threat-model warning, not a prediction of a real attack distance.

2. Name every algebra move

1

Find wavelengthUse λ = c/f at 915 MHz.

2

Find each loss budgetSubtract the tag threshold or listener sensitivity from reader EIRP.

3

Solve rangeUse d = λ/(4π) × 10^(budget/20).

4

Compare rangesDivide listener ceiling by tag wake range.

5

Add listening gainMultiply ideal range by 10^(G/20).

3. Reproduce the chapter case

λ = 3.00e8 / 915e6 = 0.3279 m
dtag = λ/(4π) × 10^(48/20) = 6.554 m
deaves = λ/(4π) × 10^(125/20) = 46.397 km
ratio = 10^(77/20) = 7,079; 9 dBi multiplier = 2.818

The listener's free-space ceiling is huge because its sensitivity is 77 dB below the tag's wake threshold. Terrain, curvature, clutter, regulations, interference, and receiver implementation sharply bound reality.

4. Try one real input

TryMove listener sensitivity. Watch its loss budget, ideal range, tag-range ratio, and directional-antenna ceiling change together.

Listener sensitivity
Wavelength
Tag loss budget
Listener loss budget
Threshold gap
Ideal tag wake range
Ideal listener ceiling
Ideal listener ceiling
Range ratio
9 dBi range multiplier
Directional ceiling

ObserveAt -95 dBm the ideal listener ceiling is 46 km, about 7,079 times the 6.55 m tag wake range.

ExplainEvery 20 dB of extra loss budget multiplies ideal range by ten; the 77 dB threshold gap dominates the 9 dBi antenna multiplier.

Technical boundaries.

These are ideal one-way free-space ceilings.

Backscatter
The tag reply is weaker and pays an outward and return path; this ledger compares tag wake with listening to the reader.
Environment
Terrain, clutter, ground, curvature, interference, polarization, receiver bandwidth, and legal limits are absent.
Security
Detecting energy is not decoding data, identifying a tag, defeating crypto, or completing an attack.

Correct, not complete: this ledger does not predict attack range or assess RFID security by itself.

5. Use the result in the threat model

Do not draw the privacy boundary at the tag's rated range. Measure reader leakage, tag replies, shielding, antenna directions, accessible positions, protocol protection, and detection thresholds.

6. Record the evidence state

Record frequency, EIRP, antennas, polarization, receiver and bandwidth, sensitivity basis, site geometry, decoded-versus-detected result, controls, failures, and retest trigger.

7. Check yourself

Why is the listener range much larger than the tag wake range?
Answer: The illustrative receiver detects down to -95 dBm while the tag needs -18 dBm to wake, a 77 dB gap.
Does 46 km mean an attacker can decode the exchange there?
Answer: No. It is an unobstructed free-space detection ceiling, not a site or decoding result.
What does 9 dBi add in the ideal equation?
Answer: A 10^(9/20) = 2.82 range multiplier, after the other assumptions are held fixed.
Honesty boundary.

This is a threshold-gap warning model.

Tag
Wake range is not the complete backscatter read range.
Listener
Detection sensitivity is not successful decoding.
Risk
A security decision needs protocol, site, attacker, and control evidence.

Correct, not complete: this ledger does not predict attack range or assess RFID security by itself.

Return to RFID security and privacy with the maths unpacked →