Security assessment of the Spanish contactless identity card

Rodríguez, R.J. (Universidad de Zaragoza) ; Garcia-Escartin, J.C.

Resumen: The theft of personal information to fake the identity of a person is a common threat normally performed by individual criminals, terrorists, or crime rings to commit fraud or other felonies Recently, the Spanish identity card, which provides enough information to hire online products such as mortgages or loans, was updated to incorporate a near-field communication chip as electronic passports do. This contactless interface brings a new attack vector for criminals, who might take advantage of the radio-frequency identification communication to virtually steal personal information. In this study, the authors consider as case study the recently deployed contactless Spanish identity card assessing its security against identity theft. In particular, they evaluated the security of one of the contactless access protocol as implemented in the contactless Spanish identity card, and found that no defences against online brute-force attacks were incorporated. They then suggest two countermeasures to protect against these attacks. Furthermore, they also analysed the pseudo-random number generator within the card, which passed all the performed tests with good results.

Idioma: Inglés

DOI: 10.1049/iet-ifs.2017.0299

Año: 2017

Publicado en: IET Information Security 11, 6 (2017), 386-393
ISSN: 1751-8709

Factor impacto JCR: 0.89 (2017)

Categ. JCR: COMPUTER SCIENCE, THEORY & METHODS rank: 69 / 103 = 0.67 (2017) - Q3 - T3
Categ. JCR: COMPUTER SCIENCE, INFORMATION SYSTEMS rank: 123 / 148 = 0.831 (2017) - Q4 - T3

Factor impacto SCIMAGO: 0.381 - Computer Networks and Communications (Q2) - Software (Q2) - Information Systems (Q2)

Financiación: info:eu-repo/grantAgreement/ES/MINECO/TIN2014-58457-R
Financiación: info:eu-repo/grantAgreement/ES/UZ/CUD2016-TEC-06

Tipo y forma: Article (PostPrint)

Área (Departamento): Área Lenguajes y Sistemas Inf. (Dpto. Informát.Ingenie.Sistms.)