Are NFC tags with cryptographic features "write-only"?

Question

I was wondering how exactly cryptographic NFC tags/cards retain their security. I read that there are certain types of cards that are able to perform symmetric or asymmetric cryptography. These cards are said to never reveal the respective key stored inside them, obviously. The reader would provide them with a challenge, the card performs an operation on the challenge and sends it back to the reader which can verify the result with its respective key.

But how do you get the key into the card? I imagine there must be some sort of a write operation at hand, so that the issuer (not the manufacturer) can rewrite and reuse cards at will. That would mean that any third party would also be able to write to the chip, but the worst they can do is "break" it (meaning making the reader not accept the card by changing the card's key) since they can't read the key.

Is there such a write-only mechanism? If not, how else do you get the key in the card while preventing others from reading it?

Answer 1

This varies by implementation and manufacturer. But in a nutshell. The keys are written once to the card and then protected against tampering. The keys are commonly stored in chip with the ROM, which has technical and physical controls in place to destroy the key if tampered. These are not 100% guaranteed and attackers have indeed found clever ways overtime to manipulate them.

Just to make it clear then. The keys are written into the card and then no further writing is allowed without the existing key being destroyed. - again implementations vary but in essence that's the basic idea.

I found this thesis a really exciting read if you want lots of detail about smart card security. It's long but excellent. http://theses.gla.ac.uk/3091/

Answer 2

I'm doing a feasibility study at the moment, analyzing security measures of several RFID/NFC IC manufacturers.

In short: No, cryptographic NFC tags are not 'write-only' at delivery, but this feature is at user disposal:

What I see is that most manufacturers deliver their chips/tags in a 'virgin' state. (as in: there are default secret keys in memory) At this moment there is no write protection. It is then up to the user (or their subcontractors) to load data into the chip. This data will consist of:

• authentication register: this data is the actual 'secret' that is needed on both the host and client side, in order to have encrypted communication.
• user data banks: serial numbers, encrypted passwords, user data ...

From this point onward, the chip cannot be read by a third party which is not in possession of the secret key. In addition, sometimes there is a 'write protection' feature, where you can blow a fuse on the IC to restrict any further writing on register blocks. (making the NFC tag permanently configured)