"Tragically easy" in the case of a large government deployment of software probably means "a few years of study, about a hundred consultants, and a bunch of cus

"Tragically easy" in the case of a large government deployment of software probably means "a few years of study, about a hundred consultants, and a bunch of custom COBOL and Java written by people who can't spell XOR and think that ROT13 is overkill." The encryption algorithms you use are the least interesting piece of the puzzle: Just use something strong enough. It's the key management, data flow, storage and access security (both physical and via computer) that this kind of thing falls apart on. You really need security all the way from the reader, which is (sort of) what chip-and-PIN is.