EPC RFID Tag Security Weaknesses and Defenses: Passport Cards, Enhanced Drivers Licenses, and Beyond

EPC (Electronic Product Code) tags are industry-standard RFID devices poised to supplant optical barcodes in many applications. The authors explore the systemic risks and challenges created by the increasingly common use of EPC for security applications. As a central case study, the authors examine the recently issued United States Passport Card and Washington State "Enhanced Drivers License" (WA EDL), both of which incorporate Gen-2 EPC tags. They measure multiple weaknesses, including susceptibility to cloning, extended read ranges, and the ability to remotely kill a WA EDL.