{'fraction_non_alphanumeric': 0.0185546875, 'fraction_numerical': 0.00732421875, 'mean_word_length': 4.9563953488372094, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Attacks on the HF Physical Layer of Contactless and RFID Systems

During the past few years, RFID technology has strongly penetrated in our lives. Nowadays public transportation ticketing, passports, ID cards, driving licenses and credit cards are using the electromagnetic waves to improve the quickness of the exchanged data. RFID devices can be divided in two main classes: the contactless cards which are smartcards with a wireless inductive interface compliant to the ISO14443 or ISO15693 standards, and the RFID tags which can have an HF or UHF interface compliant to the ISO18000 standard which now includes the EPCGlobal contribution. RFID tags are mainly dedicated to identification of objects. These exhibit a large reading distance but provide poor computational and processing resources. RFID devices and smartcards have a common characteristic; their contactless interface adds threats in term of security and privacy. This chapter will deal with this specificity by moving apart the well-known physical threats on smartcards like side channel attacks. Indeed, it is worth pointing out that the RF channel opens new potential vulnerabilities which could jeopardize security and as a consequence they should be listed and studied: • Bidirectional data communication over the air: The transactions can be easily eavesdropped by a spying probe within a distance of several meters. Due to the low resources feature of such a device, encryption remains difficult to implement. • Unidirectional power transfer over the air: The device is not the master of its energy which should be provided by the reader or by the attacker opening a backdoor for denial of service. • Clock transfer over the air (especially for HF interface): The sequencer of the card can be monitored by the reader or the attacker. Pauses or accelerations of the processor can be achieved. • Passive devices and no ON/OFF switch: The owner of the card or the tag is not able to switch off his device involving a main threat for its privacy. • Load based retro-modulation: