New Attack on Crypto-1

15 April 2008

The Crypto-1 stream cipher used in Mifare Classic smart cards has been broken yet again. The new attack is the most efficient one yet taking only 12 seconds to recover the secret key. In this algebraic attack, we construct a system of linear equations that describe the cipher and then solve this system for a given authentication using MiniSAT to recover the secret state and ultimately the secret key. The attack can operate on passively sniffed data which enables an attacker to gather the required data from meters away. Unlike previous attacks, it also works regardless of the quality of random numbers.

The Mifare Plus card that is meant to replace Mifare Classic in legacy installation is only marginally affected by the new results. Mifare Plus includes AES encryption—an open cipher that is generally assumed to be very secure.