Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently researching fingerprint abilities of german ID cards. These cards are compliant to ISO 14443 (the same standard as for passports). I found a part that caught my attention and I have a question concerning this, as I have no chance to really test it on passports/ID cards at the moment.

ISO/IEC 14443-3, Chapter 7.9.2 says:

A Pseudo-Unique PICC Identifier (PUPI) is used to differentiate PICCs during anticollision. This 4-Byte number may be either a number dynamically generated by the PICC or a diversified fixed number.

Proposition: There is a small chance of bad implementations here. If there are >2 passports/ID cards around, each one might use the same PUPI all the time.

I haven't found a source to support my proposition so far, so I'm crowdsourcing it and would be happy to hear your thoughts.

share|improve this question
I would imagine that "a diversified fixed number" could mean a counter. As long as there are <2^32 cards, it's feasible that there are no duplicates. – Polynomial Jan 14 '13 at 15:42

Yes, it's possible to have a PUPI collisions. (It's called pseudo-unique, after all, not unique.) This can happen with probability 2-32 if the PUPI is chosen randomly, or more if it isn't. The question is, so what? How is a PUPI collision harmful?

The primary intent of the PUPI is to be unique at a particular point in space-time: an RFID reader emits a “hello y'all” signal (REQA or REQB), and all the cards that receive this signal respond with a message (ATQA or ATQB) containing some type identification information (e.g. “I'm a German ID card”) and a PUPI. The reader may then decide to start a conversation with one of the cards that are in range, and it uses the PUPI to identify which of the cards it will talk to. It's irrelevant whether the reader has talked to different card with the same PUPI in the past, or whether there's another card reporting the same PUPI to a different reader.

If there are two cards in range with the same PUPI, it's likely that the reader won't be able to communicate with either (both would reply if prompted). Having multiple cards in range is supported in principle, but isn't guaranteed to work anyway: it requires the analog signal to be of good enough quality, and depends on how much interference there is (due to opaque or reflecting objects in the vicinity, among others). While a card attempting to trigger PUPI collisions is a DoS, there are worse ways to cause a DoS (it's radio, so it can be jammed).

Another element to the PUPI is privacy: if a card always reports the same PUPI, it's easier to track it. But you can already track a card by type: the PUPI only matters if there are several cards of the same type in the same general location. Ideally, the PUPI should be randomized at each powerup (I don't know if German ID cards to that), or should be identical on all cards (which would also ensure privacy but could cause collisions if there are several ID cards in close proximity — not a very common occurrence in day-to-day situations).

share|improve this answer
Thanks for your answer. Meanwhile I found what I was looking for deep inside some german specs. Indeed the UID and the PUPI on a german ID card are randomly generated each time the chip gets activated. – paraa Jan 15 '13 at 11:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.