4 ms·
If I recall correctly, the RFID data is “encrypted” using the name and birthdate on the passport, making it fairly hard for someone to remotely scan and get usa
by gorbypark 3y ago
If I recall correctly, the RFID data is “encrypted” using the name and birthdate on the passport, making it fairly hard for someone to remotely scan and get usable usable data.
- AnthonyMouse 3y agoName and birthday isn't enough entropy to resist even a naive brute force attack. Why didn't they encrypt it with a random key and then put a QR code of the key on the inside of the passport? Or just use a magnetic stripe or similar instead of something that can be remotely accessed by an attacker?
- lmz 3y agoIt's not "encrypted by" but "authenticated by", see https://www.cs.ru.nl/~erikpoll/ufrj/C_ePassport.pdf https://www.cs.ru.nl/~erikpoll/ufrj/C_ePassport.pdf slide 10 and 11.
- consp 3y agoYou pretty much need the full MRZ or be lucky you get the right part (date of birth, document expiry and document number used) data at the bottom, it's unlikely you can brute force this in the fleeting time available with a run-by scan. If you have a digitised document number it is a lot easier but otherwise you need continuous access to the chip and when you have that you can also just read it. See ICAO 9303 for details. (BAC specifically)
- ProllyInfamous 3y agoNationality is NOT one of these encrypted data fields (i.e. you can determine if an American is walking nearby, but not their name/DOB/etc).