Secure recharge of disposable RFID tickets Riccardo Focardi - PowerPoint PPT Presentation

Secure recharge of disposable RFID tickets Riccardo Focardi Flaminia Luccio Universit` a Ca’ Foscari, Venezia { focardi,luccio } @unive.it FAST 2011 15-16 September 2011, Leuven FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 1 / 17

Outline Introduction 1 RFID Tickets Mifare Ultralight 2 Security mechanisms Attacks 3 Cloning/restoring a card Lesson learned A new API 4 Type-based analysis Conclusion and related work 5 FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 2 / 17

Introduction RFID technology Radio Frequency IDentification (RFID) is more an more used transportation and logistics 1 hospitals 2 inventory 3 passports 4 ski resorts 5 race timing 6 animal identification 7 human implant (!?) 8 ... 9 FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 3 / 17

Introduction RFID technology Radio Frequency IDentification (RFID) is more an more used transportation and logistics 1 hospitals 2 inventory 3 passports 4 ski resorts 5 race timing 6 animal identification 7 human implant (!?) 8 ... 9 FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 3 / 17

Introduction RFID Tickets RFID tickets RFID cards for public transportation disposable cards chip-on-paper, very cheap 1 one or more tickets of the same kind 2 non-rechargeable 3 minimal security mechanisms 4 personal cards plastic, credit-card like cards 1 tickets or different contracts on the same card 2 rechargeable 3 strong authentication mechanisms 4 FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 4 / 17

Introduction RFID Tickets How do they work? ISO/IEC 14443: very popular HF (13.56 MHz) standard for ‘proximity cards’ used for identification proximity cards and proximity coupling device, i.e., the reader initialization and anticollision: the reader talks with exactly one card if more are in the field card API: the card implements a set of functions that can be invoked by the reader secure module: the reader may have a Security Access Module (SAM) to perform cryptographic operations and authentication security mechanisms: are specific for a certain card (and its API) FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 5 / 17

Mifare Ultralight Mifare Ultralight cards (a) Memory organization Byte number → 0 1 2 3 Page ID ID0 ID1 ID2 Check1 0 ID ID3 ID4 ID5 ID6 1 Check/Lock Check2 Internal Lock0 Lock1 2 OTP OTP OTP OTP OTP 3 Data R/W R/W R/W R/W 4 Data R/W R/W R/W R/W 5 Data R/W R/W R/W R/W ... Data R/W R/W R/W R/W 15 (b) Lock bytes Lock0 and Lock1 Lock0 L 7 L 6 L 5 L 4 L 3 BL 1 BL 2 BL OTP Lock1 L 15 L 14 L 13 L 12 L 11 L 10 L 9 L 8 FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 6 / 17

Mifare Ultralight Security mechanisms Security mechanisms very simple API: read/write of pages with some limitations: unique ID: read-only, included in encryptions or MACs to avoid card 1 cloning OTP: One Time Programmable, monotone, prevents ticket reuse 2 lock bytes: for read-only time-based contracts, e.g. skipass 3 block locking bits: prevent locking of pages that need to be modified, 4 e.g., the OTP no security API: security is built on top of the above mechanisms ⇒ security flaws found in real application, e.g., the OV-chipkaart in Amsterdam and Rotterdam. FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 7 / 17

Attacks Cloning/restoring a card Example (Card cloning) read(4 : 7); Sample (flawed) code for if ( MAC K ( p 4 , p 6 ) = p 7 ) then consuming n tickets from a p 4 := p 4 − n ; p 5 := BUS ID (); card p 6 := TIMESTAMP (); p 7 := MAC K ( p 4 , p 6 ); write(4 : 7); 0, 1 Id 2 Lock 3 Otp 4 R 5 D 1 6 D 2 7 MAC K (R , D 2 ) FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 8 / 17

Attacks Cloning/restoring a card Example (Card cloning) read(4 : 7); Sample (flawed) code for if ( MAC K ( p 4 , p 6 ) = p 7 ) then consuming n tickets from a p 4 := p 4 − n ; p 5 := BUS ID (); card p 6 := TIMESTAMP (); p 7 := MAC K ( p 4 , p 6 ); write(4 : 7); Id ′ 0, 1 Id 0, 1 2 Lock 2 3 Otp 3 4 R 4 5 D 1 5 6 D 2 6 7 MAC K (R , D 2 ) 7 FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 8 / 17

Attacks Cloning/restoring a card Example (Card cloning) read(4 : 7); Sample (flawed) code for if ( MAC K ( p 4 , p 6 ) = p 7 ) then consuming n tickets from a p 4 := p 4 − n ; p 5 := BUS ID (); card p 6 := TIMESTAMP (); p 7 := MAC K ( p 4 , p 6 ); write(4 : 7); Id ′ 0, 1 Id 0, 1 2 Lock 2 3 Otp 3 COPY 4 R = ⇒ 4 R 5 D 1 5 6 D 2 6 D 2 7 MAC K (R , D 2 ) 7 MAC K (R , D 2 ) FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 8 / 17

Attacks Cloning/restoring a card Example (double-use) read(0 : 7); if ( MAC K ( p 0 , p 1 , p 4 , p 6 ) = p 7 ) then Including the Id in the MAC p 4 := p 4 − n ; prevents cloning p 5 := BUS ID (); p 6 := TIMESTAMP (); p 7 := MAC K ( p 0 , p 1 , p 4 , p 6 ); write(4 : 7) 0, 1 Id 2 Lock 3 Otp 4 R 5 D 1 6 D 2 7 MAC K (Id , R , D 2 ) FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 9 / 17

Attacks Cloning/restoring a card Example (double-use) read(0 : 7); if ( MAC K ( p 0 , p 1 , p 4 , p 6 ) = p 7 ) then Including the Id in the MAC p 4 := p 4 − n ; prevents cloning p 5 := BUS ID (); p 6 := TIMESTAMP (); p 7 := MAC K ( p 0 , p 1 , p 4 , p 6 ); write(4 : 7) 0, 1 Id 2 Lock COPY = ⇒ 3 Otp R , D 2 , MAC K (Id , R , D 2 ) 4 R 5 D 1 6 D 2 7 MAC K (Id , R , D 2 ) FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 9 / 17

Attacks Cloning/restoring a card Example (double-use) read(0 : 7); if ( MAC K ( p 0 , p 1 , p 4 , p 6 ) = p 7 ) then Including the Id in the MAC p 4 := p 4 − n ; prevents cloning p 5 := BUS ID (); p 6 := TIMESTAMP (); p 7 := MAC K ( p 0 , p 1 , p 4 , p 6 ); write(4 : 7) 0, 1 Id 2 Lock COPY = ⇒ 3 Otp use tickets R , D 2 , MAC K (Id , R , D 2 ) 4 R − n D ′ 5 1 D ′ 6 2 MAC K (Id , R − n , D ′ 7 2 ) FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 9 / 17

Attacks Cloning/restoring a card Example (double-use) read(0 : 7); if ( MAC K ( p 0 , p 1 , p 4 , p 6 ) = p 7 ) then Including the Id in the MAC p 4 := p 4 − n ; prevents cloning p 5 := BUS ID (); p 6 := TIMESTAMP (); p 7 := MAC K ( p 0 , p 1 , p 4 , p 6 ); write(4 : 7) 0, 1 Id 2 Lock COPY = ⇒ 3 Otp use tickets R , D 2 , MAC K (Id , R , D 2 ) 4 R 5 D 1 RESTORE ⇐ = reuse the card arbitrarily D ′ 6 2 7 MAC K (Id , R , D 2 ) FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 9 / 17

Attacks Cloning/restoring a card Example (the OTP) read(0 : 7); Use the OTP to count if ( MAC K ( p 0 , p 1 , p 3 , p 6 ) = p 7 ) then resources on the card p 3 := incOTP n ( p 3 ); (initialized as 32 − R) p 5 := BUS ID (); p 6 := TIMESTAMP (); p 7 := MAC K ( p 0 , p 1 , p 3 , p 6 ); write(3 : 7) 0, 1 Id 2 Lock 3 Otp 4 5 D 1 6 D 2 7 MAC K (Id , Otp , D 2 ) FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 10 / 17

Attacks Cloning/restoring a card Example (the OTP) read(0 : 7); Use the OTP to count if ( MAC K ( p 0 , p 1 , p 3 , p 6 ) = p 7 ) then resources on the card p 3 := incOTP n ( p 3 ); (initialized as 32 − R) p 5 := BUS ID (); p 6 := TIMESTAMP (); p 7 := MAC K ( p 0 , p 1 , p 3 , p 6 ); write(3 : 7) 0, 1 Id 2 Lock COPY = ⇒ 3 Otp Otp , D 2 , MAC K (Id , Otp , D 2 ) 4 5 D 1 6 D 2 7 MAC K (Id , Otp , D 2 ) FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 10 / 17

Attacks Cloning/restoring a card Example (the OTP) read(0 : 7); Use the OTP to count if ( MAC K ( p 0 , p 1 , p 3 , p 6 ) = p 7 ) then resources on the card p 3 := incOTP n ( p 3 ); (initialized as 32 − R) p 5 := BUS ID (); p 6 := TIMESTAMP (); p 7 := MAC K ( p 0 , p 1 , p 3 , p 6 ); write(3 : 7) 0, 1 Id 2 Lock COPY = ⇒ 3 Otp + n use Otp , D 2 , MAC K (Id , Otp , D 2 ) 4 D ′ 5 1 D ′ 6 2 MAC K (Id , Otp + n , D ′ 7 2 ) FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 10 / 17

Attacks Cloning/restoring a card Example (the OTP) read(0 : 7); Use the OTP to count if ( MAC K ( p 0 , p 1 , p 3 , p 6 ) = p 7 ) then resources on the card p 3 := incOTP n ( p 3 ); (initialized as 32 − R) p 5 := BUS ID (); p 6 := TIMESTAMP (); p 7 := MAC K ( p 0 , p 1 , p 3 , p 6 ); write(3 : 7) 0, 1 Id 2 Lock COPY = ⇒ 3 Otp + n use Otp , D 2 , MAC K (Id , Otp , D 2 ) 4 5 D 1 RESTORE ⇐ = FAIL! D ′ 6 2 7 MAC K (Id , Otp , D 2 ) FAST 2011 () Secure recharge of disposable RFID tickets September 2011, Leuven 10 / 17