Passport's Fatal Flaws?

It's possible even in the online world, writers don't write the headlines for their own stories. That's the way it works at traditional newspapers anyway. So we're going to cut Bruce Schneier a break today. He probably didn't write this headline: Fatal Flaw Weakens RFID Passports. Whatever happened, his report does not justify this banner. There's nothing flawed; there's nothing fatal. The State Department has fixed the issues.

The story in its full glory, headline and all, is here.

It centers first on this problem:

"The proximity chip technology utilized in the electronic passport is designed to be read with chip readers at ports of entry only when the document is placed within inches of such readers." The issue is that they're confusing three things: the designed range at which the chip is specified to be read, the maximum range at which the chip could be read and the eavesdropping range or the maximum range the chip could be read with specialized equipment. The first is indeed inches, but the second was demonstrated earlier this year to be 69 feet. The third is significantly longer. And remember, technology always gets better -- it never gets worse. It's simply folly to believe that these ranges won't get longer over time. To its credit, the State Department listened to the criticism. As a result, RFID passports will now include a thin radio shield in their covers, protecting the chips when the passports are closed. Although some have derided this as a tinfoil hat for passports, the fact is the measure will prevent the documents from being snooped when closed.

OK, issue two is:

...anyone who travels knows that passports are used for more than border crossings. You often have to show your passport at hotels and airports, and while changing money... Because of this, the State Department added a second, and more-important, feature: access control. The data on the chip will be encrypted, and the key is printed on the passport. A customs officer swipes the passport through an optical reader to get the key, and then the RFID reader uses the key to communicate with the RFID chip.

But wait. There's more. Another problem. Another fatal flaw:

Unfortunately, there's still a problem...RFID chips, including the ones specified for U.S. passports, can still be uniquely identified by their radio behavior.

Oh my! Think we can solve this one? My guess is yes. Actually this is an even-handed, informative report even though it fuels the 'problem' fire.