24C3 Mifare crypto1 RFID completely broken
August 17th, 2008It’s an old issue but still got a kind of relations to our days of life.
Another highlight for us at CCC was [Karsten Nohl] and [Henryk Plötz] presenting how they reversed Philips crypto-1 “classic” Mifare RFID chips which are used in car keys, among other things. They analyzed both the silicon and the actual handshaking over RF. Looking at the silicon they found about 10K gates. Analyzing with Matlab turned up 70 unique functions. Then they started looking “crypto-like” parts: long strings of flip-flops used for registers, XORs, things near the edge that were heavily interconnected. Only 10% of the gates ended up being crypto. They now know the crypto algorithm based on this analysis and will be releasing later in the year.
The random number generator ended up being only 16-bit. It generates this number based on how long since the card has been powered up. They controlled the reader (an OpenPCD) which lets them generate the same “random” seed number over and over again. This was actually happening on accident before they discovered the flaw.
One more broken security-through-obscurity system to add to the list. For more fun, watch the video of the presentation.
Source: Hackaday


GlobalTrak’s Remote Sensor Nodes (RSNs) increase the shipper’s ability to monitor cargo condition with a variable set of sensors for door status, humidity, temperature, a 3-axis accelerometer, and now an extremely sensitive gamma detector, a long term stable sensor with built-in temperature compensation and low power consumption.
This is an interesting blog post, mostly because the XBee Pro is rated at about 1.6 km line of sight. However this guy is claiming to get about 150m (~150 yards) before data gets corrupted….

