3 ms·
A user accepting these "verifies" them by assuming that two properties hold if they connect over NFC or via pogo pins to the "gold elements", send a challenge o
by XMPPwocky 7y ago
A user accepting these "verifies" them by assuming that two properties hold if they connect over NFC or via pogo pins to the "gold elements", send a challenge over this connection, and receive in response the challenge signed with a public key associated with locked Kong tokens.
1. the relevant private key is known to only a Kong note's secure element. this is (hopefully) enforced by the secure element's, uh, security, and by the issuer.
2. the relevant private key is known to the secure element on the specific physical Kong note the user has been given.
2 is unenforced in your current design, from what I can see. A crafted note can relay all communication to the secure element of another note (e.g. over low-power RF from a single-use battery or small ultracapacitor).
better, a "dead" Kong note which performs no NFC communication can be given to a merchant; then, a high-power NFC transceiver can be used to pretend to be the note wirelessly (from a handful of meters away, but in a lot of situations that's more than enough). Of course, this one only works if the verifier is using NFC, but... This one is particularly nasty because it's relatively straightforwards to "weaponise" - imagine buying a "kit" off AliExpress which contains fifty dead notes, a ProxMark, and an amplified antenna. Then, in any situation where you're close enough to the person who'll be verifying your notes... just give them a dead one and relay communications. Verification passes, but what the merchant ends up putting in their cash drawer is worthless.
- badrabbit 7y agoIs it more risky than getting a fake cash from someone? Is it difficult to validate NFC with say...your phone (make sure the NFC signal changes when you bring it close to your phone)? For 2) I get the part about relaying communication but regardless of that, what makes you think any sort of communication will cause it to output the private key? As far as high powered NFC, I am not sure that would work to begin with (someone who knows radio explained it to me but I cannot recall) but even if it did how is it different than existing mobile phone NFC payment? You also gotta keep in mind,this is in-person. If someone defrauds you, they face several risks including law enforcement,legal,phsyical altercation(violence) and more. Better would be nice but I can live with "as good as cash" or "as good as mobile nfc payment" when it comes to security.
- londons_explore 7y agoAre there any solutions to the relay attack you describe? Perhaps by having the secure element "lock" and "unlock" each time the note changes hands, so that an attacker who uses a a relay will still have his note locked in a way that makes it useless unless he gives it to the recipient to unlock?
- andreareina 7y agoDepending on how much jitter there is in the time it takes to countersign the challenge, RTT might be one way.
- 34679 7y agoPut a bit more "N" in their NFC. They can be tuned to work from millimeters to meters.
- jefftk 7y agoYou could fix 2 by having a verifier that puts the note in a Faraday cage. While that's more work than just scanning with your phone it could still be cheap and worth it if you were receiving a lot of notes.
- paulgerhardt 7y agoThis specific man in the middle attack is risky in that it requires very close range, face to face interaction with your target, a fairly unreliable chance of success, and may only work on one of the four validation mechanisms. If effective the money is unlikely to propagate much further as the next user will fail to validate.