FCRFID

As it becomes more obvious that RFID's can be spoofed even with limited resources ( http://cryolite.ath.cx/perl/skin/prox ) A search on the current state of RFID challange-response systems turned up 96 bit symetrical encryption as the comercial standard.

I would like to invite anyone with detailed knowledge to comment on the possibility of brute forcing such a system.

I am assuming that listening in on a transaction for reference will provide sufficient data to know when the key has been revealed. At 40 scans a second even running sveral days seems to imply precomputed tables into the petabytes. Yet it is not so many bits if more details of the encryption is known. A non-disclosure needs to be signed to get more details, so it will take an insider somewhere to hint out just how secure they are.

tag that got my interest:
http://www.emmicroelectronic.com/Products.asp?IdProduct=205

The EM4035 is a CMOS integrated circuit intended for use in
contactless Read/Write transponders. The EM4035 is
completely ISO15693 compliant and is a member of ISO
15693 standard passive Read/Write RF tags operating at
13.56MHz.
The Chip contains an implementation of a crypto-algorithm
with 96 bit of user configurable secret-Keys contained in
EEPROM.

So the question is, will it be possible to do a power analysis on an RFID? Would doing a die probe of one brake security for all using the same key.

I know that there are high security tags in existance that are much more secure, but it is likely to be ones like this using just 96bits?

As a side note while looking at secure rfid's I also spotted this non-secure one whose specs were very impressive.
http://www.emmicroelectronic.com/DetailNews.asp?IdNews=68

An amazing feature of EM4223 is that it can read tags at a distance above 15 meters when using an optimized transponder antenna. It also has an enhanced anticollision protocol which performs without saturation effect. Indeed, with other RFID chips, it may happen that the reader saturates and is not able to read more than a certain number of tags because the transmission channel becomes saturated.
"The saturation limits of the transmission channel of EM4223 are extended to such a point that a reader is able to read over one thousand tags simultaneously present in the field", said Mougahed Darwish, president of the management board of EM Microelectronic. "Due to its high speed anticollision feature, it is also possible to read two hundred EM4223 tags per second. This high throughput will set new performance benchmarks, especially when operating under the prevailing ETSI regulation."

That's 15m reading, 200 per second, able to have 1000 in scan zone at once, one thing is certain this technology is definately not standing still.

While the idea of a Financial Cryptographic Radio Frequency Identification Device is not yet here, it is my bet it soon will be.