Basic access control
 | This article or section is in a state of significant expansion or restructuring. You are welcome to assist in its construction by editing it as well. If this article or section has not been edited in several days, please remove this template. If you are the editor who added this template and you are actively editing, please be sure to replace this template with {{in use}} during the active editing session. Click on the link for template parameters to use.
This article was last edited by Davidwr (talk | contribs) 17 years ago. (Update timer) |
Basic Access Control (BAC) is a mechanism specified to ensure only authorized parties can wirelessly read personal information from passports with an RFID chip. It uses data such as the passport number, date of birth and expiration date to negotiate a session key. This key can then be used to encrypt the communication between the passports chip and a reading device. This mechanism is intended to ensure that the owner of a passport can decide who can read the electronic contents of the passport.
inner workings
The data used to encrypt the BAC communication can be read electronically from the bottom of the passport called the machine readable zone. Because physical access to the passport is assumed to be needed to know this part of the passport it is assumed that the owner of the passport has giving permission to read the passport. Equipment for optically scanning this part of the passport is already widely used. It uses an OCR system to read the text which is printed in a standardized format.
security
The Basic Access Control mechanism has been criticized as offering to little protection from unauthorized interception. Researchers claim that because there are only limited amounts of passport issued many theoretically possible passport numbers will not be in use in practice. And there are ages in theory that no passport carrying human has in practice. This is because children typically do not request passports and some ages are beyond a normal human lifespan.
In other words, the data used as an encryption key has a low entropy.
It is claimed this brings intercepted but encrypted data in the reach of a modest brute force attack.
This effect increases when passport numbers are issued sequentially or contain a redundant checksum. Both are proven to be the case in passports issued by the Netherlands. There are other factors that can be potentially used to speed up a brute force attack. There is the fact that dates of birth are typically not distributed randomly in populations. Dates of birth may be distributed even less randomly for the segments of a population that pass for example a check in desk at an airport. And the fact that passports are often not issued on all days of the week and during all weeks of a year. Therefore not all theoretically possible expiration dates may get used.
Sources
- "Security and Privacy Issues in E-passports" by Ari Juels, David Molnar†, and David Wagner, retrieved March 15, 2006
- "A Security Review of the Biometric Passport" by Bart Jacobs, retrieved March 15, 2006 (presentation slides)
- Security Mechanisms of the Biometrically Enhanced (EU) Passport by Dennis Kügler Federal Office for Information Security Germany (presentation slides from the 2 nd International Conference on Security in Pervasive Computing 2005-04-07)
NOTE: Basic Access Control entry added to this page with the edit of 18:37, 15 March 2006 145.74.169.195.