Can Mifare Classic 1k be used for micro payments in a secure way?
I have a system in mind for use in a arcade game saloon. You are getting a card from cashier and can top it up for example with 100 points (they are written on the card not in database and only using ID). Then you can go to each machine, scan the card on the reader and your points will get decreased, and points left will be displayed on the lcd.
So each time you are scanning the card it writes new data and check its integrity.
Is this possible to be fully bullet proof, and cannot be copied over some custom hardware?
I'll create hardware to accept payments on the arcade games, and software/hardware for top-up operations.
I was thinking about a solution where I'll save a hash (with some secret seed) of unique id of the card, and current points amount and save it within the eeprom of the card (with points amount of course). I can wrap it up within a AES or 3DES block for extra security. I'll store the keys and hashing within the hardware so it will be pretty secure.
My concerns are:
- What if somebody will take the card during write operation?
- Will somebody be able to copy the card to some kind of emulator with its unique identifier and eeprom content?
- Maybe there is another routine to use, better then "read, write, check" and turn on the game?
- I red that Mifare DesFire standard is for micropayments solutions, but cards are more expensive, hardware probably also. However maybe somebody have some experience and its not as scary as it looks?
- Anybody have any hardware recommendations for Mifare of course.
Much appreciate any input.