Here’s an app note from Maxim: Ubiquity of NFC-enabled phones leads to strong brand protection
Counterfeiting has grown tremendously over the last decade. Fortunately, there are several anticounterfeiting solutions. Of these, an authentication based on challenge-response allows a much stronger protection than secure printing or unique ID RF tags. This application note presents the benefits of RFID tags based on crypto-strong authentication. It explains how these benefits enable the consumer to check for the authenticity of luxury goods by simply tapping their near-field communication (NFC)-enabled phones.
A similar version of this article appeared in German on Elektronik Praxis, August 13, 2012.
I really dislike how maxim describes this as if they had invented the challenge response security.
SMART cards have used this successfully for ages, unlike dump wired logic memory tickets.
(heh, dumb, not dump)
Slightly surprised that they’re making a big deal out of UID being forged. It’s not exactly difficult to go out and buy NFC tags that all have the same UID (!). I wonder how well stored the secrets really are.
In-field NFC deployments are a perfect example of security through obscurity. Access control applications being the worst of all.
In most cases data stored on proximity cards have little or no encryption whatsoever.
Looking at figure 1 of the app note, you can quite easily get the UID (nothing special), and challenge. All you’ve got to guess after that is a 64bit secure key… Doesn’t seem that hard to crack. Or am I missing something?
that’s not a key, but a secret. You would need an exhaustive search to find it, because sha-1 is likely to be secure for such small messages. The challenge cannot be arbitrary long, so you can’t envision collision attacks here.
but the 512-bit SHA-1 mention is bullsh*t because that’s only the internal sha-1 state; the output is 160 bits.
One of the problems here is that the reader is authenticating the tag, but not the reverse. So half of the security is left behind.
security does not rely on a tag or algorithm, but on a full framework of use cases.