Cryptography Reference
In-Depth Information
Since secret keys of Mifare Classic cards and Mifare DESFire cards can be
extracted by means of mathematical cryptanalysis and side-channel analysis, re-
spectively, our emulator poses a severe threat for many commercial applications,
if it was used by a criminal. To demonstrate the capabilities of our findings we
perform several real-world attacks, amongst others on a contactless payment sys-
tem. We emulate exact clones (including the UID) of Mifare cards, successfully
spoofed an access control system and carried out payments. Furthermore, we
implemented a mode of operation in which our emulator appears as a new card
with a new UID and new content on every payment, which hinders detection of
fraud in the backend.
With contactless payment, ticketing and access control systems being om-
nipresent today, it is crucial to realize that only strong cryptography, together
with sound protocol design and protection against implementation attacks can
ensure long-term security. Bug-fixes for broken systems based on false assump-
tions on certain device characteristics, e.g., UID-based protection schemes for
Mifare Classic, are a fatal design choice, as we demonstrate that exact cloning
ofcardsisfeasibleataverylowcost.
References
1. Atmel. ATmega32 Data Sheet,
2. Atmel. ATxmega192A3 Data Sheet,
3. Atmel. AVR XMEGA A Manual,
4. Carluccio, D.: Electromagnetic Side Channel Analysis for Embedded Crypto De-
vices, Diplomarbeit, Ruhr-University Bochum (March 2005)
5. Courtois, N.: The Dark Side of Security by Obscurity and Cloning Mifare Classic
Rail and Building Passes, Anywhere, Anytime. In: SECRYPT 2009, pp. 331-338.
INSTICC Press (2009)
6. Crapto1. Open Implementation of Crypto1 (2008),
7. de Koning Gans, G., Hoepman, J., Garcia, F.: A Practical Attack on the MIFARE
Classic. In: Grimaud, G., Standaert, F.-X. (eds.) CARDIS 2008. LNCS, vol. 5189,
pp. 267-282. Springer, Heidelberg (2008)
8. Federal Oce for Information Security, Germany. Advanced Security Mechanisms
for Machine Readable Travel Documents - Extended Access Control,
9. Future Technology Devices International Ltd. FT245R Datasheet,
10. Garcia, F., de Koning Gans, G., Muijrers, R., Van Rossum, P., Verdult, R., Schreur,
R., Jacobs, B.: Dismantling MIFARE Classic. In: Jajodia, S., Lopez, J. (eds.) ES-
ORICS 2008. LNCS, vol. 5283, pp. 97-114. Springer, Heidelberg (2008)
11. Garcia, F., van Rossum, P., Verdult, R., Schreur, R.: Wirelessly Pickpocketing a
Mifare Classic Card. In: Symposium on Security and Privacy, pp. 3-15. IEEE, Los
Alamitos (2009)
Search WWH ::
Custom Search