Contact-based fault injections and power analysis on RFID tags

In the last decade, many articles have been published that demonstrate the susceptibility of cryptographic devices against implementation attacks. Usually, such devices draw their energy from a contact-based power supply. This power-supply connection is often exploited to extract the secret key by applying fault-injection methods and power-analysis attacks. In this article, we present implementation attacks on Radio Frequency Identification (RFID) tags which are usually powered contactlessly by an electromagnetic field. We describe a contact-based measurement setup that allows both injection of faults and measuring of the power consumption of passive RFID tags. Furthermore, we demonstrate the applicability of our setup by providing practical results of attacks on commercially available HF and UHF RFID tags. The results have led us to the conclusion that RFID tags are as susceptible to such attacks as contact-based powered devices. Appropriate countermeasures are needed to thwart these attacks.