Everywhere a question like this is asked, I see people responding that (in a scenario where a card is used) the card does some processing with the data it receives/generates some data when it receives a signal. How is this possible without power?

And even if that's the case, why can't every NFC tag in, let's say, credit cards just be cloned because there are no variables in them and only static data? You'd think those RFID tags could be copied and used for transactions.

  • 31
    Why do you think they have no power? Every article I can find on even passive RFID and NFC mentions how they obtain power from the radio signals. – schroeder Aug 1 '16 at 22:53
  • 4
    @schroeder: They have no power source. They do indeed use wireless power from the radio itself. – Mooing Duck Aug 2 '16 at 1:09
  • 20
    @MooingDuck So the power source is wireless power from the radio itself. They don't have no power source... – immibis Aug 2 '16 at 4:38
  • 4
    There are RFID tags which can be cloned. Cheaper models always respond with the same number, so you can easily read that number and create an RFID tag which sends the same. Only the more expensive tags use a challenge/response protocol with actual encryption. – Philipp Aug 2 '16 at 11:31
  • 1
    Some RFID can be cloned. github.com/linklayer/BLEKey – Guntis Aug 9 '16 at 16:31
up vote 203 down vote accepted

Because the cards contain a chip which are powered by a coil. The coil is not really a antenna, but half of a transformer.

Think your regular mobile charger. This contains a transformer, that will transform the voltage from 230V or 120V AC to 5V DC. This is done by having a coil magnetize some iron, and this iron magnetizes the "receiving coil". If you draw current from the receiving coil, the primary coil will also draw more current.

Now, let's go to the "passive" card again.

The reader is one half of a transformer, and the card is one half of a transformer, but this transformer does create a magnetic field in the air instead of magnetizing iron. When you put the card close to the reader, the reader and card becomes a full transformer, and thus the card can be powered, like it was connected to a battery.

For the reader to transmit information to the card, the reader only needs to vary the frequency or amplitude of the AC voltage that powers the primary coil. The card can sense this and act on this information. For the card to send information back to the reader, the card simply short-circuits its own antenna via a transistor and a resistor. This will, like the mobile charger, cause the primary coil, i.e. the coil in the reader, to consume more current, and the reader can sense this (by having the primary reader coil via a resistor and then measure the voltage over the resistor) and read the data the chip sends to the reader.

This means that half-duplex bidirectional communication is possible with RFID, thus the chip can do anything, and work like a contact smart-card. And as you know, a contact smart card with a security chip, that can securely store a key, and only perform operations with the key, is impossible to "clone" or "copy" as the key cannot be extracted. That's the security of smart cards, they cannot be cloned, and that's why they are preferred over magnetic strip cards.

Thus, the same applies to wireless/contactless RFID card.

  • 49
    I like how this answer also explains the low-level stuff like how the card actually gets powered and talks to the reader. – André Borie Aug 2 '16 at 2:48
  • 35
    I forgot i wasn't on the electronics stackexchange for a second.. good answer. – James Trotter Aug 2 '16 at 7:35
  • 3
    Disagree on the part of impossible to "clone" or "copy" . Anything that store digitally can be clone, just depends on difficulties and tech availability. security.stackexchange.com/questions/46319/… – mootmoot Aug 2 '16 at 11:11
  • 3
    @mootmoot Most smartcards do have special "tamper-resistant" circuity, that makes it impossible to "clone" or "copy" them. Some cards however, do have possibility to "clone" or "copy" with advanced microscopy and tampering, but if the card is a secure one, its impossible. – sebastian nielsen Aug 2 '16 at 11:32
  • 3
    About the attack you referred to in the link, thats another thing. If the challenges issued is predictable, you can simply store a copy of these challenges and their replies. That does not mean the card is cloned, it just means that the reader asked for something you can know in-future and thus be able to "fool" the reader with a fraudulent card. But the card is still unclonable such as when vulnerable readers are updated to use sufficently unpredictable challenges, its really impossible to clone the card. – sebastian nielsen Aug 2 '16 at 11:36

NFC (Near Field Communications) cards are not passive. NFC readers constantly transmit RF (radio frequency) energy; this is called a carrier signal. Very close to the reader (within one wavelength, putting the "Near" in Near Field Communications,) the RF transmission is strong enough to induce enough energy into the receiving antenna to power the circuit in the card. The card contains a computer chip that has a CPU that can process received data, a small amount of static memory, and the ability to "transmit" a response (transmission is achieved by attenuating the carrier signal.)

Mag stripe cards (those that have no embedded chip) are passive. They have only "static" authentication data, which is probably what you're thinking of. The data is encoded on the stripe at the bank when it's issued, and it's always the same data, read after read after read. The mag stripe is technically very limited, and contains only a few pieces of information. They are the PAN (Primary Account Number), cardholder name, expiration date, service code, and a secret value called the CVV (Cardholder Verification Value). In total, no more than 79 characters can be encoded on the first track of a mag stripe.

NFC chip cards used for payments are programmed to emulate the same 79 characters that you might find on a mag stripe card, with a couple of exceptions: they can listen for variable data transmitted by the reader, they can respond with whatever the chip is programmed to send, and each card contains a secret key that is known only to the bank that issued the card.

To communicate, the reader sends the chip some data about the transaction including a random "challenge" number. The chip then encrypts the challenge value (and other transaction data) with the secret key stored in the card. The chip then emits this computed value in place of the CVV. This is called "dynamic" authentication data, because the number is different with every transaction.

The reason these cards are not easily clonable is that nobody but the bank knows the secret key hidden in the chip, so nobody else can produce a card that will react the same way to the challenge that came from the reader, thus the cloned card cannot produce the correct CVV. The bank is responsible for detecting the incorrect CVV and rejecting the request from the cloned card.

Not all the systems in use today are perfect. Researchers (and criminals) have figured out several attacks. Some cards are inherently insecure because they use weak encryption (such as the MiFare cards often used in transit systems.) Some cards have had their secret keys read by using side channel attacks, such as power analysis or timing analysis. Some have been examined using ion beam microscopy, revealing the bits containing the secret keys. And some banks did a poor job initially implementing their secret keys such that they didn't validate the CVVs correctly.

Once a system is properly implemented, chip cards are very very difficult to clone, whether they be NFC read or inserted into a chip reader.

  • I thought I had read somewhere that the billing address is also stored on the mag stripe? – Dan Henderson Aug 3 '16 at 15:40
  • 1
    @DanHenderson, no, the ANSI/ISO standards for the mag stripe do not include any address info. Track 2 has a 4-bit numeric character set, and includes PAN, exp date, service code, and discretionary data, and can be a max of 40 characters. Track 1 has a 6-bit alphanumeric character set and adds the cardholder name to the data, but that's basically the only difference between tracks 1 and 2. Track 3 is not normally used for financial cards. Non-standard cards (gift cards, loyalty cards, etc.) are free to encode whatever they want, of course, but they won't work in anyone else's readers. – John Deters Aug 3 '16 at 20:46
  • Upon reflection, I think the context was that of a warning that a compromised reader could extract your personal info from the card; perhaps at one point, some issuers had put birth date and/or ZIP into the "discretionary data"? – Dan Henderson Aug 3 '16 at 20:57
  • It's possible that certain issuers have placed that kind of information in the discretionary data, but that would be for their own use. The contents of that field are not well defined, so a regular payment terminal such as you might find at a gas pump wouldn't know to look in that field for a ZIP code. And if you're sticking ZIP on the mag stripe for your own store's credit card, why not just look it up from your own database when you authorize their credit? Such a thing would likely be a historical leftover from the days before the PCI Data Security Standards. – John Deters Aug 3 '16 at 21:53
  • 1
    @DanHenderson, I just remembered that most state IDs and Driver's Licenses have mag stripes that contain address and birthdate information. If you're using a mag stripe reader to check IDs at a liquor store to prevent underage purchases), that data is at risk. But those are not payment cards and don't follow the payment card standards. – John Deters Aug 3 '16 at 22:44

How can RFID/NFC tags not be cloned when they are passive technology?

Your question assumes 2 things:

  1. That RFID tags cannot be cloned
  2. And they are passive, not active.

Both points are incorrect:

  1. RFID tags can be cloned. Tags which do not make use of password-protection or over-the-air (OTA) encryption can have their data banks copied into new tags.
  2. RFID tags (at least Class 1 Generation 2 tags, aka UHF RFID tags) are computationally active, not passive. Their "passive" nature refers to their not needing an attached power source.

RFID tags (at least "Class 1 Generation 2" tags) are transponders and they're powered by the very RF wave sent to query them.

The majority of RFID tags are not encrypted or have any secrets - they act like a barcode does and merely repeat the same information every time they're queried, in which case they can very easily be cloned.

However the Class 1 Gen 2 tags (at least) support features like passwords (the scanner includes a password in the RF signal sent to query the tags) and over-the-air encryption, though this is not a mandatory feature and not every Class 1 Gen 2 chip supports it.

Research has been done into the security of RFID, here is one such recent paper: The security of EPC Gen2 compliant RFID protocols.

I'll try to make it rather short and try to answer every question.

How is this possible without power?

There is power like usual. It works by the same electromagnetical principle as a transformer (which is contactless as well). Or like one of those modern(ish) contactless smartphone chargers where you just lay your phone on a plate instead of plugging it in anywhere. Or like an induction cooker (just with less power).

The fact that you do not need touch is just a technical detail; you can ignore it and treat it just like any other electrical connection.

there are no variables in them and only static data?

This is not necessarily the case. For example there are building access cards which have to be "loaded" (over the air) with the codes for the day each day to get access to certain locks. Or money cards which can be loaded up and "emptied" by paying stuff.

why can't every NFC tag ... just be cloned because

First, there is no reason to assume that the NFC tag behaves like a RAM module or USB stick, just presenting itself as a data storage device. That's not how it works.

There may be very simple NFC tags which are used as actual identification tags only; those can be made so they simply transmit their ID to whoever asks. This may be what a store can use to quickly scan some items (or to avoid theft). No secrecy is needed here, only identification. This likely the majority of all RFID tags produced.

If you want secrecy: things like money cards or building access cards with daily rotation of codes need onboard computing as well as some kind of encryption. Without going into details, this kind of encryption can be done in a way that the actual "secret" is safe inside the chip and not visible on the air at all. At no point do they allow to access the actual "secret", nor do they need to, similarly in the way that the secret keys in HTTPS/TLS never go in the clear over the insecure channel.

EDIT: replaced the last paragraph which could be read as TLS being used in RFID chips.

  • Compared to just passing data back and forth, TLS is very computationally intensive and needs quite a bit of storage space just for the crypto keys. I doubt a RFID or NFC tag or card has the processing power to do a full TLS-style encryption setup just for key exchange. That said, though, it's almost never needed; no need to use asymmetric encryption if symmetric crypto will do just as well. Which it does whenever both sides can store the key. – a CVn Aug 2 '16 at 19:07

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.