I've been playing a bit with RFID cards of various types lately, and have noticed that the passive cards I'm using all seem to have digits of data on them as a unique identifier.
Which leads me to think that this is not a of a lot of possible ID's, so I'm wondering if organisations which issue RFID cards have ID ranges [0000100000 to 0000100100 for 100 id's for instance] assigned to them by some authority or convention?
Or is ID generation just a duty of the software that writes to the RFID cards to generate an ID at random and have it locally provisioned within the context of the application alone, ignoring concerns for global ID collisions?
Furthermore, assuming I have a device that is able to output RFID identifiers, i wonder what the limitations are of most dumb terminals. Has anybody got any examples of real world bruteforce rate for a rfid reader? How many ID/sec can it process? Do most have rate limiting in place?
Assuming a bad implementation of a card reader that does not implement rate limiting, it would follow that provisioning ID's that are sequential is bad security practice as detecting a large chunk of sequential ID's is easier than finding random ID's sparse across 10 billion values.
Any opinions on this?