Cloning a VeriChip

[bascule]

Yes, just because something's subdermally implanted doesn't make it secure:

http://cq.cx/verichip.pl

Been reading all sorts of crazy stories about these recently. I'd hate to have a subdermally implemented security measure get compromised and then go obsolete...

Some background:
http://www.chron.com/disp/story.mpl/...s/3656833.html
http://sf.indymedia.org/news/2006/02/1724563.php
http://www.chicagotribune.com/techno...technology-hed

[renderman]

Realativly old news. Any ID only chip without any cryptographic functions is stupidly
easy to clone. Johnathan's device just proves how easy it is.

Might want to checkout http://www.spychips.com/

[bascule]

Needs more HMAC-driven challenge/response

[renderman]

Needs more HMAC-driven challenge/response

Problem is the limited computing power on the chip, limits the kinds of crypto that can be done. Usually what happens is some half-baked proprietary scheme gets used and eventually broken, as in the case of Exxon/Mobil Speedpass tags (http://www.rfidanalysis.org)

[bascule]

I would think that if these devices are RF powered, the amount of power required to compute a secure challenge/response algorithm would be the biggest concern. But of course, the energy requirements ultimately limit the computing power which is of course the ultimate bottleneck in algorithm selection.