Abstract. Since 2004, many nations have started issuing "e-passports" containing an RFID tag that, when powered, broadcasts information. It is claimed that these passports are more secure and that our data will be protected from any possible unauthorised attempts to read it. In this paper we show that there is a flaw in one of the passport's protocols that makes it possible to trace the movements of a particular passport, without having to break the passport's cryptographic key. All an attacker has to do is to record one session between the passport and a legitimate reader, then by replaying a particular message, the attacker can distinguish that passport from any other. We have implemented our attack and tested it successfully against passports issued by a range of nations.
In 2010, an attack for tracking the movements of a particular passport without having to break the passport's cryptographic key has been proposed in REF .
A traceability attack against e-passports
In 14th International Conference on Financial Cryptography and Data Security 2010, LNCS
Computer Science