Wirelessly Pickpocketing a Mifare Classic Card
Total Page：16
File Type：pdf, Size：1020Kb
Wirelessly Pickpocketing a Mifare Classic Card Flavio D. Garcia Peter van Rossum Roel Verdult Ronny Wichers Schreur Radboud University Nijmegen, The Netherlands {flaviog,petervr,rverdult,ronny}@cs.ru.nl Abstract the Charlie Card in Boston3, the SmartRider in Aus- tralia4, EasyCard in Taiwan5, and the OV-chipkaart6 in The Mifare Classic is the most widely used contactless The Netherlands. It is also widely used for access con- smartcard on the market. The stream cipher CRYPTO1 trol in office and governmental buildings and military used by the Classic has recently been reverse engi- objects. neered and serious attacks have been proposed. The According to [MFS08] the Mifare Classic complies most serious of them retrieves a secret key in under a with parts 1 to 3 of the ISO standard 14443-A [ISO01], second. In order to clone a card, previously proposed specifying the physical characteristics, the radio fre- attacks require that the adversary either has access quency interface, and the anti-collision protocol. The to an eavesdropped communication session or exe- Mifare Classic does not implement part 4 of the cutes a message-by-message man-in-the-middle attack standard, describing the transmission protocol, but in- between the victim and a legitimate reader. Although stead uses its own secure communication layer. In this this is already disastrous from a cryptographic point layer, the Mifare Classic uses the proprietary stream of view, system integrators maintain that these attacks cipher CRYPTO1 to provide data confidentiality and cannot be performed undetected. mutual authentication between card and reader. This ci- This paper proposes four attacks that can be ex- pher has recently been reversed engineered [NESP08], ecuted by an adversary having only wireless access [GKM+08]. to just a card (and not to a legitimate reader). The In this paper, we show serious vulnerabilities of the most serious of them recovers a secret key in less than Mifare Classic that enable an attacker to retrieve all a second on ordinary hardware. Besides the crypto- cryptographic keys of a card, just by wirelessly com- graphic weaknesses, we exploit other weaknesses in municating with it. Thus, the potential impact is much the protocol stack. A vulnerability in the computation larger than that of the problems previously reported of parity bits allows an adversary to establish a in [GKM+08], [CNO08], [KHG08], [Noh08], where side channel. Another vulnerability regarding nested the attacker either needs to have access to a legitimate authentications provides enough plaintext for a speedy reader or an eavesdropped communication session. The known-plaintext attack. attacks described in this paper are fast enough to allow an attacker to wirelessly ‘pickpocket’ a victim’s Mifare 1. Introduction Classic card, i.e., to clone it immediately. With more than one billion cards sold, the Mi- Vulnerabilities. The vulnerabilities we discovered fare Classic covers more than 70% of the contactless concern the handling of parity bits and nested authen- smartcard market1. Such cards contain a slightly more tications. powerful IC than classical RFID chips (developed • The Mifare Classic sends a parity bit for each for identification only), equipping them with modest byte that is transmitted. Violating the standard, computational power and making them suitable for ap- the Mifare Classic mixes the data link layer plications beyond identification, such as access control and secure communication layer: parity bits are and ticketing systems. computed over the plaintext instead of over the The Mifare Classic is widely used in public transport payment systems such as the Oyster card2 in London, 3. http://www.mbta.com/fares and passes/charlie 4. http://www.transperth.wa.gov.au 1. http://www.nxp.com 5. http://www.easycard.com.tw 2. http://oyster.tfl.gov.uk 6. http://www.ov-chipkaart.nl To appear in IEEE Symposium on Security and Privacy (S&P ’09). bits that are actually sent, i.e., the ciphertext. for the odd-numbered bits of the internal state of This is, in fact, authenticate-then-encrypt which the cipher. This reduces the offline search space is generically insecure [Kra01]. to approximately 33 bits. On a standard desktop Furthermore, parity bits are encrypted with the computer this search takes about one minute. same bit of keystream that encrypts the first bit • In the third attack the attacker keeps her own of the next byte of plaintext. During the authenti- challenge constant, but varies the challenge of the cation protocol, if the reader sends wrong parity tag, again ultimately obtaining a special internal bits, the card stops communicating. However, if state of the cipher. These special states have to be the reader sends correct parity bits, but wrong precomputed and stored in a 384 GB table. This authentication data, the card responds with an attack requires on average 212 = 4096 authenti- (encrypted) error code. This breaks the confi- cation attempts, which could in principle be done dentiality of the cipher, enabling an attacker to in about two minutes. A few extra authentication establish a side channel. attempts allow efficient lookup in the table. • The memory of the Mifare Classic is divided • The fourth attack assumes that the attacker has into sectors, each of them having its own 48-bit already recovered at least one sector key. When secret key. To perform an operation on a specific the attacker first authenticates for this sector and sector, the reader must first authenticate using then for another sector, the authentication protocol the corresponding key. When an attacker has is slightly different, viz., the challenge nonce of already authenticated for one sector (knowing the the tag is not sent in the clear, but encrypted with key for that sector) and subsequently attempts to the key of the new sector. Because the random authenticate for another sector (without knowing number generator has only a 16-bit state, because the key for this sector), that attempt leaks 32 bits parity bits leak three bits of information, and be- of information about the secret key of that sector. cause the tag’s random number generator runs in sync with the communication timing, this allows Attacks. We describe four attacks exploiting these an attacker to guess the plaintext tag nonce and vulnerabilities to recover the cryptographic keys from hence 32 bits of keystream. Due to weaknesses a Mifare Classic card having only contactless com- in the cipher [GKM+08], we can use these 32 munication with it (and not with a legitimate reader). bits of keystream to compute approximately 216 These attacks make different trade-offs between online candidate keys. These can then be checked offline communication time (the time an attacker needs to using another authentication attempt. Since this communicate with a card), offline computation time attack only requires three authentication attempts, (the time it takes to compute the cryptographic key the online time is negligible. The offline search using the data gathered from the card), precomputation takes under a second on ordinary hardware. time (one-time generation time of static tables), disk space usage (of the static tables) and special assump- Related work. De Koning Gans et al. [KHG08] have tions (whether the attacker has already one sector key proposed an attack on a Mifare Classic tag that exploits or not). the malleability of the CRYPTO1 stream cipher to read • The first attack exploits the weakness of the parity partial information from a tag, without even knowing bits to mount an offline brute-force attack on the the encryption algorithm. By slicing a Mifare Classic 48-bit key space. The attacker only needs to try chip and taking pictures with a microscope, the cipher to authenticate approximately 1500 times (which was reverse engineered by Nohl et al. [NESP08]. takes under a second). Courtois et al. claim in [CNO08] that the CRYPTO1 • The second attack also exploits the weakness of cipher is susceptible to algebraic attacks and Nohl the parity bits but this time the attacker mounts shows a statistical weakness of the cipher in [Noh08]. an adaptive chosen ciphertext attack. The at- A full description of the cipher was given by Garcia et tacker needs approximately 28500 authentication al. in [GKM+08], together with a reverse engineered attempts. In this attack, she needs to make sure authentication protocol. They also describe an attack that the challenge nonce of the card is constant, with which an attacker can recover a sector key by which is why this takes approximately fifteen communicating with a genuine reader or by eavesdrop- minutes. During these authentication attempts, ping a successful authentication. the attacker adaptively chooses her challenge to All attacks described in these papers have in com- the card, ultimately obtaining a challenge that mon that they need access to a legitimate reader or guarantees that there are only 436 possibilities intercepted communication. In contrast, the attacks 2 described in our paper only need access to a card. Impact. The implications of the attacks described in this paper are vast. Many ticketing and payment systems using the Mifare Classic sequentially authenticate for several sectors verifying the data in the card. In case of invalid data, the protocol aborts. With previous attacks, this means that an attacker has to either eavesdrop a full trace or walk from the reader to the card holder several times, executing a message-by-message man- in-the-middle attack. In practice, both options are hard to accomplish undetected. Furthermore, there is no Figure 2.1. Memory layout of the Mifare Classic guarantee that this allows an attacker to recover all useful data in the card, since some sectors might not be read in this particular instance. Our attacks always 14443-A. We have used the Proxmark III7 for commu- enable an attacker to retrieve all data from the card.