RFID applications create a need for low-cost security and privacy in potentially hostile environments. To accomplish these goals of security and privacy, static identifiers and random numbers are required. Motivated by cost constraints, this thesis explores generating both identifiers and random numbers from existing CMOS circuitry, using a system of Fingerprint Extraction and Random Numbers in SRAM (FERNS). The identity results from the impact of manufacture-time physically random device threshold mismatch on the initial state of SRAM, and the randomness results from the impact of run-time physically random noise. FERNS is supported by an analytical model of the relative impacts of process variation and noise, and by experimental data from virtual tags, microcontroller memory, and the WISP UHF passive RFID tag. It is shown that virtual tags can be uniquely identified amongst a population of 160 using less than 50 bits of SRAM with an efficient matching algorithm. It is shown that a 128 bit true random number capable of passing statistical tests can be extracted from 256 bytes of SRAM. Based on these results and the observation that FERNS is well suited to passive applications, we conclude that FERNS is a viable approach to both identification and true random number generation in RFID tags.