How MIFARE Uses Cookies

[Ibrahim KAMAL]

France's sales rep. are still on vacation, so i am continuing to try and dig my way through this. (till we setup that NDA)

As funny as it may seem, i was able to get like 90% of it working.

I can authenticate.
I can create an AID, and create a file in that AID.
I can change access settings to make it readable only after authentication.

So far, so good!

No the very last bit i am trying to achieve is to encypher the data transfer. For instance, if i am trying to read "Hello World" from the DesFire card, i don't want this string to be "sniffable", if you see what i mean.

So, In the libFreeFare (from which i am inspired) I fond a option to change communication mode from "PLAIN" (0x00) to "ENCIPHERED" (0x03). I did that, and indeed, now I can't read back the correct data, even with correct key.

The problem i get is that I can't get a correct CRC from deciphered data.

My question is more of a programming one: How can start searching for where the problem is? What is the best methodology to try to understand which part is broken?

I've double checked my CRC algorithm, and it's the same i can find in various project on the web, so i don't suspect it's the problem.

Thanks,

---

+ 0  |  - 0

[Ibrahim KAMAL]

my company, Ikalogic, have existed for almost 10 years now :)

The company name is IKALOGIC, and our legal address is

19 Rue Columbia
87000
Limoges, France

Thanks for your help!

---

+ 0  |  - 0

[Ibrahim KAMAL]

Okay! Thanks to your hints, i was able to concentrate on 2K3DS only, and now, i found a little bug in my cypher and fixed it.

So, here is the sequence now:

MCU: 00 00 02 0a 00

TAG: 60 06 03 01 00 01

TAG: 00 00 09 af a4 83 00 fb 5e 29 fd 78



MCU: 00 00 11 af 8c a6 4d e9 c1 b1 23 a7 ed bf ce 53 48 6b 6d 00

TAG: 60 06 03 01 00 01

TAG: 00 00 09 00 8c a6 4d e9 c1 b1 23 a7

As you can see, i no longer "AE" error code.

Now, I am wondering, is it normal that desfire card replies this "00 8c a6 4d e9 c1 b1 23 a7" ? What does that "00" the beginning mean? I was expecting to get 0xAF, like the for the first answer from the tag..?

Thanks!

---

+ 0  |  - 0

[Ibrahim KAMAL]

Hi!

Thanks for those answers.

Unfortunately, i still don't have access to the docstore.

Any idea how much time it takes (in the middle of august!) to get some response from NXP? :)

---

+ 0  |  - 0

[Ibrahim KAMAL]

Still truncated (if an admin can delete all those messages, please, be my guest!)

MCU -- 00 00 02 1a 00

TAG -- 60 06 03 01 00 01

TAG -- 00 00 09 af 57 d2 fc d6 a2 5f 4f 73

MCU -- 00 00 11 af 8c a6 4d e9 c1 b1 23 a7 fe bf 9c 9d 25 a3 f6 4b

TAG -- 60 06 03 01 00 01

TAG -- 00 00 01 ae

---

+ 0  |  - 0

[Ibrahim KAMAL]

And again it got truncated! let's see if changing the tag character helps:

NCI --> 00 00 02 1a 00

NCI <-- 60 06 03 01 00 01

NCI  00 00 11 af 8c a6 4d e9 c1 b1 23 a7 fe bf 9c 9d 25 a3 f6 4b

NCI <-- 60 06 03 01 00 01

NCI <-- 00 00 01 ae

---

+ 0  |  - 0

[Ibrahim KAMAL]

I don't know why the authentication transaction below got truncated, here is the full listing:

NCI >> 00 00 02 1a 00
NCI << 60 06 03 01 00 01
NCI <> 00 00 11 af 8c a6 4d e9 c1 b1 23 a7 fe bf 9c 9d 25 a3 f6 4b
NCI << 60 06 03 01 00 01
NCI << 00 00 01 ae

---

+ 0  |  - 0

[Ibrahim KAMAL]

oops - now i know what the spoiler does! and I also know i can't edit the messages it seems..!

---

+ 0  |  - 0

[Author]

Posts