RFID tag and reader authentication by trusted authority

A Radio Frequency Identification (RFID) reader containing a reader key authenticates an RFID tag containing a tag key by receiving a reader challenge from a verification authority; determining a reader response based at least on the reader challenge and the reader key; sending a first message including at least the reader response but not the reader key to the verification authority; receiving a tag identifier from the tag; challenging the tag with a tag challenge; receiving a tag response based at least on the tag challenge and the tag key but not including the tag key; sending a second message including at least the tag identifier and the tag response to the verification authority; and receiving an electronically-signed reply from the verification authority. The reader validates the verification authority reply by checking the signature. The verification authority may notify a designated party if a response is incorrect.