[Paper Review] A Practical Attack on the MIFARE Classic

Gerhard de Koning Gans, Jaap-Henk Hoepman+1 more|ArXiv.org|Mar 15, 2008

Cryptographic Implementations and Security1 references4 citations

TL;DR

This paper presents a practical, low-cost attack on the MIFARE Classic smart card that exploits weaknesses in its CRYPTO1 stream cipher and pseudo-random generator to recover keystreams without knowing the secret key. By analyzing eavesdropped transactions, the attack enables full read and write access to all memory blocks in any sector, compromising data confidentiality and integrity across widely used contactless systems.

ABSTRACT

The MIFARE Classic is the most widely used contactless smart card in the market. Its design and implementation details are kept secret by its manufacturer. This paper studies the architecture of the card and the communication protocol between card and reader. Then it gives a practical, low-cost, attack that recovers secret information from the memory of the card. Due to a weakness in the pseudo-random generator, we are able to recover the keystream generated by the CRYPTO1 stream cipher. We exploit the malleability of the stream cipher to read all memory blocks of the first sector of the card. Moreover, we are able to read any sector of the memory of the card, provided that we know one memory block within this sector. Finally, and perhaps more damaging, the same holds for modifying memory blocks.

Motivation & Objective

• To analyze the MIFARE Classic's communication protocol and cryptographic design to identify exploitable weaknesses.
• To demonstrate a practical attack that recovers keystreams from eavesdropped transactions without knowledge of the secret key.
• To enable full read and write access to all memory blocks in any sector of the card, given access to one block's data.
• To expose the insecurity of relying on security by obscurity in proprietary cryptographic systems like MIFARE Classic.
• To provide actionable recommendations for mitigating risks in existing systems and guide migration to more secure alternatives.

Proposed method

• Implemented ISO 14443-A protocol stack on a Proxmark III to enable full control over reader-card communication.
• Exploited the stateless nature and low-entropy nonces (16-bit instead of 32-bit) in the CRYPTO1 pseudo-random generator to recover keystreams.
• Used known plaintext from eavesdropped commands (e.g., read, write, increment) to reconstruct the keystream and decrypt/modify data.
• Leveraged the malleability of the stream cipher to recover the first 6 and last 6 bytes of any block in a sector, given one known block.
• Performed keystream recovery from a single valid transaction to enable subsequent impersonation and data manipulation.
• Combined findings with prior work (Nohl & Plötz) to enable efficient brute-force key recovery, currently under development.

Experimental results

Research questions

• RQ1 Can the keystream of the CRYPTO1 stream cipher in MIFARE Classic be recovered without knowledge of the secret key?
• RQ2 To what extent can the malleability of the stream cipher be exploited to read or modify data in memory blocks?
• RQ3 How does the low-entropy nonce in the pseudo-random generator affect the security of mutual authentication?
• RQ4 What are the practical implications of keystream recovery for data confidentiality and integrity in real-world applications?
• RQ5 What countermeasures can be implemented to mitigate the risk of such attacks in existing systems?

Key findings

• The attack successfully recovers the keystream from a single eavesdropped transaction, enabling full access to all data in a sector without the secret key.
• All memory blocks in sector zero can be read in a few minutes, even without prior knowledge of the key.
• The first 6 bytes and, in most cases, the last 6 bytes of any block in a sector can be recovered if one block's data is known.
• The attack allows modification of any data block in a sector, compromising data integrity and enabling fraud in applications like electronic purses.
• The keystream recovery provides essential plaintext for future brute-force key recovery attacks, which are currently being optimized.
• The attack demonstrates that security by obscurity in proprietary systems like MIFARE Classic is fundamentally flawed and insufficient.