1. Mifare Classic Troubles
Peter van Rossum
Digital Security
Radboud University Nijmegen

2. Mifare Classic

3. RFID Technology Reader to tag signal Dropping field
Modified Miller Encoding
Tag to reader signal
Modulating field
Manchester Encoding

4. RFID Applications Identify friend or foe (1942) Car keys Electronic
passport
Public transport
ticketing
RFID Powder
Access control
Supply chain
management
Anti-theft
Event ticketing

5. Many standards for RFID
Mifare Classic
Many standards for RFID
ISO14443A: Mifare (NXP)
ISO14443B: CryptoRF (Motorola/Atmel)
ISO14443C: Felica (Sony)
ISO14443D: (OTI)
ISO14443E: (Cubic)
ISO14443F: Legic (KABA)
ISO15693: Tag-IT (Texas Instruments)
Typically describe physical and data-link layers (not cryptographic features)

6. Many chips in the Mifare (ISO14443A) family
Mifare Classic
Many chips in the Mifare (ISO14443A) family
Mifare Ultralight
Mifare Classic
Mifare DESFire
Mifare Plus
Mifare EV1
Mifare SMART MX
Most popular: Mifare Classic
over 1 billion sold
over 200 million in use
80% of contactless smartcard market

7. Mifare Classic Applications
Public transport ticketing systems
Access control
Wireless payment systems

8. RFID Security RFID = Radio Frequency Identification
More properly authentication
Contactless smartcards
data storage, computational capabilities
confidentiality
integrity
Common RFID Attacks
Relay attack
Replay attack
Cryptanalytic attack
Side-channel attack
Tracing attack …
Mifare Classic is vulnerable to all of these.

9. 1. RFID – Relay Attack ? ! ! ? ? ! Wireless communication
No link between authenticating object (tag) and service receiver (tag holder)‏
Attacker A initiates service
Attacker A relays queries to tag to attacker B
Attacker B sends queries to victim’s tag
Attacker B relays answers back to attacker A
Attacker A answers queries

10. 2. RFID – Replay Attack Attack Vulnerabilities
No clock
Weak randomness
Attack
Attacker intercepts communication tag - reader
Attack replays later
Countermeasures (standard)
Challenge-response authentication (needs clock, randomness, or other form of “freshness”)‏
Parking at Radboud University
Access control: wireless employee card
No authentication protocol at all
Card sends uid; back-end checks
authorization
Attack
Eavesdrop signal from car (card) to barrier
Replay signal to gain entry
(only works when original car has left; better
to eavesdrop signal from a departing car)

11. 3. RFID – Side-channel attacks
Attacker controls tag
Use side-channels (timing, power, …)
Recover secret information from tag

12. 4. RFID – Crypto Attacks Low energy Low computational capacity
Cheap to manufacture
Fast enough to operate
Weak cryptography
Attacker can break encryption scheme

13. 5. RFID – Tracing Attack Used for identification
Anti-collision phase sends uid
Attacker can recognize people based on the RFID tags they are carrying
Attacker could trace RFID enabled packages

14. Common RFID Attacks - Summary
No clock, weak randomness
replay attacks
Low computational capacity
cryptanalytic attacks
Attacker controls tag
side-channel attacks
Wireless
relay attacks
Used for identification
tracing attacks

15. Timeline
Jun 06 RU
Start of development of Ghost for ISO A (Mifare) emulation
Nov 07
Functional ISO14443-A (Mifare) emulation
Dec 07
CCC, VA
Presentation: reverse engineered encryption of Mifare Classic: CRYPTO1
Feb 08
Media report: cloning Mifare Ultralight (single-use OV-chipkaart)
TNO
Report on OV-chipkaart: fraud unlikely, advanced equipment needed, 2 year respite
Mar 08
Reverse engineered CRYPTO1 & authentication protocol
Key recovery using intercepted traffic or communication with reader
Apr 08
RHUL
Report on OV-chipkaart: fraud likely, replace cards, design open&modular
Jun 08
NXP
Lawsuit against RU to stop publication
Jul 08
Court
Publication allowed: potential damage due to flaws in chip, not publication
Oct 08
Publication at ESORICS
Nov 08
Card-only key recovery of Mifare Classic
Dec 08
Attack possible using commercially available (cheap) NFC hardware

16. Timeline 2004 Fudan Sale of fully functional Mifare Classic clones
2006
Angstrom
(Rumour) Mifare Classic reverse engineered and CRYPTO1 broken
Jun 06 RU
Start of development of Ghost for ISO A (Mifare) emulation
Nov 07
Functional ISO14443-A (Mifare) emulation
Dec 07
CCC, VA
Presentation: reverse engineered encryption of Mifare Classic: CRYPTO1
Feb 08
Media report: cloning Mifare Ultralight (single-use OV-chipkaart)
TNO
Report on OV-chipkaart: fraud unlikely, advanced equipment needed, 2 year respite
Mar 08
Reverse engineered CRYPTO1 & authentication protocol
Key recovery using intercepted traffic or communication with reader
Apr 08
RHUL
Report on OV-chipkaart: fraud likely, replace cards, design open&modular
Jun 08
NXP
Lawsuit against RU to stop publication
Jul 08
Court
Publication allowed: potential damage due to flaws in chip, not publication
Oct 08
Publication at ESORICS
Nov 08
Card-only key recovery of Mifare Classic
Dec 08
Attack possible using commercially available (cheap) NFC hardware

17. Memory structure uid, manufacturer data 1 data 2 data 3
uid, manufacturer data 1
data 2
data 3
key A, access conditions, key B 4
data 1 5
data 6
data
64 blocks
16 sectors 7
key A,access conditions, key B 60
data 15 61
data 62
data 63
key A, access conditions, key B
48 bits
48 bits
16 bytes

18. CRYPTO1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47
26c7
0dd3
0dd3
26c7
0dd3
4457c3b3
Feedback:
L(x0,x1,…,x47) := x0+x5+x9+x10+x12+x14+x15+x17+x19+x24+x25+x27+x29+x35+x39+x41+x43
LFSR stream:
ai+48 := L(ai,ai+1,…,ai+47) ∀i∈ℕ
Keystream:
bi := f(ai+9,ai+11,…,ai+47) ∀i∈ℕ
(Actually a bit more complicated
because of the initialization)

19. CRYPTO1: random number generator1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
32 bit nonces
Linear feedback shift register
16 bit internal state
Period 216 – 1 = 65535
Feedback:
L16(x0,x1,…,x15) := x0+x2+x3+x5
Successor:
suc(x0,x1,…,x31) := (x1,x2,…,x30,L16(x16,x17,…,x31))
Distance:
d((x0,x1,…,x31)(y0,y1,…,y31)) := min { n ∈ ℕ | sucn(x0,x1,…,x31) = (y0,y1,…,y31) }

20. Authentication & initialization
Tag
Reader
uid
auth(block)
pick nT nT
LFSR stream:
Initial state of the LFSR is the key
ai := ki i ∈ [0,47]
Shift nT + uid into the LFSR
ai+48 := L(ai,…,ai+47) + nTi + uidi i ∈ [0,31]
Shift nR into the LFSR
ai+48 := L(ai,…,ai+47) + nRi i ∈ [32,63]
After authentication, LFSR keeps shifting
ai+48 := L(ai,…,ai+47) i ∈ [64, ∞)
Keystream:
bi := f(ai+9,ai+11,…,ai+47) i ∈ [32, ∞)
pick nR
aR:=suc64(nT)
{nR,aR}
check aR
aT:=suc96(nT)
{aT}
check aT
auth. ok
auth. ok

21. Mifare Classic: trace Step Sender Ciphertext Plaintext Meaning 01 R 26
request type A 02 T
04 00
answer request 03
93 20
select 04
2a 69 8d 43 8d
uid 05
a 69 8d 43 8d
select(uid) 06
08 b6 dd
Mifare Classic 1k 07
60 04 d1 3d
auth(block 4) 08
3b ae 03 2d
tag nonce (nT) 09
c4 94 a1 d2 6e
bb 03 1f 2d 7f cf 34 c3
rdr nonce (nR) & resp (aR) 10 e
86 9d bb d5
tag response (aT) 11
7d de a6 b3
30 04 cd d1
read(block 4) 12
e7 ee e3 ab 0f 89 bb ed 44 b1 91 ce ef 8a 4d ce
cd ea
contents

22. Inverting the filter function
Attacking CRYPTO1
Unshifting the LFSR
internal state at any time  key
Inverting the filter function
keystream  internal state
computational complexity: approx. 226 operations (seconds)
Acquiring keystream
observing authentication  keystream
communication complexity: 1 to 3 auth. sessions (micro seconds)

23. CRYPTO1: unshifting the LFSR
Feedback:
L(x0,x1,…,x47) := x0+x5+x9+x10+x12+x14
+x15+x17+x19+x24+x25+x27+x29+x35+x39
+x41+x43
LFSR stream:
Initial state of the LFSR is the key
ai := ki i ∈ [0,47]
Shift nT + uid into the LFSR
ai+48 := L(ai,…,ai+47) + nTi + uidi i ∈ [0,31]
Shift nR into the LFSR
ai+48 := L(ai,…,ai+47) + nRi i ∈ [32,63]
After authentication, LFSR keeps shifting
ai+48 := L(ai,…,ai+47) i ∈ [64, ∞)
Keystream:
bi := f(ai+9,ai+11,…,ai+47) i∈ℕ
Inverting feedback:
R(x1,…,x47,x48) := x5+x9+x10+x12+x14
+x15+x17+x19+x24+x25+x27+x29+x35+x39
+x41+x43+x48
R(x1,…,x47,L(x0,x1,…,x47)) = x0
Inverting LFSR stream:
Unshift LFSR until end of authentication
ai = R(ai+1,…,ai+48) i ∈ [64, ∞)
Unshift nR from the LFSR
ai = R(ai+1,…,ai+48) + nRi i ∈ [32,63]
= R(ai+1,…,ai+48) + {nR}i-32 + bi
= R(ai+1,…,ai+48) + {nR}i-32 + f(ai+9,…,ai+47)
Unshift nT + uid from the LFSR
ai = R(ai+1,…,ai+48) + nTi + uidi i ∈ [0,31]
Key is the initial state of the LFSR
ki = ai i ∈ [0,47]

24. CRYPTO1: inverting the filter function# # # # # # # # # # # # # # # # # # # #
keystream:
#################### …
produces ‘odd’ keystream 0
# ################### # …
produces ‘odd’ keystream 01
## ################## # …
produces ‘odd’ keystream 010
219
Filter function can be easily inverted because the input to the filter function f
are only on odd places
Attack options:
Compute ‘odd’ bits of LFSR using table and deduce ‘even’ bits (linear relation)
Compute ‘odd’ and ‘even’ bits of LFSR using tables separately and combine tables

25. CRYPTO1: acquiring keystream
Tag
Reader
Intercepted communication:
nT, {aR}, {aT} visible to attacker
{aR} + suc64(nT), {aT} + suc96(nT)
64 keystream bits
invert f, roll back LFSR, recover key
Access to genuine reader:
nT under attacker control
{aR} + suc64(nT) visible to attacker
32 keystream bits
invert f, 216 possible LFSRs
roll back LFSRs, 216 candidate keys
(repeat and take intersection)
uid
auth(block)
pick nT nT
pick nR
aR:=suc64(nT)
{nR,aR}
check aR
aT:=suc96(nT)
{aT}
check aT
auth. ok
auth. ok

26. Weaknesses simple LFSR structure 48 bit internal state, stream cipher
enables brute force attack
weak 16-bit random number generator
enables chosen plaintext attack & replay attack
simple LFSR structure
enables unshifting the internal state to recover key
weak filter function
enables inverting the one-way function function
64 bits keystream  unique key
32 bits keystream  216 candidate keys
authentication protocol leaks keystream
consequences (march 2008)
intercepted communication can (quickly) be decrypted
key (of first sector read) can be recovered from just a reader
(access to just a tag not sufficient)

27. CRYPTO1: (in)security

28. Parity trouble Weaknesses: Parity computed over plaintext
Keystream
Ciphertext
Weaknesses:
Parity computed over plaintext
Parity encrypted
Parity encrypted using same bit of keystream that encrypts next bit of plaintext
During authentication, parity is checked before authenticity
No response when parity check fails; {NACK} when authenticity fails
Note:
Not compliant with ISO Type A
To emulate Mifare Classic with NFC chip, use raw Mifare mode and do parity yourself

29. Parity trouble Tag Attacker uid auth(block) pick nT nT pick {nR}
(Encrypted) parity checked continuously
Parity wrong  tag resets
Parity in {nR,aR} checked before aR
Parity correct and aR wrong  4 bit {NACK}
Error message is encrypted
Card-only Attack
Send 64 random bits for {nR,aR} (and random parity)
(½)8 = 1/256 probability of guessing parity correctly
Correct guess leaks 12 bits of information
Options:
Brute force
Adaptive chosen ciphertext attack (vary {nR})
Chosen plaintext attack (vary nT)
[Courtois] Differential attack (vary {nR})
Attacker only needs access to a card!
Note
Russian/Chinese Mifare clones
do not check parity
always send {NACK}
Classic compatibility mode of Mifare Plus
does not check parity
does not send {NACK}
(fixed after we notified NXP of these problems)
Tag
Attacker
uid
auth(block)
pick nT nT
pick {nR}
pick {aR}
{nR,aR}
check aR
{NACK}
auth. failed

30. Chosen Plaintext Attack
Precompute
T := { states a32 a33 … a79 | if reader sends
{nR} = {aR} = 0 then corresponding 8 encrypted
parity bits are 0 and 4 next keystream bits are 0}
|T| ≈ 248/212 = 236 (storage: 384 GB)
Attack
Search (online) for nT such that sending all 0’s
for {nR}, {aR} and the parity bits results in
{NACK} = NACK (i.e. 4 keystream bits 0).
Search (offline) in T:
Compute candidate key using nT and uid
Check key (offline)
Improvements
More tables, one for each possibility of {NACK}.
Sort table(s) by correct parity and {NACK}
when sending all 1’s for {nR}, {aR}
Tag
Attacker
uid
auth(block)
pick nT nT
{nR},{aR} = 0,0
check aR
{NACK}
auth. failed

31. Online vs. offline order of magnitude
NXP/System Integrators: “impossible to execute real-time”
Offline
brute
force
1536 authentication attempts
248 offline search space
days
NXP/System Integrators: “lab-conditions required to fix nT”
adaptive
chosen ciphertext
(vary {nR})
150 authentication
attempts with same nT
220 offline search space
chosen plaintext
(vary nT)
min
28500 authentication attempts
with same nT
232.8 offline search space
differential attack
[Courtois] (vary {nR})
4096 authentication attempts
128 authentication attempts
with fixed nT
224 offline search space in
one-time precomputed 384GB table
intercepted
communication s
2 or 3 authentications
220 offline search space
NXP/System Integrators: “Difficult to execute in real-life” ms s
min h
Online

32. Even faster? One key known already
Tag
Reader
uid
auth(block)
pick nT nT
LFSR stream:
Initial state of the LFSR is the key
ai := ki i ∈ [0,47]
Shift nT + uid into the LFSR
ai+48 := L(ai,…,ai+47) + nTi + uidi i ∈ [0,31]
Shift nR into the LFSR
ai+48 := L(ai,…,ai+47) + nRi i ∈ [32,63]
After authentication, LFSR keeps shifting
ai+48 := L(ai,…,ai+47) i ∈ [64, ∞)
Keystream:
bi := f(ai+9,ai+11,…,ai+47) i ∈ [32, ∞)
pick nR
aR:=suc64(nT)
{nR,aR}
check aR
aT:=suc96(nT)
{aT}
check aT
auth. ok
auth. ok

33. Reauthentication & initialization
Tag
Reader
{auth(block)}old key
pick nT
{nT}
LFSR stream:
Initial state of the LFSR is the key
ai := ki i ∈ [0,47]
Shift nT + uid into the LFSR
ai+48 := L(ai,…,ai+47) + nTi + uidi i ∈ [0,31]
Shift nR into the LFSR
ai+48 := L(ai,…,ai+47) + nRi i ∈ [32,63]
After authentication, LFSR keeps shifting
ai+48 := L(ai,…,ai+47) i ∈ [64, ∞)
Keystream:
bi := f(ai+9,ai+11,…,ai+47) i ∈ ℕ
pick nR
aR:=suc64(nT)
{nR,aR}
check aR
aT:=suc96(nT)
{aT}
check aT
auth. ok
auth. ok

34. CRYPTO1: reauthentication & initialization
Tag
Attacker
Weaknesses
nT predictable based on
only 216 possiblities
parity bits (reduces to 213 possibilities)
timing (reduces to 1 to 5 possibilities)
weak cipher (as before)
Attack
authenticate for one sector using known key
try to reauthenticate for other sector
guess nonce and compute 32 keystream bits
use weaknesses in cipher to compute
(1 to 5 times) approx. 216 candidate keys
repeat two or three times and take intersection
Note
compatibility mode of Mifare Plus
uses better (32-bit) random number gen
(attack fails)
some Mifare Classics are Mifare Smart MX
emulating a Mifare Classic
uses better (16-bit) random number gen
(timing information not available)
{auth(block)}old key
pick nT
{nT}

35. Summary of further weaknesses
weak random number generator sync with time
enables chosen plaintext attack
reader nonces determine 32 bits of the internal state
enables chosen ciphertext attack against card
mixing of data link and encryption layers
one-time pad used twice: information leakage
encrypted error message sent when authentication fails
4-bit information leakage
tag nonce sent encrypted when authenticating twice
32-bit information leakage (when one key already known)
consequences (november 2008)
keys can be recovered from just a card
card can be wirelessly cloned directly

36. Online vs. offline order of magnitude
brute
force
1536 authentication attempts
248 offline search space
days
adaptive
chosen ciphertext
(vary {nR})
150 authentication
attempts with same nT
220 offline search space
chosen plaintext
(vary nT)
min
28500 authentication attempts
with fixed nT
232.8 offline search space
differential attack
[Courtois] (vary {nR})
4096 authentication attempts
128 authentication attempts
with fixed nT
224 offline search space in
one-time precomputed 384GB table
intercepted
communication/
known old
key s
2 to 5 authentication attempts
220 offline search space ms s
min h
Online

37. What to do? Strategy RU: responsible disclosure
02/08: Warning (to NXP, government): additional measures
needed; minister of internal affairs made problems public
Only claim what we can actually demonstrate
10/08: Publication after delay of 7 months; full details
10/08 – 03/09: Repeat for card-only attack
Strategy NXP: damage control
03/08: Customer chooses cheapest chip
07/08: Publication irresponsible
10/08: Don’t use Classic for new applications
03/09: Lab conditions needed (for ‘immediate’ attack)
Strategy system integrators (TLS, TFL, …): protect investment
03/08: Attack not feasible
07/08: Fraud detected in back-end; no fraud detected so far
10/08: No criminal business case

38. “No Criminal Business Case’’?
Attack scenarios
Loyalty scheme attack (bus)
micro-waved OV-chipkaart
OV-chipkaart with wrong keys
Checking out (bus)
too soon
too late
State-modification attacks
Store/restore state (detected in back-end?)
Increase balance (detected in back-end?)
Add travel products (detected in back-end?)

39. “No Criminal Business Case’’?
Attack scenarios (more speculative)
Wirelessly clone cards
Travel on someone else’s card (detected in back-end?)
Generate new cards (and sell them)
On ‘white’ cards
On ‘unactivated’ or empty cards
Steal reader
Recover key diversification
by side-channel analysis
by brute force
Easy wireless cloning of cards (detected in back-end?)
Easy generation of new cards (detected in back-end?)

40. “No Criminal Business Case”?

41. “No Criminal Business Case?’’
Questions?

42. References
De Koning Gans, Hoepman, Garcia. A Practical Attack on the Mifare Classic. CARDIS LNCS pp
Nohl, Evans, Starbug, Plotz. Reverse-Engineering a Cryptographic RFID Tag. USENIX Security pp
Courtois, Nohl, O’Neil. Algebraic Attacks on the Crypto-1 Stream Cipher in Mifare Classic and Oyster Cards. ePrint 2008/166.
Garcia, De Koning Gans, Muijrers, Van Rossum, Verdult, Wichers Schreur, Jacobs. Dismantling Mifare Classic. ESORICS LNCS pp
Teepe. Making the best of Mifare Classic
Garcia, Van Rossum, Verdult, Wichers Schreur. Wirelessly Pickpocketing a Mifare Classic Card. IEEE S&P pp 3-15.
Courtois. The Dark Side of Security by Obscurity and Cloning Mifare Rail and Building Passes Anytime, Anywhere. SECCRYPT 2009.