Re: Dutch Transport Card Broken

[Henryk Plötz]

Moin,

Am Thu, 24 Jan 2008 20:58:38 -0800 schrieb Aram Perez:

 Not to defend the designers in any way or fashion, but I'd like to  
 ask, How much security can you put into a plastic card, the size of
 a credit card, that has to perform its function in a secure manner,
 all in under 2 seconds (in under 1 second in parts of Asia)? And it
 has to do this while receiving its power via the electromagnetic
 field being generated by the reader.

Hmm, how about Triple-DES for starters? :-) There are cards using 3DES
(called Mifare DESfire) available from the same manufacturer (NXP) as
the Mifare Classic cards with the proprietary algorithm that we looked
at. Apparently the main difference is that DESfire cards cost 1.50 EUR
per piece while Classic cards are at 0.50 EUR per piece. Other public
transport systems, such as Madrid, did the sensible thing and chose
DESfire:
http://www.nxp.com/news/identification/articles/otm81/madrid/

-- 
Henryk Plötz
Grüße aus Berlin
~~ Help Microsoft fight software piracy: Give Linux to a friend today! ~


pgpsmBWu8tOGO.pgp
Description: PGP signature

Re: Philips/NXP/Mifare CRYPTO1 mostly reverse-engineered

[Henryk Plötz]

Moin,

Am Tue, 15 Jan 2008 12:28:37 + schrieb Steven J. Murdoch:

 There is some confusion on the cryptography mailing list over whether
 the Crypto1 encryption algorithm which you reverse engineered is the
 same as the Hitag 2 one. NXP don't help things by branding both as
 Mifare.
 
  http://www.mail-archive.com/cryptography@metzdowd.com/msg08478.html
 
 It would help to clarify things if you sent a mail to that list saying
 whether or not the code mentioned in the above email is equivalent to
 Crypto1.

No it's not.
http://cryptanalysis.eu/blog/2007/12/29/mifare-crypto1/#comment-391

Karsten also said that though Hitag2 similar in structure to Crypto1,
the former is less complex, and may be a predecessor or something.

-- 
Henryk Plötz
Grüße aus Berlin
~~ Help Microsoft fight software piracy: Give Linux to a friend today! ~


pgpIJqe3GDfEL.pgp
Description: PGP signature