The MIFARE Classic is a classic example of why creating custom cryptography algorithms is a bad idea.
Most large scale installations will only be able to afford to update the readers in sections or regions at a time, maybe on a city by city basis in the case of transportation systems. These cards also support AES encryption, so that one single card can work with legacy readers and updated AES compatible readers such that card holders can use one card as the hardware/reader infrastructure is slowly updated. NXP did just this, with the MIFARE Plus card, by introducing a card which works with all existing Mifare Classic readers, but was not vulnerable to attacks on traditional MIFARE Classic cards. In these cases manufacturers (NXP) are tasked with coming up with quick fixes to address these issues, or they run the risk of losing large scale customers, like city bus or metro passes and readers.
In some cases (like in a city wide transportation infrastructure) this may take years to implement and have prohibitively high costs. For example, if moving from a MIFARE Classic card type to a MIFARE DESfire smart card, which uses well-vetted AES encryption, the card readers also have to be updated to support AES as well. They rely on the fact that the vulnerability costs more to implement, in time or money, than traditional attacks such as just breaking a window or paying a disgruntled employee for information.Ĭost is usually the largest factor.
What happens when something so widespread and embedded into a corporate or city infrastructure is revealed to have a custom cryptography algorithm and it’s predictable? After the initial panic, most companies realize that it’s not financially feasible to fix this security issue for years to come, if at all. One of the main players in this industry, NXP, designed the MIFARE Classic many years ago, and to date 260 Million readers and 10 billion card components have been sold in the MIFARE family of products. Smart cards and the use of near-field communications (NFC) is an increasingly popular tool for many things from wireless payment solutions to entry access and identification.
0 kommentar(er)
