MIFARE Classic default keys

Here are some default transport keys for empty (factory issued) Mifare Classic tags.

ffffffffffff
a0b0c0d0e0f0
a1b1c1d1e1f1
a0a1a2a3a4a5
b0b1b2b3b4b5
4d3a99c351dd
1a982c7e459a
000000000000
d3f7d3f7d3f7
aabbccddeeff

Since MIFARE Classic has been hacked time and again, it should be used for prototyping and experimenting only. Roel Verdult of Radboud Uni. has a good lecture on "classic mistakes" :)

RFID Sniffer

Keep your key cards close and wrapped in tin foil, hackers are out and about armed with RFID Sniffers ;)

More on the sonMicro 13.56MHz reader module here and here.

G&D microSD cryptocontroller

A new microSD card containing a secure element and cryptocontroller has been released by G&D. It supports ECC up to 521 bits (F_p, I assume, and not F_2m), AES-256 and SHA-512. The main functionality is strong authentication to allow secure phone calls.

Note: authentication is all well and good, but the security chain is only as strong as its weakest link.The main problem with open systems and mobile/ad hoc clients is key management, and I have yet to come across a practical, secure and dynamic solution in the Secure Voice market.

New developments

The contactless sector has now reached the start of the snowball phase, with several NFC pilot projects being announced weekly, new NFC devices being released (Inside Contactless, Infineon and G&D partnership)  bi-weekly, and new TSM service providers and brokers (Ericsson IPX: TSM) going public once a month.
Huge multinational customers are finally getting in on the action (Coca-Cola, Disney, Barclays, and many more).

If the current trend continues, I predict (based on my impressions, for what they're worth) further linear growth in R&D and market size until end Q2 2011. In the next two years we'll see most of the innovation taking place; market penetration rate should reach its peak at the end of 2012. I look forward to revisiting this prediction :)

SWP-enabled SIM cards

SWP support is slowly becoming more widespread among mobile phone vendors, but there are almost no NFC-enabled SWP UICCs to be found. Gemalto has come up with their own SWP&NFC UICC prototype for a pilot study in Singapore. Note that WatchData (SIMPass) and Bladox (Waver) have been doing similar product development but without the SWP functionality. In fact, WatchData argues that SWP is overrated and unattractive for handset vendors.

I think Bladox will be - for the near future - a better choice than Gemalto from the viewpoint of small startups who are looking to source NFC-enabled SIM cards.

Edit 2011-01-05:
On Track Innovations now also offers an NFC-enabled SIM+antenna. No other information e.g. SWP support.

Java Card applets access via web page, JavaScript and javax.smartcardio

Springcard blog describes an interesting way to access smart cards: via web browser, JavaScript and javax.smartcardio (PC/SC reader).

I'm in some doubt as to the usefulness of this... after all, a smart card is a trusted portable device and tying it down (leaving it in the reader connected to a PC) and making it directly accessible to the whole world via the internet (even if the webpage requires authentication) makes no sense.


Certainly, you could use this way for a mockup or demo where you need to authenticate directly to some TPM or HSM. But I don't see any commercial use-cases for this yet.

Contactless card + GUI = killer app.

This device from Toppan is a smart card with a built-in GUI: screen and buttons. It's not clear whether the card has on-board battery or whether the GUI is active only when the card is in the reader field. (Image used without permission.)