We are evaluating how to improve security on our RFID System. Our system was reviewed by someone finding the point that there are duplicate Tags we must get rid of.

So the first idea was to read the UID to ensure that the used tag is not a copy of the original one. Basically what I found out is, that the UID is used in different RFID technologies (Legic, Mifare..) as it is specified in the ISO14443.

The manufactures a claiming that the UID is not writeable and unique. I don't understand how the UID is secured to be unique, as it can be read by every device, like smartphones etc. and major coding technologies as mifare classic and legic prime are compromised.

So the point is you can read on different slides, you shouldn't use ONLY the UID as a identfication. I don't understand the reasons for this recommandation to 100%.

Let me describe following imaginary scenario: We are using Legic Readers that are reading the UID of Legic-prime cards. As legic prime's encryption is complete reverse-engineered, the tag can be copied so that there are two cards with the same UID. Or is the enrcryption of the UID different? 2. Is it possible in this scenario, that also the UID of an for e.g. MifareClassic Tag can be read? So copying tags would be even easier?

So reading of Only UID is not secure. Then we got to the point that reading UID + our own ID which is in the for example Legic prime segment would be a solution. Would this be a improvement from a security perspective? Does Legic even offer such capabilities in the Reader?

After this ideas, we got to the idea that we can use a key specified and secured by our own. With this key together with the UID and the ID in the custom segment we could build a SHA-Checksum and use this as identifcation. How is this rated from a security perspective?

1 Answer 1


Anything that the reader can read so does an attacker. And anything that an attacker can read can be copied to another tag. These are the basic principles here.

So, with this in mind, using the UID + a custom ID as a security measure is not sufficient, an attacker can just read both and copy both to another tag.

So, how can we solve this problem? Long story short, cryptography! Specifically, challenge-response authentication.

How does it work? Let's say that the tag has a private key K stored in an unreadable memory location. The reader also knows of K. So the reader transmits a random number N to the tag, the tag performs some operation with K and N (encryption using K, for example) and then retrieves the result R. The reader also reads R and compares R to its own operation of K and N. If the result is the same, the tag knows the secret and is authenticated, otherwise, the authentication fails. Here, the attacker can only read R and N, but not K.

There are other security notion to take into account here (replay attacks, for example), but this covers the basic intuition of the process.

  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jul 5, 2023 at 18:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .