I wonder whether it is possible to make a fake card that generates a new key / ID / whatever on each use. If so, this would completely break the offline part o

I wonder whether it is possible to make a fake card that generates a new key / ID / whatever on each use. If so, this would completely break the offline part of the system. You couldn't rely on hotlists of known-hacked cards any more, you'd need to check each (new) card with a central system to see if its key was ever actually issued to anybody. This is assuming there's an actual list of currently issued keys anywhere, if such a list doesn't exist, the whole system would be done for. The fact that some smartphones can emulate NFC-F doesn't help either. If a hacking technique is ever discovered, we can get from the system being fully secure, to anybody being able to issue themselves undetectable cards for any amount, in the matter of days. With counterfeit physical cards, you can at least try to shut down manufacturers and issue long prison sentences to the dealers selling them on the black market. The criminal activity has to happen in the country where the cards are used by definition, so that country can bring its law enforcement to bear. If all you have is an Android apk and some source code released by three guys in Russia, there's very little you can do. If such a system were designed in the 2020s, you could establish a CA-like system, where each card's key must be signed by a chain of certificates. This way, thoroughly hacking just one card wouldn't help, as its key could easily be revoked, and you couldn't issue new ones without hacking the (presumably airgapped) card manufacturing systems that contain the signing keys. I don't think a system from the late '80s does this, though.