3
$\begingroup$

I'm trying since days to understand the security protocols on NFC devices. I'm not a professional in security, I'm just a student and want to understand (additionally, English is absolutely not my mother tongue ^^).

I see that AES-128 is implemented on several devices, like the MIFARE DESFire EV1 (and2) but I don't understand several things :

  1. How is the key exchanged with the reader and the tag ? AES-128 is a symmetrical protocol, so the private key must be shared between the two devices. I can't understand - reader the documentation - how does it work. For instance, I can read here http://www.ti.com/lit/an/sloa213/sloa213.pdf the process of authentication with AES. I'm sorry, I don't understand how the key can be shared and formally, what functions are used :/
  2. I'm not sure neither to understand the meaning and utility of the UID (or RID with DESFire). It is only a unique number to avoid the cloning ? But in the case of a RID, how does it work to ensure that the card is not cloned ?
  3. Finally, is the random generator known ? I think it is a 16 bits generator, is that possible to know what function is implemented on it, and how is chosen the salt (I know that in the past, the RGN was a big issue with CRYPTO-1, I guess that the method is know different but is that known ?) ?

Thanks a lot :)

Improve this question
$\endgroup$

2 Answers 2

Reset to default
5
$\begingroup$

As in most Smart Card systems using symmetric cryptography, the reader does not hold a key shared with a card. It somewhat holds a master key which, combined with a card identifier (e.g. some serial number), can produce a so-called diversified key, which is in the card. This is known as key diversification (diversification is derivation using a master key and device ID). This ensures that even extracting a key from a card can't compromise the key of other cards.

The reader-side cryptography is typically performed by a SAM, perhaps similar to this one.

Thus UID/RID might be the device ID used for diversification. Or not. It is no secret, most often can be read (at least in EV1) and thus cloned, but the associated diversified key can not be read, and that's what prevents cloning.

Improve this answer
$\endgroup$
0
3
$\begingroup$

  1. The key has to be exchanged beforehand. Usually this happens during system setup somehow and often completely off-line.

  2. The ID is not used to prevent cloning. It is required for the reader to select the correct key for talking to this card.

  3. It seems they have a TRNG.

Improve this answer
$\endgroup$
2
  • $\begingroup$ I understand that the key must be exchanged before, but my question is : How ? I'm just reading that documentation : ECMA 385 and 386 : Is that the main idea : using Elliptic Curve Diffie Hellman in that way ? To exchange the private key encrypted itself in an asymmetric way ? $\endgroup$
    – Arabella Brayer
    Commented Mar 23, 2017 at 15:23
  • $\begingroup$ No, usually no public key crypto is used. You just give the reader a way to derive the card keys from a master key and an ID and then put the specific key into the card when programming it. $\endgroup$
    – Elias
    Commented Mar 23, 2017 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.