Dismantling MIFARE Classic

Abstract

Abstract.The mifare Classic is a contactless smart card that is used extensively in access control for office buildings, payment systems for public transport, and other applications. We reverse engineered the security mechanisms of this chip: the authentication protocol, the symmetric cipher, and the initialization mechanism. We describe several security vulnerabilities in these mechanisms and exploit these vulnerabilities with two attacks; both are capable of retrieving the secret key from a genuine reader. The most serious one recovers the secret key from just one or two authentication attempts with a genuine reader in less than a second on ordinary hardware and without any pre-computation. Using the same methods, an attacker can also eavesdrop the communication between a tag and a reader, and decrypt the whole trace, even if it involves multiple authentications. This enables an attacker to clone a card or to restore a real card to a previous state.

A survey of secure middleware for the Internet of Things

“…The designers created their own cryptographic approach and encryption algorithms. Security researchers used a number of techniques to break the obscurity, decode the algorithm, find flaws in it and create a hack that allowed free transport in London as well as breaking the security on a number of military installations and nuclear power plants (Garcia et al, 2008). Similarly, relying on the security of a device to protect a key that is used across many devices is a significant error.…”

Architecture Is Politics: Security and Privacy Issues in Transport and Beyond

“…Its security depends on a proprietary authentication protocol and stream cipher using keys of only 48 bits long. In the beginning of 2008 it became clear that the card was broken [10,9,6,3,4] and that its content (esp. its balance) can be accessed and changed within a matter of seconds.…”

“…The Digital Security Group of the Radboud University Nijmegen had to deal with this question because of its research into Mifare Classic chipcards [6,3,4]. It has decided to speak openly about the security vulnerabilities, which in the end involved standing up to legal intimidation and defending its right to publish freely in court, see [2] for a brief account.…”

Efficient E-Cash in Practice: NFC-Based Payments for Public Transportation Systems

“…For the transportation authority a further advantage of electronic payments is that they enable the collection of meaningful data about customer behavior which helps to maintain and improve the system. However, currently employed electronic public transportation payment systems have suffered security attacks [20,3], and they do not incorporate means to protect the user's (locational) privacy. For example it is reported that "in the period from August 2004 to March 2006 alone, the Oyster system was queried 409 times" [31], which shows that location data about customers is collected and stored and later used by other agencies.…”