Belgian Biometric Passport Problems

http://www.dice.ucl.ac.be/crypto/passport/index.html

A research team in cryptography from the Catholic University of
Louvain (Louvain-la-Neuve) disclosed serious weaknesses in the Belgian
biometric passport, the only type of passport distributed in Belgium
since the end of 2004. The work carried out in Louvain-la-Neuve during
the course of May 2007 show that Belgian passports issued between end
2004 and July 2006 do not include any security mechanism to protect
the personal data embedded in the passport's microchip. Passports
issued after July 2006 do benefit from security mechanisms but these
ones are flawed. This means that anyone possessing a little electronic
reading device, which is easy and cheap to acquire, can steal the
passport content while it is still in the pocket of the victim owners
and thus without their knowing. Face and signature are among the data
at risk. This news is all the more surprising because Karel De Gucht,
the Minister for Foreign Affairs, declared in the Parliament on 9th
January 2007 that the Belgian passport benefited from the security
mechanisms advocated by the International Civil Aviation Organization.

"Peter the Great Vodka Drinker" wrote in message
ups.com...
http://www.dice.ucl.ac.be/crypto/passport/index.html

A research team in cryptography from the Catholic University of
Louvain (Louvain-la-Neuve) disclosed serious weaknesses in the Belgian
biometric passport, the only type of passport distributed in Belgium
since the end of 2004. The work carried out in Louvain-la-Neuve during
the course of May 2007 show that Belgian passports issued between end
2004 and July 2006 do not include any security mechanism to protect
the personal data embedded in the passport's microchip.

I am sure that I am far from alone in wondering why there
should be a security mechanism in place to stop someone
reading electronically, that which they could read with their
eyes if they simply opened the passport at the right page.

tim

Following up to "tim....." :


"Peter the Great Vodka Drinker" wrote in message
oups.com...
http://www.dice.ucl.ac.be/crypto/passport/index.html

A research team in cryptography from the Catholic University of
Louvain (Louvain-la-Neuve) disclosed serious weaknesses in the Belgian
biometric passport, the only type of passport distributed in Belgium
since the end of 2004. The work carried out in Louvain-la-Neuve during
the course of May 2007 show that Belgian passports issued between end
2004 and July 2006 do not include any security mechanism to protect
the personal data embedded in the passport's microchip.

I am sure that I am far from alone in wondering why there
should be a security mechanism in place to stop someone
reading electronically, that which they could read with their
eyes if they simply opened the passport at the right page.


There is /more/ data embedded in the chip than can be read normally (at
least potentially). It should hold biometric data - or the keys to it on
the database. Stuff that really should be kept secret.
--
Tim C.

"Tim C." wrote in message
...
Following up to "tim....." :


"Peter the Great Vodka Drinker" wrote in
message
roups.com...
http://www.dice.ucl.ac.be/crypto/passport/index.html

A research team in cryptography from the Catholic University of
Louvain (Louvain-la-Neuve) disclosed serious weaknesses in the Belgian
biometric passport, the only type of passport distributed in Belgium
since the end of 2004. The work carried out in Louvain-la-Neuve during
the course of May 2007 show that Belgian passports issued between end
2004 and July 2006 do not include any security mechanism to protect
the personal data embedded in the passport's microchip.

I am sure that I am far from alone in wondering why there
should be a security mechanism in place to stop someone
reading electronically, that which they could read with their
eyes if they simply opened the passport at the right page.


There is /more/ data embedded in the chip than can be read normally (at
least potentially). It should hold biometric data

At the moment the only bio is a digital details from
the photo.

tim

On 20 Jun, 15:05, "tim....." wrote:
"Tim C." wrote in message

...



Following up to "tim....." :

"Peter the Great Vodka Drinker" wrote in
message
roups.com...
http://www.dice.ucl.ac.be/crypto/passport/index.html

A research team in cryptography from the Catholic University of
Louvain (Louvain-la-Neuve) disclosed serious weaknesses in the Belgian
biometric passport, the only type of passport distributed in Belgium
since the end of 2004. The work carried out in Louvain-la-Neuve during
the course of May 2007 show that Belgian passports issued between end
2004 and July 2006 do not include any security mechanism to protect
the personal data embedded in the passport's microchip.

I am sure that I am far from alone in wondering why there
should be a security mechanism in place to stop someone
reading electronically, that which they could read with their
eyes if they simply opened the passport at the right page.

There is /more/ data embedded in the chip than can be read normally (at
least potentially). It should hold biometric data

At the moment the only bio is a digital details from
the photo.

tim

well, the more info they hold about a person, the more reliable the
identity is, at least that's the idea.
But it seems that anyone can read and therefore forge. Whose fault is
that ?
Probably the govt. for allowing these faulty passports into
circulation.

Following up to "tim....." :

At the moment the only bio is a digital details from
the photo.

At the moment. Soon it'll be the fingerprint details, DNA, etc. It's
better to get the security right from the start than to try and fix it
later.
--
Tim C.

On 20 jun, 15:24, Tim C. wrote:
Following up to "tim....." :

At the moment the only bio is a digital details from
the photo.

At the moment. Soon it'll be the fingerprint details, DNA, etc. It's
better to get the security right from the start than to try and fix it
later.

Well, o' course, but isn't that the idea? - that they start out with a
limited amount of data and see if any security holes show up before
committing to adding more sensitive information?

B;

"Peter the Great Vodka Drinker" wrote in message
oups.com...
On 20 Jun, 15:05, "tim....." wrote:
"Tim C." wrote in message

...



Following up to "tim....." :

"Peter the Great Vodka Drinker" wrote in
message
roups.com...
http://www.dice.ucl.ac.be/crypto/passport/index.html

A research team in cryptography from the Catholic University of
Louvain (Louvain-la-Neuve) disclosed serious weaknesses in the
Belgian
biometric passport, the only type of passport distributed in Belgium
since the end of 2004. The work carried out in Louvain-la-Neuve
during
the course of May 2007 show that Belgian passports issued between end
2004 and July 2006 do not include any security mechanism to protect
the personal data embedded in the passport's microchip.

I am sure that I am far from alone in wondering why there
should be a security mechanism in place to stop someone
reading electronically, that which they could read with their
eyes if they simply opened the passport at the right page.

There is /more/ data embedded in the chip than can be read normally (at
least potentially). It should hold biometric data

At the moment the only bio is a digital details from
the photo.

tim

well, the more info they hold about a person, the more reliable the
identity is, at least that's the idea.
But it seems that anyone can read and therefore forge.

I don't see the sequence here.


tim

"Tim C." wrote in message
...
Following up to "tim....." :

At the moment the only bio is a digital details from
the photo.

At the moment. Soon it'll be the fingerprint details,

which helps someone how?

DNA, etc.

I think not.

It's
better to get the security right from the start than to try and fix it
later.

This assumes that you believe the information needs to be
secure.

tim

On 20 Jun, 15:39, wrote:
On 20 jun, 15:24, Tim C. wrote:

Following up to "tim....." :

At the moment the only bio is a digital details from
the photo.

At the moment. Soon it'll be the fingerprint details, DNA, etc. It's
better to get the security right from the start than to try and fix it
later.

Well, o' course, but isn't that the idea? - that they start out with a
limited amount of data and see if any security holes show up before
committing to adding more sensitive information?

B;

they are paid to solve these problems first not after