Squealing Euros: Privacy Protection in RFID-Enabled Banknotes

Thanks to their broad international acceptance and availability in high denominations, there is widespread concern that Euro banknotes may provide an attractive new currency for criminal transactions. With this in mind, the European Central Bank has proposed to embed small, radio-frequency-emitting identification (RFID) tags in Euro banknotes by 2005 as a tracking mechanism for law enforcement agencies. The ECB has not disclosed technical details regarding its plan. In this paper, we explore some of the risks to individual privacy that RFID tags embedded in currency may pose if improperly deployed. Acknowledging the severe resource constraints of these tags, we propose a simple and practical system that provides a high degree of privacy assurance. Our scheme involves only elementary cryptography. Its effectiveness depends on a careful separation of the privileges offered by optical vs. radio-frequency contact with banknotes, and full exploitation of the limited access-control capabilities of RFID tags.