4

I am new to NFC, and just have been researching on security from different manufacturers, trying to find out which system is more secure with their password protected area.

I only know that Desfire EV1 has the 3DES/3KDES, but totally no knowledge on Felica or ACOS, wondering if anyone has any info on it. I know of the older Desfire is known to be pretty weak in security, but EV1 has been ok up to now, how does it compare against Felica and ACOS?

If I have hidden data on a card (protected by password), and can only read the data when password is entered. Which system is the most secure for that?

||improve this question
1

DESfire before EV-1 (which was introduced in 2002) should indeed not be used any more and has not been recommended for use for more than five years. DESfire EV-1 (introduced ~2007) adds countermeasures against differential power analysis (which the non-EV-1 product lacked, leading to its eventual downfall), and AES-128. Since ~2014 there's even the newer DESfire EV-2 with better key management to delegate card space to third parties, proximity checks and better privacy options.

Felica is prevalent in Asia, but only added AES in around 2011.

I know nothing about ACOS except for its existence.

Note, if it isn't obvious: I'm biased towards DESfire EV-1, having worked with the cards in several projects.

For your basic problem of just storing data on a card that is to be read after authentication, disregarding all other things (authentication of data from the card, confidentiality of the data while in transit, etc.) it is likely that either system will work (and thus be indistinguishable). If you eventually want more, you probably don't want a niche product like ACOS (except of course if it happens to hit your niche exactly), so DESfire or Felica. The latter is mostly documented in Japanese, so if that's a problem, that's a problem.

||improve this answer
  • Sweet, thanks so much for your comment! I was looking into Desfire EV-2 but it isnt "released" yet, well can't be purchased yet anyway??And would you by any change know if Ultralight EV1 has the 3DES/AES protection, or just simple 32 bytes like NTAG 21x(Because the data i need to store is just around 200-300bytes) but i just need the security to be tight(So the data definitely can not be read before authentication). – clark Oct 10 '15 at 14:08
  • Mifare Ultralight EV1 only has a 32-bit password read protection (albeit with an optional failure counter) and no cryptographic algorithms of any kind (hence the name). Within the Mifare line the current in-between product between DESfire (cryptography and filesystem) and Ultralight (no crypto, no files) would be Mifare Plus: This has AES for authentication and protection, but is less flexible than DESfire. – Henryk Plötz Oct 10 '15 at 21:42
  • Ah, ok thanks, i took a look at the Mifare plus, it seems to be more expensive than the EV1... but less flexible? – clark Oct 11 '15 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.