I familiarised myself with all available docs on mifare nested attack available, yet I fail to see how predicting tag nonce can help cracking keys.

When tag sends nonce (N_t), key stream ks1 is created using secret key, UID and N_t. Any further communication is encrypted, but the first nonce is always in plaintext. Now what extra information does predicting nonce give about keys? I cannot extract any further data due to encryption using keystream depending on the very key I am trying to crack.

These are the documents I read:

Mifare protocol guide

Cryptoanalytic attacks on MFC

Mifare protocol guide

BlackHat hacking MFC

Card only attacks on MFC

Video about mfoc by its creator and the slides from here

My problem is, I do not understand how predicting N_t (tag nonce) can reveal key.

  • Can you add links to the research you've already read in the question? And what specific part you're struggling with, please. Dec 7, 2015 at 9:41
  • Edited question, i put some docs i read but i did read bunch more. It says i should auth into knownkey sector, get Nt, then auth again into same sector with same key, get Nt' and based on timing distance predict any tag nonce in time and auth into different unknown key sector. How do i auth into unknown key sector without key? Thx
    – michnovka
    Dec 7, 2015 at 15:00
  • I added more sources that Ive read. Still no luck understanding this, Nt is in plaintext so whats so great about predicting it? I have no idea about any of the other params. Is there some weakness in crypto1 that is exploited? All the docs spend so much time on intro into MFC design and simple stuff and then they mention the core idea of the attack in 2 sentences... Auth into knownkey sector. then reauth again. predict Nt and auth into unknown key sector. But this has no logic, how can I auth into no known key sector???
    – michnovka
    Dec 7, 2015 at 21:21

1 Answer 1


I'll give my try to explain, though I give no guarantee for correctness and would be happy if someone provided a better answer, because, I too, struggle with fully understanding the complete attack.

The "offline nested" authentication attack requires a known key (can be recovered using MFCUK, or might be known, e.g. as a default key). The known key is used to authenticate to a sector using a constant tag nonce N_T and from there on perform nested authentication to another sector and key. The request resets the internal streamcipher state to the sector key. This time, the tag nonce is sent encrypted as {N_T} (also constant!).

The parity bits sent with the encrypted tag can be used to deduce some information on the nonce and reduce the possible number from 2^16 to 2^13 possibilities to speed up the attack. Every byte sent is followed by a parity bit, where the Mifare Classic computes parity over the plaintext, while the bit of the keystream used to encrypt the parity bits is used to encrypt the next bit of the plaintext. Additionally, if the reader sends the correct parity, but the wrong answer to the challenge (attacker can forge this situation), the tag sends an encrypted error code. With a chance of 1/256, the parity bits are correct, which leaks 12 out of 48 bits of entropy. The procecure can be repeated several times (~6 times) until the rest of the bits can be bruteforced using the obtained parity bits (the key should produce all of them).

The distance between the tag nonces used in consecutive authentication attempts strongly depends on the time between the attemts (LFSR shifts). Herein, the attacker uses a distance estimation and parity bits to guess the nonce and recover bits of the keystream (abusing the weak PRNG that allows only 16 possible nonces to gain 32 bits of keystream), while the fact, that only odd-numbered bits of the LFSR are inputs of the filter function, is used to recover 2^16 possible keys (direct inversion). Given a nonce, the attacker can generate all possible keys, only if the low-most 16 bit are correct, the generated key is a valid candidate.

The attacker can repeat the attack with other sectors until all keys are known. The keys of subsequent sectors can be recovered by passive eavesdropping, as just around 8 authentication attempts are needed.




Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.