What Is RFID?

What Is RFID?

RFID stands for Radio-Frequency Identification. It's a technology that uses electromagnetic fields to automatically identify and track tags attached to objects. When you tap your badge to open a door at work, pay with a contactless credit card, or scan a library book, you're using RFID.

The technology dates back to World War II, when the British used radar transponders to identify friendly aircraft (the IFF system - Identification, Friend or Foe). The first commercial RFID patents were filed in the 1970s, and the technology has evolved dramatically since then. Today, billions of RFID tags are manufactured annually, and they're embedded in everything from retail merchandise to surgical instruments to pet microchips.

At its core, RFID is simple: a reader emits radio waves, a tag receives those waves and responds with stored data. The details of how this happens vary widely depending on the type of tag, the frequency used, and the application.

How RFID Works

sequenceDiagram
    participant Reader as RFID Reader
    participant Field as RF Field
    participant Tag as RFID Tag
    
    Note over Reader: Powered device with antenna
    Note over Tag: Chip + Antenna (passive tag)
    
    Reader->>Field: Emit RF energy
    Field->>Tag: Energy reaches tag antenna
    Tag->>Tag: Rectify RF to DC power
    Tag->>Tag: Power up internal chip
    Tag->>Tag: Modulate response signal
    Tag->>Field: Backscatter modulated signal
    Field->>Reader: Reader detects modulation
    Reader->>Reader: Decode tag data (ID, memory)
    
    Note over Reader,Tag: Entire exchange in milliseconds
    Note over Reader: Range depends on frequency
    Note over Reader: LF: ~10cm / HF: ~1m / UHF: ~12m

How passive RFID works - the reader provides both the energy and the communication channel, while the tag responds using backscatter modulation.

An RFID system has three components:

The tag (transponder) contains a microchip connected to an antenna. The chip stores a unique identifier and may have additional memory for data storage. The antenna receives energy from the reader and transmits the tag's response.

The reader (interrogator) contains a transmitter, receiver, and antenna. It emits radio waves that power the tag (for passive tags) or activate the tag (for active tags), then listens for the tag's response.

The backend system processes the data received from the reader. When you tap your badge at a door, the reader sends the badge's ID to an access control system that checks whether you're authorized to enter.

The magic of passive RFID is that the tag has no battery. It draws all its power from the reader's radio field through electromagnetic induction (for near-field systems) or energy harvesting from radio waves (for far-field systems). This is why passive RFID tags can be so small, cheap, and durable - there's no battery to replace or wear out.

Passive vs Active Tags

RFID tags fall into three categories based on their power source:

Passive tags have no internal power source. They receive all their energy from the reader's RF field. When the reader's signal hits the tag's antenna, it induces a small current that powers the chip. The tag responds by modulating (changing) the reflected signal - a technique called backscatter.

• Range: centimeters to ~12 meters depending on frequency
• Cost: $0.05-0.50 per tag at volume
• Lifespan: virtually unlimited (no battery)
• Size: can be tiny (grain-of-rice size for implantable tags)
• Uses: access cards, inventory tags, library books, passports, transit cards

Active tags have their own battery and can transmit signals independently. They don't need power from the reader, which allows much greater range and more complex functionality.

• Range: up to 100+ meters
• Cost: $5-100+ per tag
• Lifespan: limited by battery (typically 3-5 years)
• Size: larger due to battery
• Uses: vehicle tracking, container monitoring, real-time location systems, toll collection

Semi-passive (battery-assisted passive) tags have a battery to power the chip's circuitry but use backscatter for communication (like passive tags). The battery improves read reliability and range compared to fully passive tags while avoiding the cost of a full transmitter.

• Range: up to ~30 meters
• Cost: $1-20 per tag
• Uses: temperature monitoring during shipping, toll roads, some access control systems

Frequency Bands

graph TD
    subgraph LF["Low Frequency - 125-134 kHz"]
        LF1[Read Range: up to 10 cm]
        LF2[Data Rate: Low]
        LF3[Penetrates water and tissue]
        LF4[Uses: Access cards, animal tags, car immobilizers]
        LF5[Standards: EM4100, HID Prox, T5577]
    end
    subgraph HF["High Frequency - 13.56 MHz"]
        HF1[Read Range: up to 1 meter]
        HF2[Data Rate: Medium]
        HF3[Global standard frequency]
        HF4[Uses: Passports, transit, payments, libraries]
        HF5[Standards: ISO 14443, ISO 15693, NFC]
    end
    subgraph UHF["Ultra High Frequency - 860-960 MHz"]
        UHF1[Read Range: up to 12 meters]
        UHF2[Data Rate: High]
        UHF3[Bulk reading capability]
        UHF4[Uses: Supply chain, retail, warehousing]
        UHF5[Standards: EPC Gen2, ISO 18000-6C]
    end

The three main RFID frequency bands - each with different range, speed, and application characteristics.

RFID operates across several frequency bands, each with different characteristics:

Low Frequency (LF) - 125 to 134 kHz: The oldest and simplest RFID technology. LF signals penetrate water and body tissue well, making them suitable for animal identification (pet microchips) and environments where materials might block higher frequencies. Read range is limited to about 10 centimeters. Many older access control systems use LF (HID Prox cards at 125 kHz are still extremely common).

High Frequency (HF) - 13.56 MHz: The sweet spot for many applications. HF provides a good balance of range, data rate, and cost. This is the frequency used by NFC (Near Field Communication), contactless payment cards, electronic passports, library systems, and modern access control cards (MIFARE, iCLASS). Read range extends to about 1 meter.

Ultra High Frequency (UHF) - 860 to 960 MHz: Designed for longer range and bulk reading. A single UHF reader can inventory hundreds of tags per second at ranges up to 12 meters. This is the frequency used in supply chain management, retail inventory, warehouse logistics, and toll collection. The exact frequency varies by region (US uses 902-928 MHz, Europe uses 865-868 MHz).

Microwave - 2.45 GHz and above: Used in some specialized applications like vehicle identification and some active tag systems. Higher frequency means smaller antennas but shorter range for passive systems.

RFID in Access Control

The access badge you use at work is likely one of these common RFID card types:

125 kHz Proximity Cards (HID Prox, EM4100): These are the older, simpler cards. They transmit a fixed ID number when energized by a reader. There's no encryption, no authentication, and no protection against cloning. An attacker with a $20 reader can capture and clone these cards in seconds. Despite this, they're still in widespread use because replacing an entire access control system is expensive.

13.56 MHz Smart Cards (MIFARE, iCLASS, DESFire): These cards contain a microprocessor and support encrypted communication with the reader. MIFARE Classic (introduced in 1994) was a significant upgrade over proximity cards but has since been found to have cryptographic weaknesses that allow cloning. MIFARE DESFire and iCLASS SE offer stronger security with AES encryption.

The progression of access card security:

• 125 kHz Prox: No encryption. Trivially cloneable.
• MIFARE Classic: Proprietary Crypto-1 encryption. Broken in 2008. Cloneable with specialized tools.
• iCLASS Standard: Proprietary encryption. Broken. Cloneable.
• MIFARE DESFire EV1/EV2/EV3: AES-128 encryption. Considered secure when properly implemented.
• iCLASS SE/SEOS: AES encryption with mutual authentication. Current generation, considered secure.

The security of any RFID access system depends not just on the card technology but on how the backend system is configured. Even a secure card can be undermined by poor system administration - default encryption keys, lack of card revocation processes, or physical access to the reader wiring.

RFID in Passports and IDs

Electronic passports (e-Passports) contain an RFID chip operating at 13.56 MHz (NFC compatible). The chip stores a digital copy of the passport's data page, a facial photograph, and in some countries, fingerprint data.

e-Passport security features:

• Basic Access Control (BAC): The chip is encrypted with a key derived from the passport number, date of birth, and expiry date printed in the Machine Readable Zone (MRZ). You need to optically scan the passport before you can read the chip - this prevents unauthorized reading while the passport is in your pocket.
• Passive Authentication: A digital signature from the issuing country verifies that the data hasn't been altered. The reader checks the signature against the country's public key.
• Active Authentication: The chip proves it's genuine (not a clone) by responding to a random challenge with a signature using its private key, which can't be extracted from the chip.
• Extended Access Control (EAC): Required for biometric data (fingerprints). Uses certificate-based mutual authentication between the chip and the reader.

These security layers make e-Passports significantly harder to attack than access cards. Cloning a passport chip requires breaking the chip's cryptographic protections, which is currently considered infeasible with properly implemented chips.

RFID in Supply Chains

UHF RFID has transformed supply chain management. Every major retailer, many manufacturers, and most logistics companies use RFID for inventory tracking.

How it works in practice:

• Products are tagged at the manufacturer (the tag cost is pennies per item at scale)
• As pallets move through warehouses, portal readers automatically log every tagged item that passes through
• In retail stores, handheld readers can inventory thousands of items in minutes (compared to hours with barcode scanning)
• Self-checkout and anti-theft systems use RFID to verify items and detect unpaid merchandise

The efficiency gains are enormous. Traditional barcode scanning requires line-of-sight to each individual item. RFID readers can detect hundreds of tags simultaneously through packaging - an entire pallet can be inventoried in seconds without opening a single box.

Amazon's cashier-less "Just Walk Out" technology relies partly on RFID to track items as customers pick them up. Airlines use RFID tags on luggage for automated sorting and tracking. Hospitals use RFID to track surgical instruments and ensure none are left inside patients.

NFC: A Subset of RFID

Near Field Communication (NFC) is a specific set of standards built on HF RFID (13.56 MHz). It's defined by the NFC Forum and is the technology behind contactless payments (Apple Pay, Google Pay), tap-to-pair Bluetooth connections, and various smartphone-based interactions.

NFC differs from general HF RFID in a few ways:

• Peer-to-peer mode: Two NFC devices can communicate with each other (unlike standard RFID which is always reader-to-tag). This enables phone-to-phone data transfer and tap-to-pair.
• Card emulation mode: An NFC device (like a smartphone) can pretend to be an RFID card. This is how mobile payments work - your phone emulates a contactless payment card.
• Reader/writer mode: An NFC device can read and write NFC tags. This is how you interact with NFC stickers, smart posters, and business cards with embedded tags.
• Short range by design: NFC's range is intentionally limited to about 4 centimeters. This is a security feature - the short range reduces eavesdropping risk.

Every modern smartphone has an NFC chip. This means billions of people carry an RFID reader/emulator in their pocket, which has driven massive growth in NFC applications.

Security Concerns

RFID's convenience comes with security trade-offs. The same wireless nature that makes RFID useful also makes it attackable without physical contact.

Core security concerns:

Unauthorized reading: If a tag doesn't require authentication, anyone with a reader can scan it. Older access cards, basic inventory tags, and some NFC tags broadcast their data to any reader in range.

Cloning: If a tag's data can be read and a writable tag is available, the data can be copied. This is trivial for 125 kHz proximity cards and feasible for MIFARE Classic cards. It's much harder for cards with strong encryption (DESFire, SEOS).

Eavesdropping: An attacker with a sensitive receiver can capture the communication between a reader and tag from a distance greater than the normal read range. The extent depends on the frequency and power levels involved - HF/NFC eavesdropping has been demonstrated at ranges of several meters.

Relay attacks: Two attackers with radio equipment can relay the communication between a card and reader over a longer distance. One attacker holds a device near the victim's card, the other holds a device near the target reader, and the communication is tunneled between them in real time. This effectively extends the card's range from centimeters to anywhere with an internet connection.

Tracking: Since most RFID tags transmit a fixed unique identifier, they can be used to track the tag (and its carrier) across multiple reader locations. This is a privacy concern for items with embedded tags (clothing, luggage) and for access cards that are scanned at multiple locations.

Common RFID Attacks

Card cloning is the most practical attack against older access control systems. With a reader device (Proxmark3 is the most capable tool, though simpler readers exist for specific card types), an attacker reads the card data and writes it to a blank compatible card. For 125 kHz systems, this takes seconds and requires only proximity (standing near someone in an elevator could be enough).

Replay attacks capture a valid communication between card and reader, then replay it later. This works against systems without challenge-response authentication. Modern systems prevent this by using random challenges that change each time.

Brute force against weak card types. MIFARE Classic's Crypto-1 encryption uses 48-bit keys with known weaknesses. Tools can recover the encryption keys through various attacks (nested authentication attack, hardnested attack, darkside attack) in seconds to minutes.

Relay (Ghost and Leech) attacks extend the effective range of a card. The "leech" device sits near the victim's card, and the "ghost" device presents itself to the reader. The communication between them happens in real time over another channel (Bluetooth, WiFi, cellular). The reader thinks it's talking to the card directly.

Tag manipulation involves modifying writable tags to change stored data. In retail, this could mean changing an item's price tag. In access control, it could mean elevating privileges stored on the card.

Protecting Against RFID Attacks

For organizations:

• Upgrade from 125 kHz proximity cards to modern encrypted cards (DESFire EV2/EV3 or SEOS)
• Use multi-factor authentication for sensitive areas (card + PIN, card + biometric)
• Change default encryption keys on card systems
• Monitor access logs for anomalies (same card used at two locations simultaneously, access at unusual hours)
• Implement anti-passback (the system tracks whether you entered before allowing exit, preventing card sharing)

For individuals:

• RFID-blocking wallets and sleeves physically shield cards from unauthorized reading (simple and effective for passive tags)
• Be aware of what cards you carry and what information they contain
• For passports, the metallic cover provides shielding when closed - the chip can only be read when the passport is open
• Keep firmware updated on NFC-enabled devices

For system designers:

• Use strong encryption (AES-128 minimum)
• Implement mutual authentication (both reader and tag verify each other)
• Use random challenge-response protocols to prevent replay attacks
• Consider distance-bounding protocols to prevent relay attacks
• Design for key diversification (each card has a unique key derived from the master key and card identifier)

The Future of RFID

RFID continues to evolve. Several trends are shaping its future:

Smaller and cheaper tags: Tag costs continue to drop while capabilities increase. Sub-cent tags are making it economical to tag individual consumer goods (every bottle, every package).

Printed electronics: RFID circuits printed directly onto packaging using conductive inks could make tags essentially free, integrated into the printing process rather than attached separately.

Sensor integration: Tags that combine identification with sensor data (temperature, humidity, shock, tampering) are growing in pharmaceutical and food supply chains. A tag can confirm not just that a product arrived, but that it stayed within safe temperature ranges the entire journey.

RAIN RFID (UHF standardization): The RAIN (RAdio-frequency IdentificatioN) alliance is pushing for standardized UHF RFID adoption, similar to how the WiFi Alliance standardized wireless networking. This is driving interoperability and reducing deployment friction.

Integration with IoT: RFID is becoming an input layer for Internet of Things systems. Tags provide identity and sensor data that feeds into cloud platforms for analytics, automation, and decision-making.

RFID isn't flashy technology. It works in the background, quietly tracking billions of objects and granting access to millions of people every day. Understanding how it works - the frequencies, the security models, the attack surfaces - gives you insight into one of the most pervasive technologies in the physical world.

Exploring wireless technologies and physical security? The BLEShark Nano supports BLE scanning and analysis alongside WiFi capabilities, making it a useful tool for understanding the wireless landscape around you.