Microscope-wielding boffins crack Tube smartcard

Security researchers say they've found a way to crack the encryption used to protect a widely-used smartcard in a matter of minutes, making it possible for them to quickly and cheaply clone the cards that are used to secure office buildings and automate the collection of mass transportation fares.

The attack works against the Mifare Classic, a wireless card made by Netherlands-based NXP Semiconductors. It is used by transit operators in London, Boston and the Netherlands and by organizations in the public and private sectors to control access to sensitive areas, according to Karsten Nohl, a PhD candidate at the University of Virginia and one of the cryptographers who discovered the weakness. NXP says it's sold 1 billion to 2 billion of the cards.

The wireless devices are growing in popularity because of their low cost - about 50 cents apiece - and they offer many of the advantages of radio frequency identification (RFID) technology. Specifically, smartcards don't require contact with the mechanical readers used by transit agencies, which lowers operators' costs and are quicker and more convenient for users.

The research team was able to obtain the card's proprietary encryption scheme by physically dissecting its chip and examining it under a microscope. They then photographed various levels of its circuitry and used optical recognition software to produce a 3D representation of the entire chip. By examining the logic gates in great detail, they were able to deduce the proprietary algorithm, which NXP dubs Crypto1.

Under normal circumstances, knowing the encryption algorithm allows a hacker to perform a brute-force attack in which every possible key is entered until the correct combination unlocks the scrambled code. But that would have taken days, given Mifare Classic's key length of 48 bits.

The research team, which also included Henryk Plötz and an individual who goes by the moniker Starbug, soon found out that Cypto1 has a flaw that causes it to produce cryptographically weak outputs. The weakness allows them to make intelligent guesses about the possible key by swiping the smartcard against an RFID reader and observing the data that reader sends back.

"It only takes a few minutes to break any card in particular," Nohl said in an interview. He said the modest amount of time and equipment required to crack any Mifare Classic card - in many cases less than 10 minutes on a typical PC - makes the attack ripe for criminals to carry out in the real-world attacks.

"If you want to get into a high-security building, spending a matter of days is OK," he said. "Now, it doesn't take days; it takes minutes for subways and military installations alike."