RFID Security & Privacy

Think in threats, not headlines

RFID security discussions tend to swing between two extremes: "RFID can track you anywhere" and "it is just a label, there is nothing to secure". Both are wrong. The right approach is the one security engineers use for any system: identify what you are protecting, who might attack it, how, and what it would cost them and you.

A garment label in a retail store, a FASTag on a car windscreen, an employee access card and a drug authentication tag face very different threats. A stock-count label mainly needs integrity of data; an access card needs resistance to cloning; a hospital patient wristband needs privacy. Start every project with three questions:

1. What happens if someone copies a tag?
2. What happens if someone reads a tag without permission?
3. What happens if tags or readers stop working?

The main RFID threats

Note that the backend is part of the attack surface. Many real incidents involve insecure servers, default reader passwords or exposed APIs rather than clever radio attacks.

Myths vs reality

Defences for UHF (EPC Gen2) tags

Lock, passwords and kill

Standard Gen2 tags provide a 32-bit access password, a 32-bit kill password and lock states for each memory bank (see EPC Encoding & Tag Memory). Use them:

• Lock the EPC and User memory with a non-default access password so tags cannot be rewritten by anyone with a reader.
• Read-lock both passwords so they cannot be retrieved.
• Prefer unique per-tag passwords, for example derived from the TID and a secret key held in your system, so one leaked password does not unlock everything.
• Use the kill command at point of sale where customer privacy matters and the tag has no after-sale use.

These controls stop casual tampering, but the Gen2 password mechanism was not designed as strong cryptography and should not be relied on against a determined attacker.

TID checks

Recording the factory TID next to each EPC and checking both on read detects simple clones made with ordinary blank tags. It is a cheap and effective first layer, though specialist emulators can fake a TID.

Gen2v2 features

Gen2v2 adds optional commands that substantially improve security and privacy on chips that implement them:

• Untraceable - a tag can hide all or part of its EPC, TID and User memory, and reduce its operating range, so only authorised readers see full data. Useful after sale or for tags carried by people.
• Authenticate - cryptographic challenge-response using crypto suites from the ISO/IEC 29167 family (for example AES-128 based), proving that a tag is genuine because it holds a secret key that cannot be read out.

Chip support varies, and readers and software must support these commands too, so verify end to end before committing. Chip families are compared in RFID Chips Explained.

Defences for HF and NFC tags

Avoid broken legacy chips for security

The proprietary Crypto-1 cipher in MIFARE Classic cards was publicly broken in 2008, and those cards can be cloned with readily available tools. Plain 125 kHz proximity cards are even weaker: most simply broadcast a fixed number. Both are still common in Indian offices and housing societies. They are fine for low-risk uses, but should not protect anything valuable.

MIFARE DESFire (EV1, EV2, EV3)

DESFire chips are ISO/IEC 14443 A cards with on-chip AES-128 encryption, mutual authentication between card and reader, and file-based access rights per application. Keys never leave the chip. Later generations add features such as secure messaging improvements, transaction MACs and a proximity check that helps against relay attacks. DESFire is widely used for transit, campus and corporate access.

NTAG 424 DNA and SUN messages

NTAG 424 DNA is an NFC Forum Type 4 tag with AES-128. Its standout feature is Secure Dynamic Messaging (SDM), which produces SUN (Secure Unique NFC) messages: every time a phone taps the tag, it returns a URL containing an encrypted tag ID, a tap counter and a cryptographic signature (CMAC) that changes on every tap. A server holding the key verifies the signature and checks that the counter has increased. A copied URL fails because its counter has already been used, and the tag cannot be cloned without the key. No special app is required - any NFC phone can open the link.

See our NFC tags and RFID cards and wristbands pages for secure options.

Physical and backend defences

Shielding

Metal foil and conductive fabrics block RF energy. RFID-blocking sleeves and wallets protect cards when fully enclosed; shielded pouches protect passports and ID documents. In security design, remember that attackers can use shielding too - for example foil-lined bags to defeat security gates - so combine RFID with other controls where theft is a concern.

Backend authorisation

The strongest principle in RFID security is: a tag ID is a claim, not a proof. Decide what a tag read is allowed to do in the backend, using business context:

• Check that the tag is active, not reported lost, and associated with the expected item or person.
• Check plausibility - the same card cannot enter Gate 1 in Delhi and Gate 4 in Pune within a minute.
• For sensitive actions, add a second factor such as a PIN, biometric or camera check.
• Secure readers, networks and APIs as described in RFID Middleware & Software.

Relay and jamming

Relay attacks are hard to stop with crypto alone because the genuine card performs the cryptography. Defences include proximity-check features, tight timing limits, requiring user action and transaction limits. Jamming is detectable: monitor reader noise levels and alarm when a normally busy reader suddenly sees no tags.

Privacy by design

Privacy concerns arise when an RFID tag becomes linked to a person - an employee badge, a student card, a patient wristband, a tagged garment after purchase. Build privacy in from the start:

• Data minimisation - store only a random or opaque reference on the tag, never names, Aadhaar numbers, phone numbers or health details.
• Purpose limitation - use location data collected for safety or attendance only for that purpose, not for unrelated monitoring.
• Transparency - tell people where readers are and why; visible signs at reader zones build trust.
• Control at end of use - kill, detach or deactivate consumer tags at sale, or use Gen2v2 Untraceable.
• Retention limits - delete or anonymise movement histories when they are no longer needed.
• Access control and audit - restrict who can see personal location data and log every access.

Privacy law: India's DPDP Act and global rules

This section is a high-level overview, not legal advice.

India - Digital Personal Data Protection Act, 2023

The DPDP Act governs digital personal data processed in India, and processing outside India connected with offering goods or services to people in India. RFID data becomes personal data when it can identify a person, directly or by linking a tag ID to an employee, student, patient or customer record. Key obligations for the organisation (the Data Fiduciary) include:

• Processing for a lawful purpose, on the basis of consent or a legitimate use recognised by the Act, with a clear notice.
• Collecting only what is needed for that purpose and keeping it accurate.
• Implementing reasonable security safeguards to prevent personal data breaches.
• Notifying the Data Protection Board and affected individuals of breaches.
• Honouring the rights of individuals (Data Principals), such as access, correction, erasure and grievance redressal.
• Extra care for children's data, including verifiable parental consent - relevant for school RFID attendance systems.

Penalties under the Act can be very large, so RFID projects involving people should include a privacy review from the start. Detailed rules made under the Act are being implemented in phases, so check the current position with your legal team.

Elsewhere

In the European Union, the GDPR treats RFID data linked to a person as personal data, and European guidance encourages privacy impact assessments for RFID applications and standard signs that inform people of RFID reading zones. Other countries, including several US states, have their own privacy laws. If your products or people cross borders, design for the strictest regime you operate in.

RFID security and privacy checklist

• Threat model written: what happens if a tag is cloned, skimmed or jammed?
• Chip chosen for the risk: plain IDs for logistics; AES-capable chips (DESFire, NTAG 424 DNA, Gen2v2 Authenticate) for access, authentication and value.
• No MIFARE Classic or plain 125 kHz cards protecting high-value assets or sensitive areas.
• EPC and user memory locked with non-default, preferably per-tag, access passwords; passwords read-locked.
• TID recorded at encoding and checked in sensitive processes.
• No personal data on tags; opaque references only.
• Backend authorisation, plausibility checks and second factors for sensitive actions.
• Readers hardened: default passwords changed, firmware current, separate network segment, TLS for integrations.
• Monitoring for reader outages, unusual silence and RF noise.
• Privacy notice, signage, retention policy and DPDP review completed where people are involved.
• Key management plan: who holds AES keys, how they are stored, rotated and backed up.

For a review of an existing system or help choosing secure tags, talk to our RFID consulting team. Security design is also covered in depth in our Certified RFID Specialist Program.