RFID, NFC & UWB · Study deck
RFID Security and Privacy
Radio frequency means the rate of change used by a radio signal.
Radio Remi is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Distinguish static identifier checks from cryptographic authentication and policy authorization.
- Explain why relay attacks can matter even when tag-reader messages are encrypted.
- Design layered controls across tag, reader, middleware, backend, physical read zone, and operating process.
- Review privacy risk when RFID reads are linked to people, products, locations, time, or account records.
Major section
Start With the Story
Radio frequency means the rate of change used by a radio signal.
- Radio frequency identification (RFID) uses radio to identify or exchange data with a tag.
- A readable tag is not proof that the holder is the right person or that the next action is allowed.
- A useful access feature can quietly become a movement record.
Major section
Start With the Story (continued)
The same identifier may also reveal when a person arrives, which room they visit, and how long they stay.
- Short answers expose a weak design before more data is gathered.
- Short range and encryption do not settle every privacy question.
- The deeper sections explain cloning, tracking, access controls, notice, minimisation, and retention.
Major section
Key Concepts · In 60 Seconds
Threat model: A record of who might read, copy, relay, disable, or misuse RFID data, and which business decisions would be affected.
- Static identifier risk: The risk that a fixed UID, EPC, badge number, or item identifier can be copied, correlated, or tracked.
- Authentication boundary: The point where a tag, reader, or backend proves it is authorized before data is trusted.
- RFID security is not solved by adding encryption to a tag.
Major section
Phoebe's Field Notes: Why the Reader "Talks Louder" Than the Tag Answers · Ethics and Authorization
RFID security testing can disrupt access control, inventory, payment, transport, healthcare, or regulated workflows.
- If a weakness is found in a real system, preserve evidence carefully and use the organization responsible-disclosure path.
Major section
Threat Model First · Attack Surfaces
The remaining question is: A raw tag read is evidence, not consent.
- Both: RFID Threat Model Before Controls and authentication, zone need evidence.
- Retest trigger: New tag model, reader move, antenna change, firmware update, key rotation, policy change, new data sharing, or layout change.
- Risk depends on tag type, band, antenna, shielding, reader power, and message content.
Major section
Classic Gen2 Security Is Deliberately Thin
The original EPC Gen2 air interface was optimized for cheap, disposable item tags, so its security is minimal on purpose.
- To make classic gen2 security is deliberately thin reviewable, inspect how cloning or emulation relates to reader and event logs in it. Retain needed data marks the next check.
Major section
Classic Gen2 Security Is Deliberately Thin (continued)
Success at cloning or emulation cannot prove the reader and event logs boundary.
- Second, anyone with a reader may be able to track what a person or object is carrying by inventorying stable tag identifiers.
- The fixes are different, so the review should not collapse both into "add encryption.".
- A release claim such as "known tag observed" is weak.
Major section
Cloning and Tracking Are Separate Threats
The same RFID workflow can have both anti-cloning and privacy requirements, but the evidence differs.
- A subtle point behind eavesdropping is link asymmetry.
- The reader transmission can be heard farther than the faint tag backscatter, so short tag-read range does not automatically mean short eavesdropping range.
- In a receiving doorway, the clone test might use 40 expected tagged cases, one duplicate EPC written to a lab tag, and one unauthorized reader.
Major section
Trust Boundaries
Security quality improves when each boundary has its own evidence.
- A tag read is not a credential.
- A credential is not authorization.
- Authorization is not a privacy review.
- Tag boundary.: Decide whether the tag only identifies an object or also supports authentication, protected memory, access passwords, or cryptographic challenge-response.
Major section
Trust Boundaries (continued)
Reader boundary.: Readers should be authorized, configured, monitored, and tied to expected antenna zones.
- A reader ID by itself is not enough if readers can be moved or cloned.
- Middleware boundary.: Middleware should preserve raw evidence, reject unexpected readers, validate tag format, deduplicate reads, and attach zone context.
- Tags should not silently carry final business truth.
Major section
Layered Controls
A failure at backend policy changes the route from: Layered RFID Controls.
- Key management: Provision keys deliberately, protect reader credentials, rotate when needed, and remove stale readers from trust lists.
- Event filtering: Detect duplicate reads, impossible movement, unexpected reader/tag pairs, repeated denied attempts, and stale state transitions.
Major section
Gen2v2 and ISO 29167 Authentication
Millisecond-scale application logs are far too coarse for proximity proof.
- With cryptographic challenge-response, the reader sends a random challenge, the tag returns a response computed with a key it never transmits, and a clone that lacks the key cannot answer correctly.
- A challenge-response changes the evidence.
- Relay remains a separate trap.
Major section
Gen2v2 and ISO 29167 Authentication (continued)
Gen2v2 also defines an untraceable command that lets a tag hide or shorten what it reveals to unauthenticated readers, which addresses tracking separately from cloning.
- The reason a 32-bit access password is the wrong assurance model is visible in the math.
- If that value is exposed through provisioning records, reader compromise, weak operations, or a copied tag image, every copied tag can carry the same value.
- The verifier records the random challenge, expected response, observed response, key identifier or key version used by the verifier, and decision without logging the secret itself.
Major section
Privacy Review · Worked Review: Controlled Asset Cabinet
The tag may only reveal "an ID," but the system can often connect that ID to other records.
- To place privacy review on firm evidence, follow the change from read to fields on it. Rule marks the next check.
- Separate operational records from analytics where possible.
Major section
Release Notes · Common Pitfalls
RF validation record.: Read-zone map, no-read-zone tests, shielding/tuning notes, reader health behavior, and interference observations.
- Operations record.: Monitoring, fallback, override owner, incident response, support logs, training, and retest triggers.
- Treating a public identifier as a secret.: UID, EPC, or card number can often be observed.
- Assuming encryption stops relay.: Relay devices can forward encrypted messages.
Major section
Summary · Key Takeaway
RFID security review starts with the protected action and threat model, not with a generic control list.
- Static tag identifiers should not be treated as secrets or authorization proof.
- Layered controls span tag authentication, reader authorization, middleware filtering, backend policy, physical read-zone control, privacy minimization, monitoring, and fallback.
- Privacy risk increases when stable tag reads are linked to people, accounts, locations, time, or behavior records.
Deck summary
Key takeaways
Radio frequency means the rate of change used by a radio signal.
- The same identifier may also reveal when a person arrives, which room they visit, and how long they stay.
- Threat model: A record of who might read, copy, relay, disable, or misuse RFID data, and which business decisions would be affected.
- RFID security testing can disrupt access control, inventory, payment, transport, healthcare, or regulated workflows.
- The remaining question is: A raw tag read is evidence, not consent.
Retrieval practice
Recall check 1 of 3
Radio Remi says: answer from memory, then check your reasoning.
Q1Why is adding encryption to a tag not enough to make an RFID workflow secure?
Show answer
Answer: A Encryption alone is insufficient; RFID security also needs identity, reader authorization, read-zone control, and audit evidence.
Retrieval practice
Recall check 2 of 3
Radio Remi says: answer from memory, then check your reasoning.
Q2A pharmaceutical maker wants tags that cannot be cloned onto counterfeit product. Why is setting a strong Gen2 access password not enough, and what does help?
Show answer
Answer: A Static passwords gate operations but do not prove tag identity.
Retrieval practice
Recall check 3 of 3
Radio Remi says: answer from memory, then check your reasoning.
Q3A team says an RFID access workflow is safe from relay attacks because the tag and reader use encrypted challenge-response messages. What is the best review response?
Show answer
Answer: B RFID encryption and authentication are important, but relay risk must be reviewed separately because the attacker can forward valid messages in real time.
Print reference
Answers
Answer key.
- A · Encryption alone is insufficient; RFID security also needs identity, reader authorization, read-zone control, and audit evidence.
- A · Static passwords gate operations but do not prove tag identity.
- B · RFID encryption and authentication are important, but relay risk must be reviewed separately because the attacker can forward valid messages in real time.