4 ms·

Do RFID tags have anything to prevent a replay attack or is owning a bit for bit copy of an RFID tag the same as owning the original?

almost 16y ago
RFID tags are not smart cards, they basically just have a small amount of data on them which can be read off. So yes, having a bit for bit copy is exactly the same as having the original tag.
- tocomment 16y ago
  That doesn't seem like a smart design. It seems less secure than an old fashioned metal key.
  - lisper 16y ago
    These chips aren't supposed to be used for secure applications (though no doubt some people do use them that way). They are intended to be used more like a UPC code.
    - tocomment 16y ago
      I thought that's how keycards generally work?
      - lisper 16y ago
        Some work that way, others do PKI-ish things and so are more secure.
  - almost 16y ago
    Not for a key, no. But it's a great design when what you want is low cost ID tags which don't require their own power source and which essentially work like barcodes that you can scan without line of sight.
deutronium 16y ago
Regarding 'contactless smart cards' which use a similar radio protocol to RFID: One example being MIFARE used in the London underground, where they found a vulnerability in the encryption algorithm being used on the card (the cards are 'intelligent' in that they have a processor on board to perform the cryptography etc.). Once you can break the encryption, you can then set about making a clone. With contactless bank cards, (which in the UK you can use to pay for the M6 toll), you could imagine people electronically picking your pocket, by relaying the signal from a transceiver near a cash point over RF to another transceiver which communicates with the card in your pocket. (hopefully they use distance bounding protocols to prevent this!) Karsten Nohl (http://www.cs.virginia.edu/~kn5f/ http://www.cs.virginia.edu/~kn5f/) has some fascinating papers on how they broke Crypto1 (the algorithm used by MIFARE). They took photos of the chip in the card using an optical microscope, after dissolving the card in acetone (They had to sand off each layer of the chip to get to the next) They then applied image recognition to identify logic gates from their constituent transistors. And then looked for XOR gates, as they mention they're rarely used for anything other than crypto on this type of chip. Once they had found the area of the chip involved in cryptography, they converted the logic gates into the actual algorithm used, and then picked apart weaknesses with it.
- mikedmiked 16y ago
  Remarkable! Thank you for sharing this.
  - flawawa2 16y ago
    http://media.ccc.de/browse/congress/2007/24c3-2378-en-mifare_security.html http://media.ccc.de/browse/congress/2007/24c3-2378-en-mifare... http://media.ccc.de/browse/congress/2008/25c3-3032-en-analyzing_rfid_security.html http://media.ccc.de/browse/congress/2008/25c3-3032-en-analyz... Nowadays he is busy cracking and hacking GSM. Remarkable person.

almost 16y ago

RFID tags are not smart cards, they basically just have a small amount of data on them which can be read off. So yes, having a bit for bit copy is exactly the same as having the original tag.

tocomment 16y ago
That doesn't seem like a smart design. It seems less secure than an old fashioned metal key.
- lisper 16y ago
  These chips aren't supposed to be used for secure applications (though no doubt some people do use them that way). They are intended to be used more like a UPC code.
  - tocomment 16y ago
    I thought that's how keycards generally work?
    - lisper 16y ago
      Some work that way, others do PKI-ish things and so are more secure.
- almost 16y ago
  Not for a key, no. But it's a great design when what you want is low cost ID tags which don't require their own power source and which essentially work like barcodes that you can scan without line of sight.

deutronium 16y ago

Regarding 'contactless smart cards' which use a similar radio protocol to RFID: One example being MIFARE used in the London underground, where they found a vulnerability in the encryption algorithm being used on the card (the cards are 'intelligent' in that they have a processor on board to perform the cryptography etc.). Once you can break the encryption, you can then set about making a clone. With contactless bank cards, (which in the UK you can use to pay for the M6 toll), you could imagine people electronically picking your pocket, by relaying the signal from a transceiver near a cash point over RF to another transceiver which communicates with the card in your pocket. (hopefully they use distance bounding protocols to prevent this!) Karsten Nohl (http://www.cs.virginia.edu/~kn5f/ http://www.cs.virginia.edu/~kn5f/) has some fascinating papers on how they broke Crypto1 (the algorithm used by MIFARE). They took photos of the chip in the card using an optical microscope, after dissolving the card in acetone (They had to sand off each layer of the chip to get to the next) They then applied image recognition to identify logic gates from their constituent transistors. And then looked for XOR gates, as they mention they're rarely used for anything other than crypto on this type of chip. Once they had found the area of the chip involved in cryptography, they converted the logic gates into the actual algorithm used, and then picked apart weaknesses with it.

mikedmiked 16y ago
Remarkable! Thank you for sharing this.
- flawawa2 16y ago
  http://media.ccc.de/browse/congress/2007/24c3-2378-en-mifare_security.html http://media.ccc.de/browse/congress/2007/24c3-2378-en-mifare... http://media.ccc.de/browse/congress/2008/25c3-3032-en-analyzing_rfid_security.html http://media.ccc.de/browse/congress/2008/25c3-3032-en-analyz... Nowadays he is busy cracking and hacking GSM. Remarkable person.