bachelor

1.3 Grades of security 13
Common to the “Darkside” and nested authentication attacks is that they need
only a Mifare card and a NFC-compatible reader. The readers are readily available
online, currently priced at 30 e 9 .
These attacks combined can recover all sector keys and dump a card in minutes
on a laptop with a off-the-shelf NFC reader, even shorter time if the attacker
has access to a “ProxMark” reader 10 , currently costing $330. There are numerous
software projects that implement these attacks and provide read-write
functionality for Mifare cards, among others libnfc 11 , mfcuk 12 , crapto1 13 and
RFID IO tools 14 .
1.3.2 MAC
All of the security-critical sectors on Rejsekortet carry a checksum value calculated
with the CBC-MAC algorithm using DES[6], to which the key is secret.
This is to ensure that people do not modify the data in case they recovered the
Mifare keys.
The sectors carrying MACs must have the last 24 bits comprised of a “MAC
algorithm identifier,” a “MAC key identifier” as well as a 16-bit MAC (page 58,
[6] 15 ). The key identifier exists so that Rejsekort A/S can issue a new key if the
old one has been compromised (in turn enabling an attacker to calculate the
current MAC for some data stream), and likewise the algorithm can be changed
if the current algorithm is deemed too weak.
Moreover the sectors carry a field containing the ID of the key used to calculate
the hash so that RKF can issue a new key in case one is broken.
The non-critical sections have a CRC checksum instead of a MAC.
9 http://www.touchatag.com/e-store
10 http://proxmark3.com/
11 http://www.libnfc.org/
12 http://code.google.com/p/mfcuk/
13 http://code.google.com/p/crapto1/
14 http://www.rfidiot.org/
15 The specification allows MACs longer than 16 bits, but in practice only 16-bit MACs are
used[5].