How to determine the authenticity of a DESFire EV1 card

[C C]

I'm trying to implement the procedure that the app would perform the access operation only if the target DESFire is the original card. That means it is not cloned.
I'd like to know how DESFire prevent from being cloned. And, how can we developers determine whether the target card is cloned or not.
Thanks.

---

+ 0  |  - 0

[mifaresdk]

Hi,

If you (or your company) are the issuer you know about the originality of the MIFARE products from the certificates of your supplier.

You can get more information about originality checking of our products here:
https://www.mifare.net/en/products/tools/nxp-originality-checker


The MIFARE Team

---

+ 0  |  - 0

[C C]

Hi,

Thank you for replying.
Can I implement a component like "NXP Originality Checker Reader" in my own app on Android? I mean each time a user tap a registered card on the mobile phone, the app would know whether this card is the original nxp card or cloned card.

---

+ 0  |  - 0

[mifaresdk]

Hi,

There is no component “NXP Originality Checker Reader” which we provide as a module for implement it in customer software.

To check if a card is a clone card or not is an important question. But it is detached from the role of implementing your application on a MIFARE DESFire EV1 (or EV2). It is up to the card issuer to ensure no clones are issued to end-users. So, you as card issuer can participate on NXP’s efforts to guarantee the high quality of standards of our products. With the NXP Originality Checker Reader you can get a reliable tool to check MIFARE products before these are issued to end-users.

Regards,
The MIFARE Team

---

+ 0  |  - 0

[C C]

Hi,

I got your idea. You are saying that the issuer should distribute reliable cards to end-users. I agree with that.
What confuses me is how can I know the card is the original one during the use. For example, a company issues the DESFire EV1 card as value cards, to customers. Customers can store value in the card. They can use the card value both in offline shops by tapping on a card reader and online shops by tapping to their Android phones. An application on Android is going to accept the payment by reading the card to deciding if the customer is really a registered customer and whether there is enough stored value in his card. In this scenario, the company can make sure that they issue the reliable DESFire cards to customers. However, on the application side, it also needs to make sure the card is not faked. If the card can be cloned and the app fails to detect the clone card, a cheater could abuse the card in online shops by tapping a clone card on his phone.
So I'm thinking, is it possible for an app to know the originality of the DESFire?
Thanks. Hope to here from you soon.

---

+ 0  |  - 0

[mifaresdk]

Hi CC,

First of all I have to correct my statement in the previous post. I have heard that the development team is going to include originality checking into the MIFARE SDK in one of the next releases. I do not have any details yet but it might be interesting for you to know.

I understand your concern about clone cards, but let us think a moment about the initial situation. What does this implies? If you deal with money accounts on smartcards you protect the account itself and the access conditions on the reader station against unauthorized access. This means to protect your money and has nothing to do if the card is a clone card or not.

What I want to explain in my previous post is: if you are the issuer of the card, the question whether the card is a clone or not, lays in your hands! And looked at from the other side: what would you do if you detect a clone card in an end-users hand? First answer, it was issued in your office - and the ball is now in your court again. Second answer, someone find a way to steal the credentials and creates a duplicate. If this happen you have a problem! If someone is able to do this, it is also able to make a copy to a genuine MIFARE card.

The clone card problem is really a “bad user experience problem”. Clone cards are often weak manufactured and does not fulfil the technical specifications. This can be seen in defects and spontaneous failures at the reader station. The end-user see a smartcard which sometimes works and sometime does not. Failures in booking accounts result in big trouble on your side and on end-users side. A user which made such kind of experience will relinquish your service and your business.

My advice is to spend effort to protect the credentials, use approved techniques and encrypt the data communication. Use methods which makes it difficult to damage your business, even if someone is able to duplicate one card. For instance the key diversification approach uses for each card a unique key. If someone is able to compromise the key for one card, only this dedicated card is affected but not all others.

Sorry for my long explanation today,
The MIFARE Team

---

+ 0  |  - 0

[C C]

Hi,

Thank you very much for the elaborate explanation. It is a good advice to protect the credentials. I think DESFrie cards are with a lot of security features to protect the stored credentials.

I'm asking the question because I just read a research paper saying that it can clone DESFire card. The link is here . I'd like to know if the attack gets access to a DESFire card, which adopts both master key and application key properly, is it possible for the attacker to clone the whole card without cracking the master key or application key? By the whole card, I mean not only the memory for storing user data but also the memory for manufacturer, including the memory storing UID and keys.

---

+ 0  |  - 0

[C C]

The link to the paper is http://proxmark.nl/files/Documents/13.56%20MHz%20-%20MIFARE%20DESFire/Cloning_Cryptographic_RFID_Cards_for_25USD-WISSEC_2010.pdf

---

+ 0  |  - 0

[mifaresdk]

Hi CC,

Thank you for providing the paper. This paper is not new for us. If you read the first paragraph of page 8 carefully, you verify that the attack is currently NOT applicable and works only with our legacy product DESFire and DOES NOT WORK with our current product DESFire EV1.

If we talk about “clone cards” we mean cards which are offered as blank MIFARE products which are not manufactured by NXP or any other licensed manufacturer. These cards are replicas which behaves more or less like a MIFARE product. Using these products may cause failures and “bad user experience” in the field. You should avoid using this cards and we as NXP help you with our Originality Checker Tools to detect this false MIFARE cards.

The MIFARE Team

---

+ 0  |  - 0

[C C]

Hi,

I see... I used to understand "clone cards" as one can clone all the user memory and manufacturer memory of a NXP card to a different non-NXP card or card emulator. So If I protect the data stored in DESFire card are properly by using master key and application key, I don't need to worry about the whole card, including the user memory and manufacturer memory, being cloned?

Thank you.
CC

---

+ 0  |  - 0

[mifaresdk]

Hi CC,

We have two topics in this thread: protect your data and prevent the theft on one side and avoid issuing inferior products to your end-users on the other side. In both topics it is your natural duty as issuer to do well: prefer strong cipher like AES128 (in contrast to single DES) where data have to be encrypted, use CMAC base signing where data do not need to be encrypted but protected against changing. Use smart cryptographic methods like key diversification to ensure every card uses a unique key (so the master key is never used directly). Protect your reader terminal against attacks where you never store the keys in software, but use a hardware keystore instead where the keys cannot be read-out etc. And at the end: MIFARE products are security relevant products! Therefore never buy MIFARE products from uncertain sources in the net, use always serious distributors and sellers which are well known and have a business tradition.

The MIFARE Team

---

+ 0  |  - 0

[C C]

Hi,

I'm quite new in contactless card, but I've understood both threads we discussed thanks to your elaborate explanation. Thank you very much.

---

+ 0  |  - 0

[Author]

Posts