EPC RFID Tags in Security Applications: Passport Cards, Enhanced Drivers Licenses, and Beyond

Abstract

EPC (Electronic Product Code) tags are industry-standard RFID devices poised to supplant optical barcodes in many applications. They are prevalent in case and pallet tracking, and also percolating into individual consumer items and border-crossing documents. In this paper, we explore the systemic risks and challenges created by increasingly common use of EPC for security applications. As a central case study, we examine the recently issued United States Passport Card and Washington State \enhanced drivers license (WA EDL), both of which incorporate Gen-2 EPC tags. We explore several issues: 1. Cloning: We report on the data format of Passport Cards and WA EDLs and demonstrate their apparent susceptibility to straightforward cloning into o-theshelf EPC tags. We show that a key anti-cloning feature proposed by the U.S. Department of Homeland Security (the tag-unique TID) remains undeployed in these cards.