MIFARE: Интегрированные схемы для бесконтактных карт и систем доступа.

Brand of smart and proximity cards

MIFARE is a series of integrated circuit (IC) chips used in contactless smart cards and proximity cards. The brand includes proprietary solutions based on various levels of the ISO/IEC 14443 Type A 13.56 MHz contactless smart card standard. It uses AES and DES/Triple DES encryption standards, as well as an older proprietary encryption algorithm, Crypto 1. According to NXP, 10 billion of their smart card chips and over 150 million reader modules have been sold. The MIFARE trademark is owned by NXP Semiconductors, which was spun off from Philips Electronics in 2006.

The MIFARE Classic IC is just a memory storage device, where the memory is divided into segments and blocks with simple security mechanisms for access control. They are ASIC based and have limited computational power. Due to their reliability and low cost, those cards are widely used for electronic wallets, access control, corporate ID cards, transportation or stadium ticketing. It uses an NXP proprietary security protocol (Crypto 1) for authentication and ciphering. MIFARE Classic encryption has been compromised; see below for details. The MIFARE Classic with 1K memory offers 1,024 bytes of data storage, split into 16 sectors; each sector is protected by two different keys, called A and B. Each key can be programmed to allow operations such as reading, writing, increasing value blocks, etc. MIFARE Classic with 4K memory offers 4,096 bytes split into forty sectors, of which 32 are the same size as in the 1K with eight more that are quadruple size sectors. MIFARE Classic Mini offers 320 bytes split into five sectors. For each of these IC types, 16 bytes per sector are reserved for the keys and access conditions and can not normally be used for user data. Also, the very first 16 bytes contain the serial number of the card and certain other manufacturer data and are read only. That brings the net storage capacity of these cards down to 752 bytes for MIFARE Classic with 1K memory, 3,440 bytes for MIFARE Classic with 4K memory, and 224 bytes for MIFARE Mini. The Samsung TecTile NFC tag stickers use MIFARE Classic chips. This means only devices with an NXP NFC controller chip can read or write these tags. At the moment BlackBerry phones, the Nokia Lumia 610 (August 2012), the Google Nexus 4, Google Nexus 7 LTE and Nexus 10 (October 2013) can't read/write TecTile stickers.

MIFARE Plus is a replacement IC solution for the MIFARE Classic. It is less flexible than a MIFARE DESFire EV1 contactless IC. MIFARE Plus was publicly announced in March 2008 with first samples in Q1 2009. MIFARE Plus, when used in older transportation systems that do not yet support AES on the reader side, still leaves an open door to attacks. Though it helps to mitigate threats from attacks that broke the Crypto 1 cipher through the weak random number generator, it does not help against brute force attacks and crypto analytic attacks. During the transition period from MIFARE Classic to MIFARE Plus where only a few readers might support AES in the first place, it offers an optional AES authentication in Security Level 1 (which is in fact MIFARE Classic operation). This does not prevent the attacks mentioned above but enables a secure mutual authentication between the reader and the card to prove that the card belongs to the system and is not fake. In its highest security level SL3, using 128 bit AES encryption, MIFARE Plus is secured from attacks.

The MIFARE Ultralight has only 512 bits of memory (i. e. 64 bytes), without cryptographic security. The memory is provided in 16 pages of 4 bytes. Cards based on these chips are so inexpensive that they are often used for disposable tickets for events such as the 2006 FIFA World Cup. It provides only basic security features such as one time programmable (OTP) bits and a write lock feature to prevent re writing of memory pages but does not include cryptography as applied in other MIFARE product based cards.

Introduced at the Cartes industry trade show in 2008, the MIFARE Ultralight C IC is part of NXP's low cost MIFARE product offering (disposable ticket). With Triple DES, MIFARE Ultralight C uses a widely adopted standard, enabling easy integration in existing infrastructures. The integrated Triple DES authentication provides an effective countermeasure against cloning. Key applications for MIFARE Ultralight C are public transportation, event ticketing, loyalty and NFC Forum tag type 2.

It was introduced in 2022.

The MIFARE DESFire (MF3ICD40) was introduced in 2002 and is based on a core similar to SmartMX, with more hardware and software security features than MIFARE Classic. It comes pre programmed with the general purpose MIFARE DESFire operating system which offers a simple directory structure and files. They are sold in four variants: One with Triple DES only and 4 KiB of storage, and three with AES (2, 4, or 8 kiB; see MIFARE DESFire EV1). The AES variants have additional security features; e. g., CMAC. MIFARE DESFire uses a protocol compliant with ISO/IEC 14443 4. The contactless IC is based on an 8051 processor with 3DES/AES cryptographic accelerator, making very fast transactions possible. The maximal read/write distance between card and reader is , but the actual distance depends on the field power generated by the reader and its antenna size. In 2010, NXP announced the discontinuation of the MIFARE DESFire (MF3ICD40) after it had introduced its successor MIFARE DESFire EV1 (MF3ICD41) in late 2008. In October 2011 researchers of Ruhr University Bochum announced that they had broken the security of MIFARE DESFire (MF3ICD40), which was acknowledged by NXP (see MIFARE DESFire security).

A cloud based platform that digitizes MIFARE product based smart cards and makes them available on NFC enabled smartphones and wearables. With this, new Smart City use cases such as mobile transit ticketing, mobile access and mobile micropayments are being enabled.

In November 2010, security researchers from the Ruhr University released a paper detailing a side channel attack against MIFARE product based cards. The paper demonstrated that MIFARE DESFire product based cards could be easily emulated at a cost of approximately $25 in "off the shelf" hardware. The authors asserted that this side channel attack allowed cards to be cloned in approximately 100 ms. Furthermore, the paper's authors included hardware schematics for their original cloning device, and have since made corresponding software, firmware and improved hardware schematics publicly available on GitHub. In October 2011 David Oswald and Christof Paar of Ruhr University in Bochum, Germany, detailed how they were able to conduct a successful "side channel" attack against the card using equipment that can be built for nearly $3,000. Called "Breaking MIFARE DESFire MF3ICD40: Power Analysis and Templates in the Real World", they stated that system integrators should be aware of the new security risks that arise from the presented attacks and can no longer rely on the mathematical security of the used 3DES cipher. Hence, to avoid, e. g. manipulation or cloning of smart cards used in payment or access control solutions, proper actions have to be taken: on the one hand, multi level countermeasures in the back end allow to minimize the threat even if the underlying RFID platform is insecure," In a statement NXP said that the attack would be difficult to replicate and that they had already planned to discontinue the product at the end of 2011. NXP also stated "Also, the impact of a successful attack depends on the end to end system security design of each individual infrastructure and whether diversified keys – recommended by NXP – are being used. If this is the case, a stolen or lost card can be disabled simply by the operator detecting the fraud and blacklisting the card, however, this operation assumes that the operator has those mechanisms implemented. This will make it even harder to replicate the attack with a commercial purpose."

In September 2012 a security consultancy Intrepidus demonstrated at the EU SecWest event in Amsterdam, that MIFARE Ultralight product based fare cards in the New Jersey and San Francisco transit systems can be manipulated using an Android application, enabling travelers to reset their card balance and travel for free in a talk entitled "NFC For Free Rides and Rooms (on your phone)". Although not a direct attack on the chip but rather the reloading of an unprotected register on the device, it allows hackers to replace value and show that the card is valid for use. This can be overcome by having a copy of the register online so that values can be analyzed and suspect cards hot listed. NXP has responded by pointing out that they had introduced the MIFARE Ultralight C in 2008 with 3DES protection and in November 2012 introduced the MIFARE Ultralight EV1 with three decrement only counters to foil such reloading attacks.

For systems based on contactless smartcards (e. g. public transportation), security against fraud relies on many components, of which the card is just one. Typically, to minimize costs, systems integrators will choose a relatively cheap card such as a MIFARE Classic and concentrate security efforts in the back office. Additional encryption on the card, transaction counters, and other methods known in cryptography are then employed to make cloned cards useless, or at least to enable the back office to detect a fraudulent card, and put it on a blacklist. Systems that work with online readers only (i. e., readers with a permanent link to the back office) are easier to protect than systems that have offline readers as well, for which real time checks are not possible and blacklists cannot be updated as frequently.

Another aspect of fraud prevention and compatibility guarantee is to obtain certification called to live in 1998 ensuring the compatibility of several certified MIFARE product based cards with multiple readers. With this certification, the main focus was placed on the contactless communication of the wireless interface, as well as to ensure proper implementation of all the commands of MIFARE product based cards. The certification process was developed and carried out by the Austrian laboratory called Arsenal Research. Today, independent test houses such as Arsenal Testhouse, UL and LSI TEC, perform the certification tests and provide the certified products in an online database.

Card name Locality Type Details SUBE card Argentina (Buenos Aires) MIFARE Classic 1K Used for public transport, such as Metro, trains and buses Tarjeta Sin Contacto MOVI Argentina (Rosario) MIFARE DESFire EV1 SAM V2 Means of payment for urban transport and as of 2015 payment for public bicycles and parking meters. Adelaide Metro metroCard Australia (Adelaide) MIFARE DESFire EV1 Adelaide Metro network (Bus, Train and Tram) Baku metrocard Azerbaijan (Baku) MIFARE Classic 1K, MIFARE Plus S 1K For use on the subway rides on the Baku Metro. M Card Canada (St. John's) MIFARE Classic 1K Used on the Metrobus Transit system. Compass Card Canada (Metro Vancouver) MIFARE DESFire EV1 4K, MIFARE Ultralight (single use) Used for public transit (TransLink). $6 refundable deposit. Tarjeta Metroval Chile (Valparaíso) MIFARE Classic 1K Valparaíso Metro uses this card as a unique payment method Tarjeta Bip! Chile (Santiago de Chile) MIFARE Classic 1K and 4K (if bank bip or university bip are used) Metro de Santiago, Transantiago In Karta Czech Republic (nationwide) MIFARE DESFire, MIFARE DESFire EV1, Used for transport on trains, aimed at regular train users. Using the card enables 25% discount on fares. Hradecká kartaCzech Republic (Hradec Králové)MIFARE Classic 4KCard is issued by DPMHK a. s. (Transport company of Hradec Králové), no longer compatible with Pardubická karta. Matkakortti Finland (Helsinki) MIFARE DESFire Can be used with all forms of public transport systems within Helsinki Metropolitan Area. MetromoneyGeorgia (Tbilisi) MIFARE Classic 1KUsed in municipal transport (metro, bus) and while traveling by Rike Narikala ropeway. Delhi Metro Rail CorporationIndiaMIFARE UltralightUsed in Metro transit system and for paying fares in DTC and cluster buses. Namma Metro Smart Card India (Bengaluru) MIFARE DESFire EV1 Can be used to travel in Namma Metro in Bengaluru TFI Leap Card Ireland (Dublin) MIFARE DESFire EV1 replaces the individual Luas, Dart and Dublin Bus smartcards AltoAdige/Südtirol Pass Italy (Trentino Alto Adige/Südtirol) MIFARE DESFire EV1 Southern Tirol network (Bus, Train and Cable cars)Tallinja CardMaltaMIFARE Plus X 2KUsed by Malta Public Transport (buses); https://www. publictransport. com. mt/en/tallinja card AT HOP card New Zealand (Auckland) MIFARE DESFire EV1 Introduced as the regional integrated ticketing card. The previous branded HOP card aka "Snapper/HOP" uses the JCOP standard and was phased out of use in Auckland in 2013. SmartTech ProductionHong Kong MIFARE Golden Partner TransCard Slovakia MIFARE DESFire EV1 Used by almost every public transport system in Slovakia. In most cases only referred to as BČK – Bezkontaktná čipová karta (contactless smart card). Managed by Zväz autobusovej dopravy (Association of bus transport) as Slovenský dopravný pas (Slovak transport pass). Urbana Slovenia (Ljubljana) MIFARE DESFire EV1 Used by buses, parking spaces, libraries, museums, the Ljubljana Castle funicular, sports institutes and cultural events. T mobilitat Spain (Barcelona) MIFARE DESFire Metro, trains and buses, with compatibility with Bicing bike rentals, car parks. Resekortet Sweden MIFARE Classic 1K Travel ticket for buses and trains. EasyCard Taiwan MIFARE Classic, MIFARE Plus Oyster card United Kingdom (London) MIFARE DESFire EV1 Migrated from MIFARE Classic to MIFARE DESFire EV1 in 2011 Transit Access Pass United States (Los Angeles, California) MIFARE Classic 1K / MIFARE Plus Used as electronic ticketing for most public transport within Los Angeles County. Hop Fastpass United States (Portland, Oregon) MIFARE DESFire EV1 256B Breeze Card United States (Atlanta Metropolitan Area, Georgia) MIFARE DESFire EV1, MIFARE Ultralight (Breeze Ticket) Used on transport in the Greater Atlanta area on systems such as MARTA, CobbLinc, Ride Gwinnett, and GRTA Xpress regional busses. Clipper Card United States (San Francisco Bay Area, California) MIFARE DESFire EV1 4K Replacing TransLink, which used a Motorola Card. Talon Card United States (Kennesaw State University) MIFARE Classic 4K Used for door access and on campus payments SmarTrip United States (Washington Metropolitan Area, Washington, D. C.) MIFARE Plus X 2K Used on the Washington Metropolitan Area Transit Authority and neighbouring transit systems; accepted on systems in Baltimore, MarylandMetrorreyMéxico(Monterrey)MIFARE Classic 1KUsed in public transport like, metro, metrobus, and the new generation of metropolitan bus Muevo LeonBeep (smart card)Philippines (Metro Manila)MIFARE Classic, MIFARE DESFire EV1Used on the LRT Line 1 (Metro Manila), LRT Line 2, MRT Line 3 (Metro Manila), BGC Bus