Wirelessly Pickpocketing a Mifare Classic Card

Abstract

The Mifare Classic is the most widely used contactless smartcard on the market. The stream cipher CRYPTO1 used by the Classic has recently been reverse engineered and serious attacks have been proposed. The most serious of them retrieves a secret key in under a second. In order to clone a card, previously proposed attacks require that the adversary either has access to an eavesdropped communication session or executes a message-by-message man-in-the-middle attack between the victim and a legitimate reader. Although this is already disastrous from a cryptographic point of view, system integrators maintain that these attacks cannot be performed undetected. This paper proposes four attacks that can be executed by an adversary having only wireless access to just a card (and not to a legitimate reader). The most serious of them recovers a secret key in less than a second on ordinary hardware. Besides the cryptographic weaknesses, we exploit other weaknesses in the protocol stack. A vulnerability in the computation of parity bits allows an adversary to establish a side channel. Another vulnerability regarding nested authentications provides enough plaintext for a speedy known-plaintext attack.

When Reverse-Engineering Meets Side-Channel Analysis – Digital Lockpicking in Practice

“…Most of these have in common that they turn out to be insecure from a cryptanalytical perspective once the secret protocols and algorithms have been reverse-engineered. Today most security products used for access control, such as Texas Instrument's Digital Signature Transponder (DST) [5], NXP's Mifare Classic cards [7,10], Hitag 2 transponders [21], and Legic Prime [17], have something in common: Mathematical attacks emerging from cryptographic weaknesses enable to break their protection in minutes. For systems with a higher level of mathematical security, several examples of real-world side-channel attacks have demonstrated a huge attack potential: The 112-bit secret key of the Mifare DESfire MF3ICD40 smartcard (based on the 3DES cipher) can be extracted with Electro-Magnetic (EM)-based Side Channel Analysis (SCA) [16].…”

Fuming Acid and Cryptanalysis: Handy Tools for Overcoming a Digital Locking and Access Control System

“…Likewise, following the reverse-engineering of NXP's Mifare Classic cards [2] through analyzing the silicon die, the used Crypto1 cipher was found to be weak, relying on a state of only 48 bits. Further mathematical weaknesses of the cipher and implementations flaws, e. g., a weak random number generator, enable to reveal all secret keys and practically circumvent the protection mechanisms with a card-only attack in minutes [3][4][5]. The Hitag 2 transponders of the same manufacturer, widely used for car immobilizers-but also for RKE systems-were found to be flawed after the cipher became public [6].…”

Chameleon: A Versatile Emulator for Contactless Smartcards

“…A method to recover a secret sector key is proposed in [10], requiring two recorded genuine authentications to one sector. The most powerful attacks are card-only attacks as presented in [11] and [5]. They exploit amongst others the weakness that a card sends an encrypted NACK (0x5) each time the parity bits of the message n R ⊕ ks 1 || a R ⊕ ks 2 are correct but the decrypted a R is not (cf.…”