Why a tag UID is not authentication — and what encryption and dynamic data add

01 / FIELD NOTE

Keep the decision tied to the operating context.

The word unique, in a factory identifier, is doing quieter work than it first appears. A tag carries a permanently assigned serial number that no reader can change, and it is tempting to treat that invariant as a credential. It is not — it is an identifier, and the distinction is the whole of this note. The factory number is broadcast openly: any reader in range receives it without any interaction. A device that copies the number into another tag now answers with the same identifier, and a system that checks only the number greets the copy with the same privileges as the original.

The attack that makes this concrete is the sniff-and-clone: an adversary stands near a genuine tag, records its identifier from the air, and writes it into a blank chip that has no secret. The copied chip is, from the interrogator's point of view, indistinguishable — same identifier, same answer, same behaviour. The failure is not that the technology is broken; it is that the design asked a public fact to do the job of a secret. The identifier is fine for automation — a count of what is present, a link to a record — and useless for proof.

The step up is a secret shared between the tag and the system, and the mechanism is a mutual handshake. Each side holds a key that the other's protocol can test; when a reader asks for data, the tag demands proof from the reader before it releases anything, and the reader's system demands proof from the tag that it holds the right key. Data exchanged in this mode is computed rather than released: the key never crosses the air, only a result that only the key-holder could produce. An eavesdropper recording the traffic learns a transcript, not the secret.

The encryption is what protects a captured transcript from being replayed later. If the tag always answered with the same ciphertext — the same byte string, however scrambled — an attacker could record that string once and replay it forever, and the system would accept it every time because it is, byte for byte, what a genuine tag produces. The handshake stops the impersonation of the tag; a static answer would let the impersonation of the answer succeed. This is the replay attack, and it is the reason the third layer exists.

The third layer makes the answer a living object. The chip holds an internal counter that increments on every interaction, and each tap produces a message computed from the counter plus the current session material, signed with the key. No two taps produce the same message, and the server that verifies the message checks the counter against the values it has seen: a message built with an already-used counter is refused, because a genuine tag only moves forward. A recorded interaction is dead on arrival — it is a past moment of a tag that has since moved on.

The three layers compose rather than substitute, and the useful mental model is a maturity scale. UID alone answers "what is it" and is defeated by a copy. A keyed handshake answers "does it hold the secret" and is defeated by a replay of a static answer. The dynamic counter answers "is this answer fresh" and closes replay while preserving the consumer interaction — the tap still opens a page in a normal browser; only the computation behind the page changed. Each layer costs a little more per tag and buys exactly one named attack.

The honest limit: the mechanism is as strong as the key management around it. A key that was provisioned identically to every unit in a batch is a shared secret, and a leak of one unit then compromises the batch; a proper deployment varies the key per identifier and keeps the mapping in the server. The physics underneath is also unchanged: the crypto runs in milliseconds and sits under the radio discipline of the antenna, so the read-range behaviour of the tag is a design property that exists independent of the authentication. What the three layers decide is the height of the bar a copy must clear, not the range at which the bar is met.