 | ||
MIFARE is the NXP Semiconductors-owned trademark of a series of chips widely used in contactless smart cards and proximity cards.
Contents
- Variants
- MIFARE Classic
- MIFARE Ultralight and MIFARE Ultralight EV1
- MIFARE Ultralight C
- MIFARE DESFire
- MIFARE DESFire EV1
- MIFARE DESFire EV2
- MIFARE Plus
- MIFARE Plus EV1
- MIFARE SAM AV2
- Applications
- History
- Security of MIFARE Classic MIFARE DESFire and MIFARE Ultralight
- Considerations for systems integration
- Certification
- Institutions
- References
The MIFARE name covers proprietary technologies based upon various levels of the ISO/IEC 14443 Type A 13.56 MHz contactless smart card standard. According to MIFARE themselves, 10 billion of their smart card chips and 150 million of their reader modules have been sold. The technology is owned by NXP Semiconductors, which was spun off from Philips Electronics in 2006.
Variants
The technology is embodied in both cards and readers.
The MIFARE name (derived from the term MIkron FARE Collection System) covers seven different kinds of contactless cards:
MIFARE Classic
The MIFARE Classic card is fundamentally just a memory storage device, where the memory is divided into segments and blocks with simple security mechanisms for access control. They are ASIC-based and have limited computational power. Thanks to their reliability and low cost, those cards are widely used for electronic wallet, access control, corporate ID cards, transportation or stadium ticketing.
The MIFARE Classic 1K offers 1024 bytes of data storage, split into 16 sectors; each sector is protected by two different keys, called A and B. Each key can be programmed to allow operations such as reading, writing, increasing value blocks, etc. MIFARE Classic 4K offers 4096 bytes split into forty sectors, of which 32 are same size as in the 1K with eight more that are quadruple size sectors. MIFARE Classic mini offers 320 bytes split into five sectors. For each of these card types, 16 bytes per sector are reserved for the keys and access conditions and can not normally be used for user data. Also, the very first 16 bytes contain the serial number of the card and certain other manufacturer data and are read only. That brings the net storage capacity of these cards down to 752 bytes for MIFARE Classic 1K, 3440 bytes for MIFARE Classic 4K, and 224 bytes for Mini. It uses an NXP proprietary security protocol (Crypto-1) for authentication and ciphering.
The Samsung TecTile NFC tag stickers use MIFARE Classic chips. This means only devices with an NXP NFC controller chip can read or write these tags. At the moment BlackBerry phones, the Nokia Lumia 610 (August 2012), the Google Nexus 4, Google Nexus 7 LTE and Nexus 10 (October 2013) can't read/write TecTile stickers.
MIFARE Classic encryption has been compromised; see below for details.
MIFARE Ultralight and MIFARE Ultralight EV1
The MIFARE Ultralight has only 512 bits of memory (i.e. 64 bytes), without cryptographic security. The memory is provided in 16 pages of 4 bytes. Cards based on these chips are so inexpensive that they are often used for disposable tickets for events such as the Football World Cup 2006. It provides only basic security features such as one-time-programmable (OTP) bits and a write-lock feature to prevent re-writing of memory pages but does not include cryptography as applied in other MIFARE based cards.
MIFARE Ultralight EV introduced in November 2012 the next generation of paper ticketing smart card IC for limited-use applications that offers solution developers and operators the maximum flexibility for their ticketing schemes and additional security options. It comes with several enhancements above the original MIFARE Ultralight
Key applications:
MIFARE Ultralight C
Introduced at the Cartes industry trade show in 2008, MIFARE Ultralight C is part of NXP's low-cost MIFARE offering (disposable ticket). With Triple DES, MIFARE Ultralight C uses a widely adopted standard, enabling easy integration in existing infrastructures. The integrated Triple DES authentication provides an effective countermeasure against cloning.
Key features:
Key applications for MIFARE Ultralight C are Public Transportation, Event Ticketing, Loyalty and NFC Forum Tag Type 2.
MIFARE DESFire
The MIFARE DESFire (MF3ICD40) was introduced in 2002 and is based on a core similar to SmartMX, with more hardware and software security features than MIFARE Classic. It comes pre-programmed with the general purpose MIFARE DESFire operating system which offers a simple directory structure and files. They are sold in four variants: one with Triple-DES only and 4 KB of storage, and three with AES (2, 4 or 8 KB; see MIFARE DESFire EV1). The AES variants have additional security features, e.g., CMAC. MIFARE DESFire uses a protocol compliant with ISO/IEC 14443-4. The card is based on an 8051 processor with 3DES/AES crypto accelerator, making very fast transactions possible.
The maximal read/write distance between card and reader is 10 centimetres (3.9 in), but actual distance depends on the field power generated by the reader and its antenna size.
In 2010 NXP announced the discontinuation of the MIFARE DESFire (MF3ICD40) after it had introduced its successor MIFARE DESFire EV1 late 2008. In October 2011 researchers of Ruhr University Bochum announced that they had broken the security of MIFARE DESFire (MF3ICD40), which was acknowledged by NXP., see DESFire Attacks
MIFARE DESFire EV1
(previously called DESFire8)
New evolution of MIFARE DESFire card, broadly backwards compatible. Available with 2 KB, 4 KB and 8 KB NV-Memory. Other features include:
MIFARE DESFire EV1 was publicly announced in November 2006.
Key applications:
MIFARE DESFire EV2
New evolution of MIFARE DESFire card, broadly backwards compatible. New features include:
MIFARE DESFire EV2 was publicly announced in March 2016.
MIFARE Plus
MIFARE Plus is a replacement card for the MIFARE Classic. It provides an easy upgrade of existing infrastructures toward high security. Data management is identical to the MIFARE Classic; however, the security management requires the modification of the installed reader base. Other features include:
Key applications:
It is less flexible than MIFARE DESFire EV1.
MIFARE Plus was publicly announced in March 2008 with first samples in Q1 2009.
MIFARE Plus, when used in older transportation systems that do not yet support AES on the reader side, still leaves an open door to attacks. Though it helps to mitigate threats from attacks that broke the Crypto-1 cipher through the weak random number generator, it does not help against brute force attacks and cryptoanalytic attacks. During the transition period from MIFARE Classic to MIFARE Plus where only a few readers might support AES in the first place, it offers an optional AES authentication in Security Level 1 (which is in fact MIFARE Classic operation). This does not prevent the attacks mentioned above but enables a secure mutual authentication between the reader and the card to prove that the card belongs to the system and is not fake. In its highest security level SL3, using 128-bit AES encryption, MIFARE Plus is secured from attacks.
MIFARE Plus EV1
MIFARE Plus EV1 was announced in April 2016.
New features compared to MIFARE Plus X include:
MIFARE SAM AV2
MIFARE SAMs are not contactless smartcards. They are Secure access modules designed to provide the secure storage of cryptographic keys and cryptographic functions for terminals to access the MIFARE products securely and to enable secure communication between terminals and host (backend). MIFARE SAMs are available from NXP in the contact-only module (PCM 1.1) as defined in ISO/IEC 7816-2 and the HVQFN32 format.
Key features:
Integrating a MIFARE SAM AV2 in a contactless smart card reader enables a design which integrates high-end cryptography features and the support of crypto authentication and data encryption/decryption. Like any SAM, it offers functionality to store keys securely, and perform authentication and encryption of data between the contactless card and the SAM and the SAM towards the backend. Next to a classical SAM architecture the MIFARE SAM AV2 supports the X-mode which allows a fast and convenient contactless terminal development by connecting the SAM to the microcontroller and reader IC simultaneously.
MIFARE SAM AV2 offers AV1 mode and AV2 mode where in comparison to the SAM AV1 the AV2 version includes Public Key Infrastructure (PKI), Hash functions like SHA-1, SHA-224, and SHA-256. It supports MIFARE Plus and a secure host communication. Both modes provide the same communication interfaces, cryptographic algorithms (Triple-DES 112-bit and 168-bit key, MIFARE Crypto1, AES-128 and AES-192, RSA with up to 2048-bit keys), and X-mode functionalities.
Applications
MIFARE products can be used in different applications:
Formerly most access systems used MIFARE Classic, but today these systems have switched to MIFARE DESFire because this product has more security than MIFARE Classic.
History
The MIFARE product portfolio was originally developed by Mikron in Gratkorn, Austria. Mikron was acquired by Philips in 1995. Mikron sourced silicon from Atmel in the US, Philips in the Netherlands, and Siemens in Germany.
Infineon Technologies (then Siemens) licensed MIFARE Classic from Mikron in 1994 and developed both stand alone and integrated designs with MIFARE product functions. Infineon currently produces various derivatives based on MIFARE Classic including 1K memory (SLE66R35) and various microcontrollers (8 bit (SLE66 series), 16 bit (SLE7x series), and 32 bit (SLE97 series) with MIFARE emulations, including devices for use in USIM with Near Field Communication.
Motorola tried to develop MIFARE-like chip for wired-logic version but finally gave up. The project expected one million cards per month for start, but that fell to 100,000 per month just before they gave up the project.
In 1998 Philips licensed MIFARE Classic to Hitachi Hitachi licensed MIFARE products for the development of the contactless smart card solution for NTT's IC telephone card which started in 1999 and finished in 2006. In the NTT contactless IC telephone card project, three parties joined: Tokin-Tamura-Siemens, Hitachi (Philips-contract for technical support), and Denso (Motorola-only production). NTT asked for two versions of chip, i.e. wired-logic chip (like MIFARE Classic) with small memory and big memory capacity. Hitachi developed only big memory version and cut part of the memory to fit for the small memory version.
The deal with Hitachi was upgraded in 2008 by NXP ( by then no longer part of Philips) to include MIFARE Plus and MIFARE DESFire to the renamed semiconductor division of Hitachi Renesas Technology.
In 2010 NXP licensed MIFARE products to Gemalto. In 2011 NXP licensed Oberthur to use MIFARE products on SIM cards. In 2012 NXP signed an agreement with Giesecke & Devrient to integrate MIFARE applications on their secure SIM products. These licensees are developing Near Field Communication products
Security of MIFARE Classic, MIFARE DESFire and MIFARE Ultralight
The encryption used by the MIFARE Classic card uses a 48 bit key.
A presentation by Henryk Plötz and Karsten Nohl at the Chaos Communication Congress in December 2007 described a partial reverse-engineering of the algorithm used in the MIFARE Classic chip. Abstract and slides are available online. A paper that describes the process of reverse engineering this chip was published at the August 2008 USENIX security conference.
In March 2008 the Digital Security research group of the Radboud University Nijmegen made public that they performed a complete reverse-engineering and were able to clone and manipulate the contents of an OV-Chipkaart which is a MIFARE Classic card. For demonstration they used the Proxmark device, a 125 kHz / 13.56 MHz research instrument. The schematics and software are released under the free GNU General Public License by Jonathan Westhues in 2007. They demonstrate it is even possible to perform card-only attacks using just an ordinary stock-commercial NFC reader in combination with the libnfc library.
The Radboud University published three scientific papers concerning the security of the MIFARE Classic:
In response to these attacks, the Dutch Minister of the Interior and Kingdom Relations stated that they would investigate whether the introduction of the Dutch Rijkspas could be brought forward from Q4 of 2008.
NXP tried to stop the publication of the second article by requesting a preliminary injunction. However, the injunction was denied, with the court noting that, "It should be considered that the publication of scientific studies carries a lot of weight in a democratic society, as does informing society about serious issues in the chip, because it allows for mitigating of the risks."
Both independent research results are confirmed by the manufacturer NXP. These attacks on the cards didn't stop the further introduction of the card as the only accepted card for all Dutch public transport the OV-chipkaart continued as nothing happened but in October 2011 the company TLS, responsible for the OV-Chipkaart announced that the new version of the card will be better protected against fraud.
The MIFARE Classic encryption Crypto-1 can be broken in about 200 seconds on a laptop, if approx. 50 bits of known (or chosen) key stream are available. This attack reveals the key from sniffed transactions under certain (common) circumstances and/or allows an attacker to learn the key by challenging the reader device.
The attack proposed in recovers the secret key in about 40 ms on a laptop. This attack requires just one (partial) authentication attempt with a legitimate reader.
Additionally there are a number of attacks that work directly on a card and without the help of a valid reader device. These attacks have been acknowledged by NXP. In April 2009 new and better card-only attack on MIFARE Classic has been found. It was first announced at the Rump session of Eurocrypt 2009. This attack was presented at SECRYPT 2009. The full description of this latest and fastest attack to date can also be found in the IACR preprint archive. The new attack improves by a factor of more than 10 all previous card-only attacks on MIFARE Classic, has instant running time, and it does not require a costly precomputation. The new attack allows to recover the secret key of any sector of MIFARE Classic card via wireless interaction, within about 300 queries to the card. It can then be combined with the nested authentication attack in the Nijmegen Oakland paper to recover subsequent keys almost instantly. Both attacks combined and with the right hardware equipment such as Proxmark3, one should be able to clone any MIFARE Classic card in not more than 10 seconds. This is much faster than previously thought.
MIFARE DESFire Attacks
In November 2010, security researchers from the Ruhr University released a paper detailing a 'side channel' attack against MIFARE cards, including the DESFire EV and EV1 cards. The paper demonstrated that DESFire cards could be easily cloned at a cost of approximately $25 in 'off the shelf' hardware. The authors asserted that this side channel attack allowed MIFARE cards to be cloned in approximately 100ms. Furthermore, the paper's authors included hardware schematics for their original cloning device, and have since made corresponding software, firmware and improved hardware schematics publicly available on GitHub.
In October 2011 David Oswald and Christof Paar of Ruhr-University in Bochum, Germany, detailed how they were able to conduct a successful "side-channel" attack against the card using equipment that can built for nearly $3,000. called "Breaking MIFARE DESFire MF3ICD40: Power Analysis and Templates in the Real World," They stated that System integrators should be aware of the new security risks that arise from the presented attacks and can no longer rely on the mathematical security of the used 3DES cipher. Hence, in order to avoid, e.g. manipulation or cloning of smartcards used in payment or access control solutions, proper actions have to be taken: on the one hand, multi-level countermeasures in the backend allow to minimize the threat even if the underlying RFID platform is insecure," In a statement NXP said that the attack would be difficult to replicate and that they had already planned to discontinue the card at the end of 2011. NXP also stated "Also, the impact of a successful attack depends on the end-to-end system security design of each individual infrastructure and whether diversified keys – recommended by NXP – are being used. If this is the case, a stolen or lost card can be disabled simply by the operator detecting the fraud and blacklisting the card, however this operation assumes that the operator has those mechanisms implemented. This will make it even harder to replicate the attack with a commercial purpose,"
MIFARE Ultralight Attack
In September 2012 a security consultancy Intrepidus demonstrated at the EU SecWest event in Amsterdam, that MIFARE Ultralight based fare cards in the New Jersey and San Francisco transit systems can be manipulated using an Android application, enabling travelers to reset their card balance and travel for free in a talk entitled "NFC For Free Rides and Rooms (on your phone)". Although not a direct attack on the chip but rather the reloading of an unprotected register on the device, it allows hackers to replace value and show that the card is valid for use. This can be overcome by having a copy of the register online so that values can be analysed and suspect cards hotlisted. NXP have responded by pointing out that they had introduced the MIFARE Ultralight C in 2008 with 3DES protection and in November 2012 introduced the MIFARE Ultralight EV1 with three decrement only counters to foil such reloading attacks.
Considerations for systems integration
For systems based on contactless smartcards (e.g. public transportation), security against fraud relies on many components, of which the card is just one. Typically, to minimize costs, systems integrators will choose a relatively cheap card such as a MIFARE Classic and concentrate security efforts in the back office. Additional encryption on the card, transaction counters, and other methods known in cryptography are then employed to make cloned cards useless, or at least to enable the back office to detect a fraudulent card, and put it on a blacklist. Systems that work with online readers only (i.e., readers with a permanent link to the back office) are easier to protect than systems that have offline readers as well, for which real-time checks are not possible and blacklists cannot be updated as frequently.
Certification
Another aspect of fraud prevention and compatibility guarantee is the MIFARE Certificate called to life in 1998 ensuring the compatibility of several certified cards with multiple readers of MIFARE technology. With this certification, the main focus was placed on the contactless communication of the wireless interface, as well as to ensure proper implementation of all the commands of MIFARE cards and readers. The certification process was developed and carried out by the Austrian laboratory called Arsenal Research. Today Arsenal Testhouse performs the certification tests and provides the certified products in an online database.