MIFARE Classic
The 13.56 MHz card behind a generation of transit and access systems. Its proprietary CRYPTO1 cipher is broken, so keys fall to nested, darkside, and reuse attacks and the card is dumped and cloned.
MIFARE Classic is a 13.56 MHz contactless smartcard (NXP, ISO 14443 Type A) that became the default for transit ticketing, building access, cashless vending, and campus cards. It stores data in keyed sectors protected by a proprietary stream cipher, CRYPTO1. That cipher and its authentication protocol have been thoroughly broken, which is why a card that looks like real security is, in practice, dump-and-clone territory for anyone with the right reader.
What it is
A MIFARE Classic 1K holds 1KB of EEPROM organised as 16 sectors of 4 blocks, each block 16 bytes (the 4K variant has 40 sectors). The first block of the whole card, sector 0 block 0, is the read-only manufacturer block carrying the UID. The last block of every sector is the sector trailer, and it is the heart of the security model: it stores Key A, four access bits, and Key B. To touch any data block you must first authenticate to its sector with one of those keys; the access bits decide what Key A and Key B are each allowed to do (read, write, increment, decrement). See the diagram for the layout.
Why it matters
The entire scheme rests on CRYPTO1, a 48-bit LFSR-based stream cipher NXP kept secret. Once it was reverse-engineered, the secrecy was all it ever had. The keys are only 48 bits, the random nonce the card generates is weak and partially predictable, and the authentication protocol leaks information an attacker can exploit. In practice that means a stolen or borrowed card can be fully read in seconds to minutes, and its contents (including stored value or an access identifier) copied onto a blank. Systems that trusted MIFARE Classic to be tamper-proof, stored-value transit purses, "secure" door credentials, were repeatedly cloned and forged.
CRYPTO1 and the known attacks
Key recovery has a ladder of techniques, chosen by how much you already know:
| Attack | Precondition | Idea |
|---|---|---|
| Default keys | none | try FFFFFFFFFFFF, A0A1A2A3A4A5, and other well-known keys first |
| Darkside | no known key on the card | exploit CRYPTO1 error responses to recover one sector key from the card alone |
| Nested | one sector key already known | use the known key's authenticated session to predict nonces and recover the rest |
| Hardnested | one key known, hardened nonces | statistical attack against cards with a fixed/predictable PRNG that resists plain nested |
| Key reuse | one key known | the same Key A or Key B often unlocks every sector; just try it everywhere |
The practical strategy is top-down: try defaults, then if any one sector key is known (often it is, via defaults) run nested to sweep the rest, and only fall back to darkside or hardnested when the card gives you nothing to start from.
How it is dumped and cloned
The Proxmark3 automates the whole chain; mfoc and mfcuk are the classic libnfc/ACR122U equivalents.
# --- Proxmark3 ---
[usb] pm3 --> hf 14a info # confirm it is a Classic, read UID/SAK
[usb] pm3 --> hf mf chk --1k -f default_keys.dic # try dictionary keys
[usb] pm3 --> hf mf autopwn # nested/darkside as needed, dump all sectors
# writes a .bin / .eml dump of the full card
# --- libnfc tooling ---
mfoc -O dump.mfd # nested attack, needs at least one known key
mfcuk -C -R 0:A -s 250 -S 250 # darkside, recover a key from a card with none known
nfc-mfclassic W a blank.mfd dump.mfd # write the dump onto a magic UID-writable card
Once you have the dump, cloning writes it to a magic card (gen1a/gen2) whose block 0 is writable, so even the UID is reproduced. A same-UID clone defeats readers that only check the UID, and a full-sector clone reproduces stored data and access rights.
Pitfalls
- Not every "MIFARE" is Classic. MIFARE DESFire and Plus use real AES and are not broken this way. Read
hf 14a infoand confirm the card type before reaching for CRYPTO1 attacks. - Hardened PRNG. Newer Classic-compatible chips fixed the weak nonce, so plain nested and darkside fail; you need hardnested, which is slower and needs a known key to start.
- Read is not the whole story. Access bits can lock a sector trailer so keys become unreadable even after you can read data. Misconfigured access bits can also brick a sector permanently if you write them wrong.
- UID-only trust is the real hole. If a system authorizes on UID alone, you never need to break CRYPTO1 at all, cloning the UID onto a magic card is enough. Check what the reader actually verifies.