I'm trying since days to understand the security protocols on NFC devices. I'm not a professional in security, I'm just a student and want to understand (additionally, English is absolutely not my mother tongue ^^).
I see that AES-128 is implemented on several devices, like the MIFARE DESFire EV1 (and2) but I don't understand several things :
- How is the key exchanged with the reader and the tag ? AES-128 is a symmetrical protocol, so the private key must be shared between the two devices. I can't understand - reader the documentation - how does it work. For instance, I can read here http://www.ti.com/lit/an/sloa213/sloa213.pdf the process of authentication with AES. I'm sorry, I don't understand how the key can be shared and formally, what functions are used :/
- I'm not sure neither to understand the meaning and utility of the UID (or RID with DESFire). It is only a unique number to avoid the cloning ? But in the case of a RID, how does it work to ensure that the card is not cloned ?
- Finally, is the random generator known ? I think it is a 16 bits generator, is that possible to know what function is implemented on it, and how is chosen the salt (I know that in the past, the RGN was a big issue with CRYPTO-1, I guess that the method is know different but is that known ?) ?
Thanks a lot :)