2 NFCSet of short-range, high frequency Radio Frequency Identity (RFID) data transmission standardsISO 14443, ISO 15693, ISO 18092Operating distance: 4 cm to 10 cmOperating Frequency: MHzData rates “of NFC radio”: 106 kbit/s, 212 kbit/s, 424 kbit/sCommunication between two devices:Initiator: E.g. ReaderTarget: E.g. TagNFC Forum defines:InteroperabilityNFC application specification
3 NFC data exchange principle Active Device (reader)Proximity coupling device (PCD)Connected to power sourceGenerates an electromagnetic field for data exchangePassive device (NFC tag)Proximity integrated circuit card (PICC)Harvest power from an Active deviceSource: Mifare® (14443A) MHz RFID Proximity Antennas
4 Active NFC device modes of operation Reader / Writer Mode (PCD, ISO 1443)Active device that transmits powerReads and modifies data stored in a passive tagE.g. Mobile phone reading smart posterCard Emulation Mode (PICC, ISO 14443)Acts like a passive targetInteracts with an external active readerE.g. Mobile phone used as a transport ticket, Google WalletPeer-to-peer Mode (ISO 18092)Both the initiator and target transmit powerEstablishes bi-directional data connectionE.g. A mobile phone exchanging a virtual business card with another mobile phone, Android Beam
6 NFC forum tag types Type 1 Tags Type 2 Tags Type 3 Tags Type 4 Tags Unique Identity4 or 7 bytes8 bytes7 bytesTransmission ProtocolISO 14443AISO 18092Memory Size96 bytes( up to 2 KB)64 bytes(up to 2 KB)Variable sizes(up to 1 MB)(up to 32KB)Memory Organization12 blocks,each of 8 bytes16 pages,each of 4 bytesBlocks,each of 16 bytesSmart card based.OTP bits48 bits32 bitsLock bits16 bitsRe-writableUntil lockedPre-definedIssuer-definedData collision protectionNoYesTransmission speed106 kbits/s212 kbits/s or 424 kbits/s106 kbits/s, 212 kbits/s, 424 kbits/sExamplesTopazUltralightFeliCa LiteJava cards, DESFire
7 Threats on memory tags Tag cloning Modification of tag data E.g. Foursquare check-in tags can be cloned to falsely claim that you have been at the location (to claim loyalty discounts)Can be prevented to some degree by calculating MAC that includes UID.Modification of tag dataCan be prevented by locking tag re-writeSwapping / replacing valid tagsE.g. Tags used to help purchase items from vending machines can be swapped so that when a customer tries to purchase an item from a vending machine, the immoral person waiting at the other vending machine gets the purchased item.
8 Example: Security on Type 2 tag (MIFARE Ultralight) Page addressByte Numbers00hUID0UID1UID2BCC001hUID3UID4UID5UID602hBICC1INTLOCK0LOCK103hOTP0OTP1OTP2OTP304hData0Data1Data2Data305hData4Data5Data6Data7….0FhData44Data45Data46Data47Bits7654321LOCK0L7L6L5L4L3BL 15-10BL 9-4BL OTPLOCK1L15L14L13L12L11L10L9L8Byte 0 – 9 : read onlyByte 10 – 15: One time programmable (OTP) bytes; Once a bit in an OTP byte is set, it cannot be reset back.L : Lock pageBL: Block lock, Once a BL bit is set the locking configuration for the corresponding page is unchangeable.
9 MIFARE Ultralight with NDEF data # Memory content: * 04:E4:91 F9 (UID0-UID2, BCC0) * CA:1A:26:80 (UID3-UID6) (BCC1, INT, LOCK0-LOCK1) . E1:10:06:00 (OTP0-OTP3) D D1 01 |....| |.U.a| C 74 6F |alto| . 2E FE |.fi.| |....| |....|[0A] |....|[0B] |....|[0C] |....|[0D] |....|[0E] |....|[0F] |....| *:locked & blocked, .:un(b)lockedOTP data E1:10:06:00 defines NDEF applicationFor detail on NDEF format, see NFC forum NFC Data Exchange Format (NDEF) Technical specification
10 NFC tag security Security mechanisms: Security assumptions: 7-byte Unique Identity (UID)One-time programmable bits: bits that can be set to one but not reset to zerocan be used as counterPages can be locked to prevent modificationSecurity assumptions:The UID cannot be cloned or spoofed !!!?When reading the tag, the UID and card content cannot be modified by the attacker (physical session integrity) !!!?Attacker can freely write data to the card, and interrupt sessions (tear card away from the reader)
11 No Cryptographic security included in the NFC Specs NFC transmission protocols do not define any specific encryption or security mechanismISO : Read/Write and Card Emulation modeISO 18092: Peer-to-peer modeNDEF specification defines signature scheme for integrity protectionDoes not prevents content cloning (signature does not cover the card UID)Does not include reader authentication for access controlTherefore, cryptographic security must be defined by the NFC application.
12 Contactless smart cards Memory tags with some security functionalityMIFARE Ultralight: UID, lock bytes, OTPUltralight C: triple-DES authenticationDESFire: Triple-DES / AES mutual authentication, file system with access control listsSmart cards with contactless interfaceCPU and operating systemTamper-resistant environmentSecure crypto-processorSecure file systemE.g. JavaCard, EMV contactless debit and credit cardsDistinction between memory cards and smart cards is not always clear cut
13 Relay Attack on NFCRelaying e.g. contactless EMV payments from your pocket to a faraway shopRequires card emulation on the proxy tokenDoes not require UID spoofing because EMV does not use the UIDSource: L. Francis, G. P. Hancke, K. E. Mayes, and K. Markantonakis. Practical Relay Attack on Contactless Transactions by Using NFC Mobile Phones. Cryptology ePrint Archive, Report 2011/618,
14 Frame Waiting Time (FWT) Frame sent by PCDFrame sent by PICCt < FWTTime
15 NFC reader and tag interaction PCDPICCREQAATQAAnti-collision loopUID + SAKRequest for Answer to Select (RATS)Answer To Select (ATS).. .Command APDUResponse APDU
16 FWT parameter FWI: Frame Waiting Time Integer Answer To Select (ATS)TLLength ByteT0Format ByteTAInterface BytesTBTCT1Historical Bytes(ISO/IEC )TkCRC 1CRC 2TBFWISFGIFWI: Frame Waiting Time IntegerSFGI: Start-up Frame Guard TimeFWT = (256 X 16 / fc) X 2 FWIFWTMin = 0: (256 X 16/ X 106) X 1 ≈ 303 μsFWT = 4: (256 X 16/ X 106) X 24 ≈ 4833 μsFWT = 8: (256 X 16/ X 106) X 28 ≈ 77 msFWTMax = 14: (256 X 16/ X 106) X 214 ≈ 4949 ms
17 Observation on Android Jelly Bean (4.1.2) MIFARE DESFire:default FWI = 0x8FWT = 77 msNexus S responded well beyond 77 ms (≈430ms)Changing FWI parameter doesn’t affect response timeWe assume fixed FWT implementationMax. latency for relay attack on Nexus S NFC reader is around 430 ms
18 NFC on mobile phones Integration of NFC in mobile phone is growing Nokia Lumia 610 and aboveNexus S and aboveSamsung Galaxy S II plus and aboveBlackBerry 10Many more
19 NFC support on phones Mostly Read/write and P2P mode Card Emulation is usually restrictedSome phone platform include Secure Element necessary for Card Emulation however public APIs are restrictedCurrently used applicationsNDEF tag read/writeFourSquare check-insSamsung TectTilesPotential NFC applications:Public transit ticketsMobile paymentLoyalty card
20 Threats on NFC phones Denial of Service attacks Mobile phone NFC stack reacts to any tag within its NFC rangeSome mal-formatted tags can jam the stackAlso, most of the card manager in SE blocks itself after 10 successive authentication failuresMalware delivery via NFCMobile OSs reads NDEF message and opens corresponding applicationE.g. NDEF with URL causes phone to open the URL in its default web browserNDEF with URL to malware download pageNFC message with malicious contentMalicious file over NFC to exploit android document viewer vulnerability NFC to execute Unstructured Supplementary Service Data (USSD) codes https://www.hkcert.org/my_url/en/blog/
21 NFC based financial application on phone Rely on security offered by the mobile phone platformSandboxesPermission based access controlShould protect against mobile malwaresIll intent of the phone userE.g. User may gain root access to modify ticket valueProtect against remote and local attackerEnsure the security even when the OS is compromised
22 Secure execution on mobile phone Isolate ExecutionExecution of a security-sensitive code in complete isolation from other codesEnsures integrity and run-time secrecy of application dataSecure StorageProtects stored data from unauthorized accessPasswords, secret keys, credentials etc.Remote AttestationRemotely verify authenticity of any particular application before interactionRoot of trust measurementDynamic root of trust measurement (DRTM)Secure ProvisioningSecurely deploying application module to a specific user device from a remote server over the airApplication migration from one device to anotherTrusted pathEnsures unaltered communication channel between the end pointsDirect physical connection between NFC front end controller and the isolated execution environment
23 Available Secure Elements Contactless stickersIndependent of the mobile phone OSElisa LompakkoUniversal Integrated Circuit Card (UICC)Preferred by Mobile Network OperatorsOrange Quick TapSecure MicroSDUsed by some banks in TaiwanEmbedded Secure ElementGoogle WalletProgrammable Trusted Execution EnvironmentOn-board Credential (ObC)Mobicore
24 Security Element Architecture, e.g. SIM Issuer SecurityDomainIssuer SecurityDomainThird Party SecurityDomainApplication FirewallApplication FirewallSIM appletCredit card AppletPublic-transportticketCard ManagerSIM is multi-application smart cardEach service provider creates a separate Security Domain on the cardProblems: increases the complexity of card manager; no support for over-the-air installation of new applets
25 Trusted Service Manager (TSM) Mobile NetworkOperator(MNO)Service ProvidersBankTSMPublic-transitAuthorityLoyalty…μSDSIMModel currently favored by network operators:Single trusted entity serving both MNO and Service ProvidersSecurely distributes and personalize the SP application to the customer’s SE over the air (OTA personalization).Verify user’s device and SE capabilities and resourcesManage life cycle of the applicationsEmbeddedSE
27 NFC Data Exchange Format (NDEF) NDEF MessageNDEF RecordNDEF RecordNDEF RecordHeaderPayloadNDEF is Message encapsulation format.Used to exchange messages between:NFC devices orAn NFC device and a tag.Contains one or more NFC application data as NDEF RecordHeader defines the properties of the Payload.Start and end of NDEF recordsRecord type definition (RTD): payload data typeLength of the payload etc.
28 Signature Record Type Definition NDEFRecord 1NDEFRecord 2Empty NDEFSignature Record 1NDEFRecord 3NDEFSignature Record 2Signed recordsSignature for record1 & 2Signed recordSignature only for record 3Provides integrity and authenticitySignature RTD contains:Signature,RSA (1024) with SHA-1 and PKCS#1 v 1.5 padding or PSSECDSA (P-192) with SHA-1 with no padding.Certificate chain.Or, reference location to the signatureSignature Record apply forall preceding records, (from record 1) or,Record following the preceding Signature record.VulnerabilityCloning, replacing a tag with another valid tag
29 Tag UID based NFC applications Simple Access control application based on tag UIDNFC tags is used as credential to identify the userReader must be connected to a backend databaseBackend server maintains access policiesPros:Simple and cheap solution“UID cannot be faked easily”Suitable for small scale businessCons:Backend complexity increases with the number of customersReaders needs to be connected to the backend server all the time.
30 Event Ticketing One time or limited use tags MIFARE UltralightReader implements cryptographic functionalityKey diversification – e.g. Hash(UID + Master key)Encrypts data and store the cipher-text on tags.Reads the cipher-text from tags and decrypts data.Use of OTP bytes as incremental counterUse Lock bytes to prevent rewriteMAC for integrity protection
31 Public transit application Proprietary solutions are widely usedMIFARE ClassicMIFARE DESFire EV1Uses Symmetric cryptoTriple-DES, AESValue is stored on the cardStandardsITSO: Interoperable public transport ticketing using contactless smart customer media.
32 Open Payment Ticketing Smart Card Alliance proposal for NFC ticketingEach traveler has a travel account in a server cloud, which is operated by a service provider (SP)Travel card only stores user’s identity and credentialsUser identity is verified by a reader at the station gateTicket identity and travel information sent to a backend serverThe backend server calculates the ticket fare and forwards the information to SP for payment collectionPayment is collected by SPAllows credentials from different SPs to be usedE.g. Bank cards, SIM card, National ID etc.
33 Open Payment Ticketing with Mobile Phone Fare Calculation ServiceTransport AuthorityService Provider (accounting authority)NFCTransport AuthorityOperates transport systemCalculate the fare calculation based on the ID and traveling distanceCollects ticketing evidence for auditingService provider (e.g. bank or mobile operator)Manages the customer relationship and travel account; issues the travel credentialsCollects evidence directly from phones and from Transport Authority for auditingCollets payment from the customer (prepaid or credit)
34 Identity Verification in Open Payment DeviceReaderDeviceReaderChallenge || IDRChallenge || IDRCertD (PKD || IDD||…)Fresh TokenMACK [Challenge || IDD||IDR]SigD[Challenge ||IDD||IDR]Faster secret-key protocol:Reader and SP share a secret keyPhone fetches fresh token from SP over the Internet before travelingReader verifies the fresh token with its keyExchange of data < 100BMAC verification by SP for additional auditing; not done in real timeChallenge-response protocol:User Verification at the gateExchange of data > 1KBAuthentication time is around 1 sec with current NFC data speed
35 Mobile NFC Payment: Google Wallet First Generation Google Wallet (no longer in use)Secure Element in the phone stores credit-card informationEmbedded secure element on PN65 NFC board in Google phonesCan store more than one credit cardMobile phone acts as a credit card when presented to a payment terminalNFC card emulation modePayment protocol is controlled by wallet applet running inside the secure elementApplication running in user space provides interfaces forPIN entry, selection of credit card, displaying payment informationGoogle acted as the TSM and distributed credit card applets to the phones
36 Mobile NFC Payment: Google Wallet Second Generation Google WalletUser’s credit card or bank account information is stored by Google in the cloudSecure element on the phone stores a virtual payment card identityDuring payment, user selects payment card or bank from the application on his phoneThe virtual card is presented to the point-of-sale terminalGoogle collects the payment from user’s credit card or bank account and makes the payment to the merchantPayment terminal needs to be modified to support this service
37 Additional readingNFC Data Exchange Format (NDEF) Technical SpecificationMadlmayr, G.; Langer, J.; Kantner, C.; Scharinger, J.; , "NFC Devices: Security and Privacy," Availability, Reliability and Security, ARES 08. Third International Conference on , vol., no., pp , 4-7 March 2008 doi: /ARESL. Francis, G. P. Hancke, K. E. Mayes, and K. Markantonakis. Practical Relay Attack on Contactless Transactions by Using NFC Mobile Phones. Cryptology ePrint Archive, Report 2011/618,