Electronic – How to add security to your Product

I don't know about CE, but you legally need FCC approval to sell a product in the US if it is a intentional radiator. If not, it still has to meet part 15 requirements, but it is up to you how you comply and there is no mandatory testing.

You can just throw a unintentional radiator out there (in the US) without testing, but if there is ever a complaint or some reason the FCC decides to test it and it is found non-compliant, then you're in deep doodoo. They can confiscate all your inventory, fine you, and even criminally prosecute you in extreme cases. If you can show you had the product tested properly and it was found to pass, the problems will be less onerous. You still won't be allowed to sell them anymore, but they might not confiscate all your inventory, there might not be fines, and probably not criminal prosecution.

A bunch of years ago there were some asian motherboards that radiated all kinds of crap. The FCC waited until one of the major trade event and made a public spectacle shutting down the perpetrators and confiscating their gear.

You may think your little product is too low volume to get on the FCC's radar. That may be true by itself, but how much do you trust your competitors? One of my customers makes a end user product that includes a RF remote, so is a intentional radiator. They went thru all the trouble to get it to meet emission standards and to get it certified. One of their competitors is importing something my customer knows is not compliant, so they filed a formal complaint with the FCC. It's too soon to tell how that will play out, but I wouldn't want to be in the other guy's shoes when the FCC finally gets around to testing and finds illegal emissions.

Yes, it is quite possible to make passive tags secure, but the tag must have some local processing power, not just a static read-only memory that it reads out.

The general algorithm is called "challenge-response". The reader and the tag share some secret piece of data, but this data is never transmitted over the air. Instead, the reader chooses some random data, sends this to the tag, which performs a cryptographically-secure transformation on the data that depends on the secret data, and then sends the transformed data back to the reader. Internally, the reader performs the same transformation, and if the two results match, then the tag is known to be valid.

Such a tag cannot be cloned simply by eavesdropping on the radio signal. Of course, if an attacker physically opens the tag and reads out the secret data (along with the transformation algorithm), all bets are off.