MIFARE Classic family

The MIFARE Classic IC is just a memory storage device, where the memory is divided into segments and blocks with simple security mechanisms for access control. They are ASIC-based and have limited computational power. Due to their reliability and low cost, those cards are widely used for electronic wallets, access control, corporate ID cards, transportation or stadium ticketing. It uses an NXP proprietary security protocol (Crypto-1) for authentication and ciphering.^{[citation needed]}

MIFARE Classic encryption has been compromised; see below for details.^{[citation needed]}

The MIFARE Classic with 1K memory offers 1,024 bytes of data storage, split into 16 sectors; each sector is protected by two different keys, called A and B. Each key can be programmed to allow operations such as reading, writing, increasing value blocks, etc. MIFARE Classic with 4K memory offers 4,096 bytes split into forty sectors, of which 32 are the same size as in the 1K with eight more that are quadruple size sectors. MIFARE Classic Mini offers 320 bytes split into five sectors. For each of these IC types, 16 bytes per sector are reserved for the keys and access conditions and can not normally be used for user data. Also, the very first 16 bytes contain the serial number of the card and certain other manufacturer data and are read-only. That brings the net storage capacity of these cards down to 752 bytes for MIFARE Classic with 1K memory, 3,440 bytes for MIFARE Classic with 4K memory, and 224 bytes for MIFARE Mini.^{[citation needed]}

Parts of this article (those related to smartphone types) need to be updated. (December 2013)

The Samsung TecTile NFC tag stickers use MIFARE Classic chips. This means only devices with an NXP NFC controller chip can read or write these tags. At the moment BlackBerry phones, the Nokia Lumia 610 (August 2012^[6]), the Google Nexus 4, Google Nexus 7 LTE and Nexus 10 (October 2013^[7]) can't read/write TecTile stickers.^{[citation needed]}

MIFARE Plus family

MIFARE Ultralight family

MIFARE DESFire family

MIFARE SAM AV2

MIFARE SAMs are not contactless smart cards. They are secure access modules designed to provide the secure storage of cryptographic keys and cryptographic functions for terminals to access the MIFARE products securely and to enable secure communication between terminals and host (backend). MIFARE SAMs are available from NXP in the contact-only module (PCM 1.1) as defined in ISO/IEC 7816-2 and the HVQFN32 format.^{[citation needed]}

Integrating a MIFARE SAM AV2 in a contactless smart card reader enables a design that integrates high-end cryptography features and the support of cryptographic authentication and data encryption/decryption.^{[citation needed]} Like any SAM, it offers functionality to store keys securely and perform authentication and encryption of data between the contactless card and the SAM and the SAM towards the backend. Next to a classical SAM architecture, the MIFARE SAM AV2 supports the X-mode which allows a fast and convenient contactless terminal development by connecting the SAM to the microcontroller and reader IC simultaneously.^{[citation needed]}

MIFARE SAM AV2 offers AV1 mode and AV2 mode where in comparison to the SAM AV1 the AV2 version includes public key infrastructure (PKI), hash functions like SHA-1, SHA-224, and SHA-256. It supports MIFARE Plus and secure host communication. Both modes provide the same communication interfaces, cryptographic algorithms (Triple-DES 112-bit and 168-bit key, MIFARE products using Crypto1, AES-128 and AES-192, RSA with up to 2048-bit keys), and X-mode functionalities.^{[citation needed]} The MIFARE SAM AV3 is the third generation of NXP's Secure Access Module, and it supports MIFARE ICs as well as NXP's UCODE DNA, ICODE DNA and NTAG DNA ICs.^[21]

MIFARE 2GO

A cloud-based platform that digitizes MIFARE product-based smart cards and makes them available on NFC-enabled smartphones and wearables. With this, new Smart City use cases such as mobile transit ticketing, mobile access and mobile micropayments are being enabled.^[22]

MIFARE Classic

The encryption used by the MIFARE Classic IC uses a 48-bit key.^[31]

A presentation by Henryk Plötz and Karsten Nohl^[32] at the Chaos Communication Congress in December 2007 described a partial reverse-engineering of the algorithm used in the MIFARE Classic chip. Abstract and slides^[33] are available online. A paper that describes the process of reverse engineering this chip was published at the August 2008 USENIX security conference.^[34]

In March 2008 the Digital Security^[35] research group of the Radboud University Nijmegen made public that they performed a complete reverse-engineering and were able to clone and manipulate the contents of an OV-Chipkaart which is using MIFARE Classic chip.^[36] For demonstration they used the Proxmark3 device, a 125 kHz / 13.56 MHz research instrument.^[37] The schematics and software are released under the free GNU General Public License by Jonathan Westhues in 2007. They demonstrate it is even possible to perform card-only attacks using just an ordinary stock-commercial NFC reader in combination with the libnfc library.

The Radboud University published four scientific papers concerning the security of the MIFARE Classic:

• A Practical Attack on the MIFARE Classic^[38]
• Dismantling MIFARE Classic^[39]
• Wirelessly Pickpocketing a MIFARE Classic Card^[40]
• Ciphertext-only Cryptanalysis on Hardened MIFARE Classic Cards^[41]

In response to these attacks, the Dutch Minister of the Interior and Kingdom Relations stated that they would investigate whether the introduction of the Dutch Rijkspas could be brought forward from Q4 of 2008.^[42]

NXP tried to stop the publication of the second article by requesting a preliminary injunction. However, the injunction was denied, with the court noting that, "It should be considered that the publication of scientific studies carries a lot of weight in a democratic society, as does inform society about serious issues in the chip because it allows for mitigating of the risks."^[43][44]

Both independent research results are confirmed by the manufacturer NXP.^[45] These attacks on the cards didn't stop the further introduction of the card as the only accepted card for all Dutch public transport the OV-chipkaart continued as nothing happened^[46] but in October 2011 the company TLS, responsible for the OV-Chipkaart announced that the new version of the card will be better protected against fraud.^[47]

The MIFARE Classic encryption Crypto-1 can be broken in about 200 seconds on a laptop from 2008,^[48] if approx. 50 bits of known (or chosen) keystream are available. This attack reveals the key from sniffed transactions under certain (common) circumstances and/or allows an attacker to learn the key by challenging the reader device.

The attack proposed in^[49] recovers the secret key in about 40 ms on a laptop. This attack requires just one (partial) authentication attempt with a legitimate reader.

Additionally, there are a number of attacks that work directly on a card and without the help of a valid reader device.^[50] These attacks have been acknowledged by NXP.^[51] In April 2009 new and better card-only attack on MIFARE Classic has been found. It was first announced at the rump session of Eurocrypt 2009.^[52] This attack was presented at SECRYPT 2009.^[53] The full description of this latest and fastest attack to date can also be found in the IACR preprint archive.^[54] The new attack improves by a factor of more than 10 all previous card-only attacks on MIFARE Classic, has instant running time, and does not require a costly precomputation. The new attack allows recovering the secret key of any sector of the MIFARE Classic card via wireless interaction, within about 300 queries to the card. It can then be combined with the nested authentication attack in the Nijmegen Oakland paper to recover subsequent keys almost instantly. Both attacks combined and with the right hardware equipment such as Proxmark3, one should be able to clone any MIFARE Classic card in 10 seconds or less. This is much faster than previously thought.

In an attempt to counter these card-only attacks, new "hardened" cards have been released in and around 2011, such as the MIFARE Classic EV1.^[55] These variants are insusceptible for all card-only attacks publicly known until then, while remaining backward compatible with the original MIFARE Classic. In 2015, a new card-only attack was discovered that is also able to recover the secret keys from such hardened variants.^[56] Since the discovery of this attack, NXP is officially recommending to migrate from MIFARE Classic product-based systems to higher security products.^[57]

MIFARE DESFire

In November 2010, security researchers from the Ruhr University released a paper detailing a side-channel attack against MIFARE product-based cards.^[58] The paper demonstrated that MIFARE DESFire product-based cards could be easily emulated at a cost of approximately $25 in "off the shelf" hardware. The authors asserted that this side-channel attack allowed cards to be cloned in approximately 100 ms. Furthermore, the paper's authors included hardware schematics for their original cloning device, and have since made corresponding software, firmware and improved hardware schematics publicly available on GitHub.^[59]

In October 2011 David Oswald and Christof Paar of Ruhr-University in Bochum, Germany, detailed how they were able to conduct a successful "side-channel" attack against the card using equipment that can be built for nearly $3,000. Called "Breaking MIFARE DESFire MF3ICD40: Power Analysis and Templates in the Real World",^[60] they stated that system integrators should be aware of the new security risks that arise from the presented attacks and can no longer rely on the mathematical security of the used 3DES cipher. Hence, to avoid, e.g. manipulation or cloning of smart cards used in payment or access control solutions, proper actions have to be taken: on the one hand, multi-level countermeasures in the back end allow to minimize the threat even if the underlying RFID platform is insecure," In a statement^[61] NXP said that the attack would be difficult to replicate and that they had already planned to discontinue the product at the end of 2011. NXP also stated "Also, the impact of a successful attack depends on the end-to-end system security design of each individual infrastructure and whether diversified keys – recommended by NXP – are being used. If this is the case, a stolen or lost card can be disabled simply by the operator detecting the fraud and blacklisting the card, however, this operation assumes that the operator has those mechanisms implemented. This will make it even harder to replicate the attack with a commercial purpose."

MIFARE Ultralight

In September 2012 a security consultancy Intrepidus^[62] demonstrated at the EU SecWest event in Amsterdam,^[63] that MIFARE Ultralight product-based fare cards in the New Jersey and San Francisco transit systems can be manipulated using an Android application, enabling travelers to reset their card balance and travel for free in a talk entitled "NFC For Free Rides and Rooms (on your phone)".^[64] Although not a direct attack on the chip but rather the reloading of an unprotected register on the device, it allows hackers to replace value and show that the card is valid for use. This can be overcome by having a copy of the register online so that values can be analyzed and suspect cards hot-listed. NXP has responded by pointing out that they had introduced the MIFARE Ultralight C in 2008 with 3DES protection and in November 2012 introduced the MIFARE Ultralight EV1^[65] with three decrement only counters to foil such reloading attacks.

Transportation

Application references

Institutions

• Northwest University, South Africa – Student/staff ID, access control, library, student meals, sport applications, payments^[127]
• Cambridge University^[128] – Student/Staff ID and access card, library card, canteen payments in some colleges^[129]
• The University of Queensland – Staff and student ID, access control, library, copy/print, building access (MIFARE DESFire EV1)^[130]