RFID, NFC & UWB · Study deck

RFID Security and Privacy

Radio frequency means the rate of change used by a radio signal.

Radio Remi is your guide for this deck.

rfidsecurityprivacy

Radio Remi, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Distinguish static identifier checks from cryptographic authentication and policy authorization.
Explain why relay attacks can matter even when tag-reader messages are encrypted.
Design layered controls across tag, reader, middleware, backend, physical read zone, and operating process.
Review privacy risk when RFID reads are linked to people, products, locations, time, or account records.

Major section

Start With the Story

Radio frequency means the rate of change used by a radio signal.

Radio frequency identification (RFID) uses radio to identify or exchange data with a tag.
A readable tag is not proof that the holder is the right person or that the next action is allowed.
A useful access feature can quietly become a movement record.

Major section

Start With the Story (continued)

The same identifier may also reveal when a person arrives, which room they visit, and how long they stay.

Short answers expose a weak design before more data is gathered.
Short range and encryption do not settle every privacy question.
The deeper sections explain cloning, tracking, access controls, notice, minimisation, and retention.

Major section

Checkpoint: Key Concepts · In 60 Seconds

Threat model: A record of who might read, copy, relay, disable, or misuse RFID data, and which business decisions would be affected.

Static identifier risk: The risk that a fixed UID, EPC, badge number, or item identifier can be copied, correlated, or tracked.
Authentication boundary: The point where a tag, reader, or backend proves it is authorized before data is trusted.
RFID security is not solved by adding encryption to a tag.

Major section

Phoebe's Field Notes: Why the Reader "Talks Louder" Than the Tag Answers · Ethics and Authorization

RFID security testing can disrupt access control, inventory, payment, transport, healthcare, or regulated workflows.

If a weakness is found in a real system, preserve evidence carefully and use the organization responsible-disclosure path.

Major section

Threat Model First · Attack Surfaces

A rogue reader, insider, thief, or data broker may exploit eavesdropping, cloning, relay, jamming, or log misuse.

A raw tag read is only an observation; it does not show consent or authorize the protected action.
Retest trigger: New tag model, reader move, antenna change, firmware update, key rotation, policy change, new data sharing, or layout change.

RFID threat model review path that starts with the protected action, then tests attacker assumptions, attack paths, controls, evidence, and retest triggers.

Major section

Classic Gen2 Security Is Deliberately Thin

The original EPC Gen2 air interface was optimized for cheap, disposable item tags, so its security is minimal on purpose.

Gen2 defines two 32-bit password fields: a kill password that, when nonzero, can permanently silence a tag, and an access password used to enter the secured state for protected operations.

RFID security boundary map showing risks, controls, telemetry, lifecycle, and a reminder that a readable ID is not a credential.

Major section

Classic Gen2 Security Is Deliberately Thin (continued)

A tag need not physically implement either password, and unlocked memory can be written without entering the secured state.

A tag ID can be copied or emulated, and a read can be relayed or replayed.
Authentication and key policy, read-zone controls, and backend authorization address different parts of those risks.
Reader and event logs provide telemetry for review, while provisioning and revocation define the identifier’s lifecycle.

Major section

Classic Gen2 Security Is Deliberately Thin (continued)

The evidence should show which control stopped misuse and what the fallback did.

Second, anyone with a reader may be able to track what a person or object is carrying by inventorying stable tag identifiers.
The fixes are different, so the review should not collapse both into "add encryption.".
A release claim such as "known tag observed" is weak.

Major section

Cloning and Tracking Are Separate Threats

The same RFID workflow can have both anti-cloning and privacy requirements, but the evidence differs.

A subtle point behind eavesdropping is link asymmetry.
The reader transmission can be heard farther than the faint tag backscatter, so short tag-read range does not automatically mean short eavesdropping range.
In a receiving doorway, the clone test might use 40 expected tagged cases, one duplicate EPC written to a lab tag, and one unauthorized reader.

Major section

Trust Boundaries · Layered Controls

Security quality improves when each boundary has its own evidence.

A tag read is not a credential.
A credential is not authorization.
Authorization is not a privacy review.
Each step adds reader identity, zone context, and data checks.

RFID trust boundaries from tag and reader through middleware, backend policy, audit, and privacy review.

Major section

Gen2v2 and ISO 29167 Authentication

Millisecond-scale application logs are far too coarse for proximity proof.

With cryptographic challenge-response, the reader sends a random challenge, the tag returns a response computed with a key it never transmits, and a clone that lacks the key cannot answer correctly.
A challenge-response changes the evidence.
Relay remains a separate trap.

Major section

Gen2v2 and ISO 29167 Authentication (continued)

Gen2v2 also defines an untraceable command that lets a tag hide or shorten what it reveals to unauthenticated readers, which addresses tracking separately from cloning.

The reason a 32-bit access password is the wrong assurance model is visible in the math.
If that value is exposed through provisioning records, reader compromise, weak operations, or a copied tag image, every copied tag can carry the same value.
The verifier records the random challenge, expected response, observed response, key identifier or key version used by the verifier, and decision without logging the secret itself.

Major section

Privacy Review · Worked Review: Controlled Asset Cabinet

The tag may only reveal "an ID," but the system can often connect that ID to other records.

Separate operational records from analytics where possible.
A lab wants to use RFID to issue high-value test instruments from a cabinet.
The release decision should require both access-control evidence and asset-event evidence.

RFID privacy review flow showing identifier, person linkage, purpose, minimization, retention, sharing, access, and complaint handling.

Major section

Release Notes · Common Pitfalls

RF validation record: Read-zone map, no-read-zone tests, shielding/tuning notes, reader health behavior, and interference observations.

Operations record: Monitoring, fallback, override owner, incident response, support logs, training, and retest triggers.
Treating a public identifier as a secret: UID, EPC, or card number can often be observed.
Assuming encryption stops relay: Relay devices can forward encrypted messages.

Major section

Checkpoint: Summary · Key Takeaway

RFID security review starts with the protected action and threat model, not with a generic control list.

Static tag identifiers should not be treated as secrets or authorization proof.
Layered controls span tag authentication, reader authorization, middleware filtering, backend policy, physical read-zone control, privacy minimization, monitoring, and fallback.
Privacy risk increases when stable tag reads are linked to people, accounts, locations, time, or behavior records.

RFID layered controls include tag authentication, reader authorization, event filtering, backend policy, read-zone control and privacy minimization, followed by monitoring, fallback and retest.

Deck summary

Key takeaways

Radio frequency means the rate of change used by a radio signal.

The same identifier may also reveal when a person arrives, which room they visit, and how long they stay.
Threat model: A record of who might read, copy, relay, disable, or misuse RFID data, and which business decisions would be affected.
RFID security testing can disrupt access control, inventory, payment, transport, healthcare, or regulated workflows.
A rogue reader, insider, thief, or data broker may exploit eavesdropping, cloning, relay, jamming, or log misuse.

Retrieval practice

Recall check 1 of 3

Radio Remi says: answer from memory, then check your reasoning.

Q1Why is adding encryption to a tag not enough to make an RFID workflow secure?

ARely on tag encryption as proof that the reader is authorized

BValidate reader compatibility with the encrypted tag format.

CTreat successful decryption as proof that an item crossed the authorized read zone

DA raw read is not a credential; authorization and zone control matter

Show answer

Answer: D Encryption alone is insufficient; RFID security also needs identity, reader authorization, read-zone control, and audit evidence.

Retrieval practice

Recall check 2 of 3

Radio Remi says: answer from memory, then check your reasoning.

Q2A pharmaceutical maker wants tags that cannot be cloned onto counterfeit product. Why is setting a strong Gen2 access password not enough, and what does help?

AA static password can be copied; use cryptographic challenge-response instead.

BThe password is enough if the maker also sets the tag kill password.

CPasswords fail only because 32 bits is too short; a longer static password would stop cloning.

DCloning is impossible on UHF tags, so no extra measure is needed.

Show answer

Answer: A Static passwords gate operations but do not prove tag identity.

Retrieval practice

Recall check 3 of 3

Radio Remi says: answer from memory, then check your reasoning.

Q3A team says an RFID access workflow is safe from relay attacks because the tag and reader use encrypted challenge-response messages. Which assessment of relay risk is justified for this access workflow?

AEncryption always prevents relay attacks, so no additional controls are needed at all.

BRelay attacks only affect active tags that carry their own onboard batteries.

CEncryption does not stop relay; add timing or distance controls.

DThe real fix is to store the full door policy on the tag so the backend is never involved.

Show answer

Answer: C RFID encryption and authentication are important, but relay risk must be reviewed separately because the attacker can forward valid messages in real time.

Print reference

Answers

Answer key.

D · Encryption alone is insufficient; RFID security also needs identity, reader authorization, read-zone control, and audit evidence.
A · Static passwords gate operations but do not prove tag identity.
C · RFID encryption and authentication are important, but relay risk must be reviewed separately because the attacker can forward valid messages in real time.