While the data encoded to any
passive tag can be encrypted, that won't prevent it from being cloned. A counterfeiter could copy a tag’s encrypted data to create a clone and introduce that tag’s twin into a supply chain. Plus, if a party just wanted to track a tag without decrypting its data, it can still do so as long as the tag does not require the
reader to authenticate itself. In order to prevent cloning or tracking, a
chip needs the built-in ability to encrypt the transmission of that data dynamically, so that the
encryption changes each time it's read.
Incorporating data encryption into the chips used in passive
RFID tags is not new.
Texas Instruments (TI) chips use an algorithm that encrypts transmissions by the tags used in
Mobil Speedpass payment fobs. And the tags used in RFID-enabled payment cards and Near Field Communication (
NFC) devices, such as cell phones and PDAs, also encrypt data transmissions. But these chips have significantly more processing power than those found in passive tags used for supply chain applications, such as
EPC Gen 2 Class 1 tags.
Additionally, security flaws have been identified in encryption used by the Speedpass
tag (see
Attack on a Cryptographic RFID Device), and researchers at the
University of Cambridge and other universities say they've succeeded in breaking the encryption used to secure data transmission between an
ISO 14443A RFID smart card and an
interrogator.
Algebraic Eraser encrypts data, then erases the part an attacker would use to try to break the encryption. Parks says one way to visualize this is to think of a tangle of fishing line. While it is being tangled, you can see where the lines cross each other, but once those intersections are no longer visible, it is very difficult to untangle the line.
According to SecureRF, partially erasing the data reduces the amount of information generated during the encryption process, and also increases the speed at which it is encrypted. Parks claims the Algebraic Eraser is 1,000 times faster than an RSA's application for equivalent security.