Dear MIFARE Classic user,

NXP has noted the information from the ministry of Interior based on the claims that the University of Nijmegen made on March 12th 2008 regarding the specific use of MIFARE Classic chips for access management applications.

Although MIFARE Classic is predominantly used in public transport infrastructure, there are a considerable number of installations using the chip technology also in access management implementations.
NXP confirms that MIFARE Classic encryption is not supplied for electronic passports.

NXP takes these concerns very serious and we are closely looking into this. We are also informing the system integrators which we know may have designed systems using MIFARE Classic chip technology about the recent developments so that they can review their systems together with their customers.

Access management measures for buildings and properties are - even more than in other applications - formed as end-to end systems comprising multiple layers. Depending on the specific security requirements of the respective facility, access management systems are complemented by additional measures on site, such as security personnel, camera surveillance or other means to detect suspicious activities.

NXP would like to point out, that in practice the assessment of costs versus security that is selected by system integrators and their customers vary greatly. Many systems use for example pin codes, magnetic stripe cards or 125 KHz long range contactless cards without any encryption. These access management schemes are often deemed sufficient to meet the requirements of the total system.
We are reaching out to system integrators to closely review their systems in light of latest developments, in light of the assets that are protected and in relation to other protection in place. This way they can establish whether their systems can remain as they are, or whether these would require an upgrade.

NXP is the industry leader in contactless and security, and presents with the MIFARE portfolio the largest and most competitive offering, which has become the industry's choice.

This wide range of chips offers varying degrees of functionality, performance, security and strength of encryption, so that system integrators can choose the appropriate solution in terms of chip security and back end system to address their requirements. MIFARE Classic provides a benchmark in cost competitiveness as well as proven contactless performance, while the recently announced MIFARE Plus (samples available in Q4 2008) enables an optimal future-proof migration path when necessary. Both, MIFARE Plus and our high-end product MIFARE DESFireEV1 offer strong AES encryption and are targeted to receive the internationally recognized Common Criteria certification.

NXP continues to monitor the situation, evaluates its products and security measures, and remains open to discussions with all interested parties.