In my application, I am trying to prevent counterfeit widgets from being used on our gadgets; think HP ink-cartridges. I will be doing such with UHF RFID tags embedded in the widgets.
Unfortunately, the environment in which the gadgets are used does not allow me to keep a database of every widget in existence. I am operating in a closed, non-connected environment. The gadgets will have a computer and RFID reader installed on them. And the widgets may be used across multiple gadgets and they are reusable for a certain, to be determined, number of cycles.
I'd like to use the unique Tag ID (TID) of each tag as the salt for a common passphrase. These will be used to generate a 32-bit hash which will then be used as the tag read/write enable field. I then want to use some other hash in the user memory as secondary assurance that the widget is indeed authentic. Possibly using some random number and/or the date/time. However, I'm not exactly sure how I'd do that across multiple gadgets without storing unencrypted, unhashed information on the tag.
I know my current plan is not fool-proof (and it won't be without a database), but I'd like to know if there's any other ways to make it stronger. The tags in question (Alien Higgs 3) do not have an onboard microcontroller or any other "smarts" with which to interpret data.