Schneier on Security

Bruce,

The MiFare chip is made by Phillips which used to be the largest electronics company in Holand. So much so that their Sports Club Football team (PSV Eindhoven) is internationaly regarded like the U.K. Manchester United...

Also of more interest is the MiFare chips are also used in the Transport For London "Oyster" Travel Card system that likewise has cost hundreds if not thousands of millions of USD to impliment. TfL are currently spending upto 100million USD more trying to get the overground train operators to adopt it as well...

Also a major U.K. bank has gone into business with TfL to make a combined travel / credit / micro-payment card. The worying thing about the micro payment is that for transactions below 20USD no PIN or other autherisation is required (just put areader close by)...

Oh from the security point of view the MiFare cards hold the last 25 journies / transactions.

It looks like very bad news for the 13million or so people who have to use public transport in London...

> Dutch Parliament recently invited the students to give testimony; they're more than a little bit interested how $2B could be wasted.

That's a good sign at least . Here in the States they'd just be arrested and ignored so the system could go forward. Look how long it's taken for problems with voting machines to be addressed by state legislators, and then only after years of use.

Oh I forgot to mention I have blogged about it here before and my previous comments might be of interest,

http://www.schneier.com/blog/archives/2007/01/id_cards_to_sto.html#c136247

http://www.schneier.com/blog/archives/2007/01/id_cards_to_sto.html#c136312

http://www.schneier.com/blog/archives/2006/09/the_state_of_su_1.html#c112138

A student of the Radboud University of Nijmegen has already been able to make a 'free-traveling' card: http://www.computable.nl/nieuws.jsp?id=2285626 (sorry, Dutch webpage).

I've read somewhere that the Dutch government knew there were some problems with the card, but for 'political reasons' they decided to continue the project.

If you take a look at the project, you'll see some real classic mistakes have been made: usage of their own crypto algortim (which hasn't been proven safe) and keeping it secret, usage of a short key (I've read 48 bit, but others say even 32bit) and continuation while there were warnings about the security of the card.

A real nice schoolbook example of bad security.

The interesting question is: what does "hacked" mean in this case?

The Ultralite cards used in this case are no more secure than printed paper slips - they are just dumb memory containers with no security whatsoever. They are designed to be low-value, disposable cards.

It is still far easier and cheaper to jump the gate or just pay the fare than to create a duplicate of the ticket (which needs skill and equipment). You could have also copied the previous paper tickets using Photoshop, and nobody would've called that a "hack" - just "forgery". The situation is not different when the information is printed in a way which cannot be easily discerned by the human eye.

The cracking of Mifare Classic crypto is then far more interesting, but it remains to be seen how much practical impact that has, since even that is used in relatively low-value systems.

Does a "hack" lead to the imminent collapse of the public transport, if the alternatives are easier? How much security do you really need, or can afford to protect a $2 transaction? My guess is that even with hundreds of people cloning their cards, the *total* cost of the system is still lower than what it would be if you enforced high-grade crypto in the system.

Good find, Bruce.

And you analysis of the root cause of the problem is spot on. Like most "powers that be" in Holland too they like to give the hard earned tax payers money to those who attend the same tennis club, more then to those who know what they're talking about.
I can even tell you the part two: an expensive committee will be formed, soft questions will be asked, a silly conclusion will be drawn, more money will be wasted, nobody will be to blame and the cards will be used for the next couple of years anyway...

"My guess is the system was designed by people who don't understand security, and therefore thought it was easy."

The system was designed by experts Bruce...

"Thales, a world leader in professional electronics in the Aerospace, Defense and Information Technology & Services markets, will supply the operators' systems and equipment, building on its smartcard knowledge and experience in the conception and implementation of large-scale, integrated fare collection systems; Vialis will install and maintain the system's physical infrastructure, such as smartcard readers and ticketing and fare machines. Accenture will integrate the system's technology infrastructure and will support the operations of the Trans Link Systems' back office, which includes clearing and settlement of revenues for the participating transport companies. "

"Also a major U.K. bank has gone into business with TfL to make a combined travel / credit / micro-payment card. The worying thing about the micro payment is that for transactions below 20USD no PIN or other autherisation is required (just put areader close by)..."

The Barclays' OnePulse cards don't use the MiFare interface to make payments, they used the contactless EMV interface. And if you put a reader close by you would only be able to transfer the money into a Barclays Business merchant acquiring account. Not really the crime of the century.

There have been a few quite informative posts on another 'security' blog recently, which go into a lot more detail (and in English)...

http://www.toool.nl/blackbag/?p=157
http://www.toool.nl/blackbag/?p=158
http://www.toool.nl/blackbag/?p=162

@Pom:

jumping the gate won't be easy. Take a look at the gates:
http://www.retmetro.nl/nieuwsitempics/417_ovchipkaart_5.jpg
(yes, the gates are open. It's a photo of the gates while they haven't been activated yet)

there was a hole talk at ccc's 24th chaos communication congress last december about it.

there are recordings and slides available under

http://events.ccc.de/congress/2007/Fahrplan/track/Hacking/2378.en.html

Allow me to correct a few minor quibles. The OV-Chipkaart has been available since at least August of 2007 in some cities. I started using it when I moved to Rotterdam for the metro system, so this card has already been released.

The idea is to roll it out to all of the other public transport networks, and integrate tickets for the Netherlands Rail system as well.

Right now this isn't that big of a deal. It is trivial at least in Rotterdam and the Hague to board the metro system with only a minor chance of scrutiny. And in most cases, simply showing an anonymous OV card is enough to convince the conductor you have paid, regardless of whether it was swiped or not.

And if by the off chance the RET workers have hand scanners, the damn things fail to read about 10% of the time anyway (costing you 4 euros btw), that social engineering will get you out of a fine.

Whoops, re-read the article. The ultralite ticket is new, the mifare isn't.

A little bit of perspective here!

We are talking about a bus ticket. The system it is replacing consists of a strip of cardboard with rubber stamps on it!

They have actually made good choices regarding cost/ease of use/effectiveness.
The major cost is in installing the physical gates which did not exist previously.

Having said that Zurich public transport ticketing consists of pieces of paper with dates printed on them. They are not normally checked by anyone. However they have teams of plain clothes ticket inspectors which randomly pounce on a tram or bus and check everybodies ticket and issue large fines to those without a ticket.

The ticket cost pays for the transport system (well some of ot), the fines pay hte inspectors wages.
The whole system is vastly more cost effective than the high tech electronic solutions implmented in London and the Netherlands.

But then I expect if Zurich hosted the leading manufacturer if RFID chips .....

According to dutch newspapers, apparently most of the cost of 2 Bn is born not directly by the government, but by the transport agencies themselves. The government is in for about 120 milion for development costs.

That said, the government sets the date for the changeover from the old to the new system. This being postponed by these new 'revelations' costs Rotterdam metro a reported several hundred thousand euros a month.

Moreover, several privacy issues were identified. For instance, information about users would be stored for a whopping 7 years.....

Of course in all of this a cost/benefit analysis should be employed. The fact that the disposable version of the cards was cracked completely is not nice, but not an extremely big deal. Some simple security measures would make this a nuisance, but not a break in the system. If the full blown card is cracked, that might necessitate a rewrite of the entire system.

Lessons:

- security by obscurity is not a good idea
- a breakdown in security must be taken into account in the design fase....

Hah - Houston (TX) Metro is implementing the same sort of thing to replace their paper-ticket system. In the process, fares are going up; most importantly, the all-(day/week/month) passes are going away.

My guess is they had to raise the fares to pay for their new system. Unfortunately, for people like me who rode voluntarily, the price increase makes it now cheaper to drive. For folks who rely on the bus as their primary means of transport, the hit is much harder to bear. That's a pretty "good" plan for an agency who's goal has been to increase ridership.

Oh, and let's not forget the privacy concerns (the govvy/unscrupulous empoyee) can see where one card has been over the past months (or years?).

I disagree with the poster(s) who said that hacking the card is more trouble than printing a paper ticket/jumping the gate. The cost of hacking the card is up front, once. After that, the process can be automated, so it might be as simple as waving your card next to your writer when you get home, and then you're ready to go out again the next day.

Oh, and quoting Thales' press release doesn't automatically make them an "expert," man. In fact, the fact that they appear to exclusively supply the government would make them a bit suspect. It is pretty common knowledge that government contracts never require quality or fitness-for-use -- they just have to satisfy the terms of the RFB/RFP---sometimes not even that. Just take a look at MOD's Defence Information Infrastructure system (£5bn and up?).

The Dutch system involves a lot more money than bus passes; it's also supposed to replace train tickets. Therefore some serious money is involved for daily rail commuters.

The question for me, as a Dutch resident, is this: is the solution possibly worth all the cost and bother?

The present cardboard "strip cards" used for bus and tram rides are cheap and efficient. They also allow for small conveniences: if I'm holding shopping bags my wife can tell the driver to put my ride on her card since I can't easily reach my wallet. With an electronic system there's no room for human ease or convenience. Of course many people fail to pay on the tram (there are multiple entry doors, unlike busses where you enter only by the driver), but that's a social problem that won't go away with chip card -- especially one with lousy security.

Train tickets are printed from vending machines on paper, but with a metallic holographic stripe. That protects against most forgery. Again, the main problem is people not paying and betting that a conductor won't catch them. On a short local ride that's a very good bet. On a longer trip across an international border (I go frequently from The Hague to Brussels) my ticket is checked 2 or 3 times. So more conductor checks on local trains could have a powerful impact (and also cut down on pickpocketing, drinking, and other annoyances.)

Finally, Dutch train stations are busy, busy places. The hallways and escalators are often jammed with people. I can't wait to see the fun we'll have as people are slowed by the gates, or who get confused about how much fare has been deducted, or what to do if they think something has gone wrong...

So ... did anyone ever bother to ask why this was necessary?

The German town I lived in, Karlsruhe, had a system very similar to the one in Zürich. There were stamping machines on the trams, which you stuck your paper ticket into. The paper tickets had some anti-counterfeiting measures like a metallic strip built in.

One of the nifty low-tech security measures they used involved the noise that the ticket punch made. It made a distinctive, loud metallic "ding" when you stamped your ticket. This meant that you couldn't sneakily punch your ticket after the inspectors got on the tram - although I did see people try to do that.

Interestingly, in my two years there, I think that I would've saved money by not having a ticket and paying the fine. I had my ticket inspected every two or three months; the fine was not much more than a one-month pass.

Some details of how the fare card security was broken are here:
http://www.freedom-to-tinker.com/?p=1250
The one-time-use and reusable cards are both broken, but in different ways.

I personally still regard the OV-Chipkaart as a solution in desparate search of a problem. Not only are there security issues with the card, also all traffic motions are stored for 7.5 years! And the council for privacy protiection in the Netherlands raised some serious concerns with that. Wish us luck :)

Might be fun to do a drive by RFID erasure before a football (American or the rest of the world football) game if these tickets become common. I too have to admit a bit of admiration for the Dutch. In the USA, they'd be on their way to, Guantanamo! That sounds like it would make a nice jingle for the DHS

On a more technical note about this Chipcard: the constraints in terms of number of gates for building algorithms is restricting the level of security that can be reached in principle. For mor e info on that, watch the ccc-talk that was linked to previously, especially the discussion afterwards (about the last 10 minutes of video) where a brittish initiative is discussed.

My first thought was the same as Jared's. If this were in the US, they'd have been arrested for hacking, the news covered up, any exposure would be laughed off, the system would be deployed anyway, and then they'd try to arrest anyone who hacked their tickets.
Then in 10 years when the mass transit system was failing because nobody was actually buying tickets anymore, they'd shut down the system because nobody used mass transit; even though the busses are constantly full, nobody's buying tickets therefore nobody's using it.

I think that the dutch government does not care about how much the system is going to cost or how flawed it will be.
They will have a system in a few years that can exclude all that they want to be excluded with some nice extra false positives built in to make sure that the population is frequently harassed.

This is about locking in and keeping their population in check, if the population travels then they want to know from all of them where they are at any given moment.
Yes at this moment there are anonymous cards but they will not stay, at some point they will claim that they are unsafe and need to be discontinued.

This is not about money, nor privacy, it's all about power over the population.

2 centuries ago here in Europe the common man was not able to travel far from their birthplace because most roads, bridges and land had their toll booth and most people were too poor to be able to pay for that.
Our politicians want that situation restored because then the population is so easy controllable, they want to install card readers on every station, road, bridge and land to keep us from traveling whenever they think that we don't have a good reason (in their perception) to travel.

Flawed dictatorships are really the worse kinds, go see "Brasil", for all people that have never seen it.

Yes I am a cynical old bastard that is proven right on a daily base that most people are fucked up, especially the ones that use language as a weapon.

@ Dave Birch

Quote

The system was designed by experts Bruce...

"Thales, a world leader in professional electronics in the Aerospace, Defense and Information Technology & Services markets, will supply the operators' systems and equipment, building on its smartcard knowledge (...)"

/Quote

A small correction - the system was built by employees of a company that presumably has, in its employ, experts in RFID security. Whether they assigned any of those experts to the project is not clear.

The most we can say for sure is that it was built by colleagues of experts...

@ John Ridley:

Please define hacking... ;-) What these guys have done op open the black box, and peeked inside... You have to pay for such a card, so it is your property that you're looking at... If I buy a new computer and open it up to look inside, is that hacking?! Not according to Dutch law...

As someone else pointed out, the system was set up in such a way that if you don't know the inner workings all would be okay - that has changed now. Security through obscurity is bad bad bad...

BTW the chips in these cards are used in all sorts of cards, like in cards to access buildings, some bank cards, etc. According to the Mifare web site, they sold over 500 million of these chips - we can only wait for the next card to be 'hacked'...

@Hugo:

The keys employed in Mifare Classic (used for the personalized subscription card and for the unpersonalized purse card in the ov-chipkaart system) are indeed only 48 bits, so 'security by obscurity' was their only defense against a brute force attack (a real card will only do about 10 tries per second). Obviously, now when the algorithm is known, brute forcing is easy and there might even be time-memory tradeoffs to break keys even faster.

32 bit are not used in Mifare Classic (actually that's the length of the card UID, and also the length of the card challenge though that only contains 16 bits of randomness), but have been mentioned in connection with the ov-chipkaart system because the disposable two trip cards (Mifare Ultralight, no encryption, no security besides fixed UID and one-time programmable bits) in the system seem to use some sort of encryption or HMAC of size 32 bits. And even though that's probably too short it's it won't matter anyways since you can simply build a Mifare Ultralight emulator and not care about any protection/encryption of the on-card data (that's what Roel Verdult did).

And yes, this *is* a problem: For 40 EUR (for the emulator) + ~100 EUR (for an RFID reader) you can build a foolproof system to always reuse the same two-trip card over and over that is almost impossible to detect unless all readers at the entrance gates are online and continuously connected to a back-end database. This could even be used to fool plain-clothes ticket inspectors since you could simply use the RFID reader to write the data from your card emulator to a real card when you are challenged to show your ticket.

The blame for the other problem is neatly shared by all involved parties. Though NXP is not really to blame for the initial usage of their proprietary stream cipher (it was designed back in 1994!) with such a ridiculously short key length that completely relies on security by obscurity, they should have realized that after more than ten years somebody is inevitably going to reverse engineer it. (Rumor has it that there are already counterfeit Mifare Classic cards available from China from manufactures who did not license the algorithm.) They probably should have softened their marketing and not continue talking about proven security and approved authentication.

On the other hand the warning signs (48 bit! proprietary algorithm!) were quite clear so there *is* blame to place on anyone who bought that stuff. Especially since NXP now sells 3DES cards (Mifare DESfire) at a slightly larger cost (1,50 EUR instead of 0,50 EUR). Which AFAIK are even used in the public transport systems of other cities. And of course Trans Link Systems should have opened the specifications for their system right at the beginning for people to look at it and point out the flaws.

The good news is that this will hopefully happen now. The problems were all over the mainstream news for the last two weeks, at least in the Netherlands.

I'm still waiting for when someone will notice that the Oyster cards also use Mifare Classic. And several other large systems too. And lots and lots of small to middle systems.

--
Henryk Plötz
Grüße aus Berlin

After going over the report, the privacy implications of this are massive.

The card will only work as long as you check in and out of every station you pass through. If your last check-in is inconsistent with your present check-out, it looks like the ticket will (or at least can) be refused. So, in order to use this transit system, you must assist in having your movements tracked in detail. Fantastic!

This is ridiculous. People will continue to plop RFID chips into anything and everything in the name of convenience without the slightest regard of the privacy problems it might be introducing. To protect yourself, don't buy into RFID enabled products. If you have no choice, wrap them in a shield like www.rfid-shield.com

@Henryk: Exactly. What is the value of using a 1.50 EUR card to cover a trip which is worth 3 EUR? You would need to drive the price up by quite a lot just to cover the price of the secure card.

Makes more sense to just use the completely insecure and cheap cards for the day trips. So what if a bunch of people make copies? You could of course check it at the backend if the ticket has already been used, and blacklist them. But, in that case, the secure system would need a way to track all the uses. Which, again, isn't nice.

To use a slightly more expensive card for the monthly pass makes obvious sense, though. There you could actually lose some money.

@Pom:

I don't know the particulars of the RFID cards that Singapore uses for its transport network, but they do require the purchase of a fairly solid card for $1 for even a single journey. You can get it refunded at the end of the trip.

This system has been in place for years and seems to work fine. It also has the side-effect of incentivizing the purchase and use of stored value (rather than single-trip) cards, which means shorter queues for everyone at the ticket machines.

So there is a proven alternative to using cheap disposable cards for short journeys.

@Pom

I don't see a difference between a hacked monthly pass and a hacked day pass. If you can use the hacked day pass as many times as you want, it is effectively a hacked monthly pass. The system is only as strong as its weakest link.

There's another, non-torrent version of Henryk's talk ruebezahl mentioned above, http://dewy.fem.tu-ilmenau.de/CCC/24C3/mp4/24c3-2378-en-mifare_security-COMPATIBLE.mp4

It's in English and quite comprehensible, even for people not so damn deep in security.

A lot of noise for the single-use tickets: for instance the London subway system uses paper tickets with magstripe, much easier to copy.
The big problem is that people tend to rely on new technology as the solution for the problem (what was the problem? fraud?), and that the technology in itself does not provide enough (part of the business case probably involved getting rid of all human inspectors).
A multilayer security scheme (machine checks at the gates, random checks by inspectors, human readable printed source/destination on the card) would be easier and would provide better security (both for the transport company and the travellers!), and in the end would probably be cheaper.

@James: "Please define hacking... ;-) What these guys have done op open the black box, and peeked inside... You have to pay for such a card, so it is your property that you're looking at... If I buy a new computer and open it up to look inside, is that hacking?! Not according to Dutch law..."

"Hacking" is what any decent electronics/radio/computer enthusiast or professional does, often daily, and with zeal. It is not, by definition, illegal - despite the best efforts of the press to hijack the term from its true meaning.

I think you are referring to "criminals", I'm sure Dutch law has a lot to say about "criminals", but hopefully it doesn't say anything about "hackers" (by name).

@Dave Birch

Quote:

The system was designed by experts Bruce...

"Thales, a world leader in professional electronics in the Aerospace, Defense and Information Technology & Services markets, will supply the operators' systems and equipment, building on its smartcard knowledge and experience in the conception and implementation of large-scale, integrated fare collection systems; Vialis will install and maintain the system's physical infrastructure, such as smartcard readers and ticketing and fare machines. Accenture will integrate the system's technology infrastructure and will support the operations of the Trans Link Systems' back office, which includes clearing and settlement of revenues for the participating transport companies. "

I work for a consultancy (a competitor of Accenture) which I am leaving because I can't stand the lack of competence and integrity. I can assure you that the way these companies operate is that a bunch of graduates with very little experience do the majority of the work with minimal oversight from someone experienced - who may or may not know anything about security.

Don't believe the hype of these companies - they have mediocrity built in. They only care about money and they know the customer is too dumb to ask difficult questions.

Whether it was designed by experts is irrelevant if the final implementation is flawed.

They made mistake upon mistake with this system.

Take the terminals where you can add money to your card. The first implementation had the basic flaw where if you pulled your card from the system too soon, your bank account was charged while your card was not updated.

In that case they can't claim that it was something 'new' they had to do.

Another example, one of the major transport companies was recently addressed that their storage of private 'OV-pass' information was not up to EU standard.

Or the biggest train company that has been pushing this card said it could not implement the 'return ticket' as it exists now (a return ticket is cheaper that two single trips), but they can send you advertisements targeted to your times, dates and locations of travel.

It CAN probably be designed securely enough by experts, but if all parties involved get their say in it, it never will.

As a side note, the London (and various other) systems use the more expensive NXP chip, not the MiFare one that the Dutch government opted on because of 'cost' reasons. (Source, various newspapers)

one thing I can't find in the report, is more details information about the encryption key. They think the UID (which is readable) is part of the key, but it doesn't say if the rest of the key is static, and the same for all cards, or different for each card, or possibly for each transaction.
If it is static, it would be highly vulnerable to a class-break, especially since the key is, apparently, only some 32 or 48 bits long.

One thing I think is missing from the article, is a denial-of-service attack; either using a device to interfere with the readers, rendering them unable to read any card, and probably resulting in the gates being opened and everyone being waved through.

Another option would be to carry a medium powered reader device to set the remaining trip counters or lockbits on the cards of the other travelers. This would probably result, if done sufficiently frequently, in a public outcry because the tickets people have paid for are invalidated, and they will demand their money back.

I think the only way to build such a system properly, is not to rely on the card as a writable storage medium, but to have cards with globally-unique identifiers, of, say, 128 bits to prevent lucky guesses of valid identifiers, and record all other information in a central database. I don't really understand why they didn't do this; it doesn't really require very fast connections or a huge datacenter, we're talking about a few million transactions per day at most, each only a few bytes in length.
You could even use multiple sites with replication or local caches of data to prevent a temporary loss of the connection from causing real problems.

The only vulnerability that I can think of that would remain, if the copying of an unsuspecting travelers card.

I think a system with printed barcodes and the same, long, identifiers would be a lot better, en much cheaper to implement. This is, unfortunately, a rather typical example of a dutch government project, costing huge amounts of money to solve a fairly simple problem, and even failing miserably at that. (and yes, I do live in the Netherlands)

@Arnold User: the Dutch OV-card uses mifare ultralight and mifare classic. The oyster card in London is mifare classic as well

@Sparky: We didn't say anything about the key because that would depend on the implementation. We looked only at the card itself and what it does, and not at any particular usage of the card.

The card can simply store two keys per sector. Then for each transaction this key and the UID and some randomness is munged together to form the equivalent of a session key and that is used for the transaction. So even if all cards had used the same key that should in theory be not a big problem since the UID is part of the 'session key'. But based on the way their munging is done it is problematic.

But as you correctly said, in a properly designed system each card would have a different set of keys of its own anyways. That is completely out of the scope of Mifare Classic and entirely application specific, just like the actual payload data. Note that for basically every application theses card-keys would remain static for practicality reasons, since changing the keys on each transaction would be a major hassle. This shouldn't be a problem (in theory again) because there are random nonces used in the 'session key' generation. In practice these nonces are only 16 bits and completely time-dependent.

Another implementation consideration is that the typical Mifare Classic reader ICs can store some keys (32 keys if I remember correctly) in internal write-only storage (e.g. can't be read out from the IC through conventional means). This is not really secure storage but probably good enough for most application. However, using this facility means that your whole system is limited to 32 keys in total.

If you don't want to do that you will need to come up with the keys external to the reader IC, e.g. in your controlling microcontroller, for example by deriving card specific keys from a master key, maybe even using a SAM. But then you would need to transmit these keys to the reader IC on each transaction, over a bus, usually in the clear.

And yes, the optimum system design would not store any information on the card except for an opaque identifier and then look up all information online. But that would require constant, uninterruptible, critical on-line connections for all reader devices, all the time. While this is hard enough to do for fixed gates, e.g. in subway stations, things get much, much more complicated for the devices that ticket inspectors would use and the especially entry/exit readers in buses and trams.

(The optimal system would also not only include a simple UID but have to have some cloning protection in the form of a secret key that the card would need to prove possession of through a challenge/response protocol based on real cryptographic functions. Oh, and if you want to be really good you would make it so that no identifiable information is ever transmitted over the air in the clear to prevent tracking attacks by third parties. This gets complicated if you want to reach the other goal of giving each card an individual key, especially if you don't have public key cryptography available, but is possible, e.g. by using key trees.)

--
Henryk Plötz
Grüße aus Berlin

Pom:

I think that if they're spending $2B on the new system, they're trying to get something that significantly better than the old system. So comparing the new flaws to the old system, saying that it's not worse doesn't really cut it - if all they were shooting for was something that wasn't worse than what they had, they would have stayed with what they had and kept the $2B.

And regarding your cost argument, if what people are "stealing" is so cheap that it's not worth high-grade encryption, then why go through the bother of encrypting at all?

Sounds like a case of technology-for-technology's sake, much like the voting machines here in the US.

@ Henryk

Having a connection with the database is already required for uploading the movement data of the traveler, although that does not have to be realtime. On the other hand, all stations (Bus, train and tram) are stationary, so a local solution for the network is possible. (Here in Eindhoven, The Netherlands, a lot of bus stops have a strange square (2 x 3 m) cut into the roadway where the front of the bus will stop, so it seems like a detector/network of some sort...)

The biggest problem I see for the disposable cards is indeed that the number of remaining trips is present on the card itself, as Sparky wrote. That is stupid.

The biggest problem for the reusable subscription cards is the 7 year data collection issue.
Not nice and totally useless. Aggregate info is useful for the transportation companies and
a short retention is useful for billing reasons, maybe even for public safety reasons (For example police can find a missing person, or a thief if they use a subscription card), but that should be no more than e.g. one month.

But it will probably be pushed anyway with the lie that it will prevent terrorism.
Of course, the person that is going to commit a criminal act buys a stack of one-way tickets to prevent tracking. Those cards will be bought in other places by accomplices and payed by the funder of the terrorist...

The real-time stuff is completely unnecessary, especially at the outset of the project.

Each fare station -- fixed or mobile -- can have a local copy of all good ticket IDs (at 8 bytes each, and 1 billion tickets outstanding, this would fit onto an 8GB flash device). The station simply accepts all presented tickets that are in the database; those not in the database are rejected. The fare station records all presented tickets, and at some convenient time, sends them all to some Big Computer which does the trip counter subtraction (or whatever), and removes ID's that are no longer valid. The fare stations are incrementally updated as well, at convenient times and locations.

No massive 24/7/365/forever uptime demands, no vast real-time critical network computing problem. No need: most people are honest.

I'd guess you could probably get (worst case) daily updates to all stations, probably better to fixed stations. With slightly more data from the Big Computer, fare stations could also impose some policy decisions at the local level, at least for tickets it sees again.

Of course it isn't real-time, but it would be vastly more pervasive and effective than any number of human ticket inspectors. Revenues would either stay the same or go up, but costs would go down as you can now release the inspectors to things more befitting a human being's attention.

This wouldn't cost $2 billion though. Damn it, will I never get rich?

In light of this news, I think the British government should reconsider RFID tagging of criminals:

http://www.vnunet.com/vnunet/news/2207145/government-considers-rfid-tags

With a clever rewriting of the RFID a criminal can modify the stored information and assume a different identity.

@ Anonymous
> This wouldn't cost $2 billion though. Damn it, will I never get rich?

You should have sold the idea for $1.5 billion ;-)

But seriously, the problem with that idea is you want only sold tickets in that database with fare left, not all tickets present in machines not sold yet.
Otherwise busting up a machine is worthwhile and it means the database will be _big_.
I would think that the machines contain more tickets at all times than are present on persons traveling (otherwise the machines would always be empty :-] )
If someone buys a ticket and immediately goes into town to catch a bus which has not yet been to the central station (or a inter-city bus), his card might be tagged as invalid. That is not wanted...

On the other hand, a combination could work: A database present in the buses, with 'almost-real time' updating of the sold tickets: When a bus gets a connection at a station, the changes are uploaded and downloaded.
If a person at that station presents an unknown ticket, the bus has to finish the local data transfer, but that would not be problematic most of the time.
If the synchronization is done always (e.g. using a mobile phone type connection, not WLAN-like), the bus would probably have the info while in transit to that station...

@Pieter: Of course you are correct in that the current system will have to transmit data to some central authority, but at least in theory it would have been sufficient to do that only once in a time interval, e.g. once per day. A secure system that doesn't rely on data stored on the cards needs constant online access and will be completely useless when the connection fails.

@Anonymous: There is a simple way to get rich with your supposed system: Simply have them implement that system, then go ahead and steal one of the '8GB flash devices'. Afterwards you can sell counterfeit tickets using the stolen IDs and since there are no ticket inspectors anymore those would be impossible to detect. :-)

@ Henryk
But for the times that the system is offline a caching database can be used.
Nowadays, mobile data access is cheap, so continuous updating should not be a problem.
If cost of the disposable tickets is a problem, that is the way to go. A ticket could than even be printed as a barcode, as the number of trips is not on the card itself.
Reading a barcode is also contact-less.
Even making a copy would not work, as the number of trips available stays constant.
(There is of course a small window of opportunity for a copied ticket if no synchronization can take place between the different fare terminals, but if the system logs the accesses, it would be possible to detect a copied ticket while in motion. Combining the system with a camera (which will be done anyway 'to improve security and catch terrorists') and you know who it was. At the next stop the ticket inspectors can pick up the culprit).

I liked the coin system used in Dublin when I was there on holiday, sort of like a toll-booth: Throw the coins into a chute and the machine counts and prints a ticket.
As it is at the driver station, he/she can check that you paid. The money goes into a strongbox of some sort, the driver does not have change. If you give too much, a refund ticket is printed that can be refunded at the central station only.

The one/multi-day tickets (Ramblers) on the other hand, were crap.
Magstripe on paper with a check machine with printer in the bus. The machines often did not work...

@ Henryk
Transit systems usually diversify the card keys from a master key using triple DES algorithms. That’s why I’m still trying to determine the actual impact of what you and Karsten have done on large transit systems.
@Dave Birch
I believe that Bob J is 100% correct in what he says. Very few, if any, transit system design organisations have knowledgeable security staff – they rely on outside consultants.
@ Anonymous
Transit systems do indeed store a “hotlist� of suspect or bad cards in their terminals, with the list updated daily. This means that a suspect transaction or card can be hot-listed out of the transit system quickly, so damage is usually confined to 24-48 hours of free travel.

@olesmartie: Deriving keys is true and good but in the case of Mifare Classic mostly useless because crypto1 is the weakest link, and a very weak link at that.

Although we have not produced a proof of concept yet it seems very likely that it will be possible to simply 'ask' the reader for the key. One would take Roel Verdult's ghost device, Melanie Rieback's RFID-guardian or our OpenPICC, set it to spoof the UID of the target card, walk up to a reader and perform the first part of the mutual authentication procedure. The reader must authenticate itself first (which --in itself-- is the correct design decision) and will therefore give us the crypto1 mutual authentication response to any chosen challenge. From there we will simply be able to brute force the key that led to that response and will then have the derived key for that particular card.

While this will not yield the master key, it does provide an oracle that can be asked for the derived key for any card. The brute force attack that is necessary here can be greatly sped up with a time-memory trade off, so it will likely only take a couple of minutes per key.

(Disclaimer: These are speculations about potential future work. And we all know that forecasts are hard, especially if they concern the future. But I think it is a safe bet that, in a year from now, crypto1 will be broken on a regular basis, just like WEP now.)

@ Henryk
I still have problems with what will actually be achieved in a transit system. Every card that is hacked should, theoretically, be hot-listed out of the transit system within 24-48 hours, and all that is lost are free trips for that time.
(Also there are “grey lists� in use that alert station security staff whenever a particular card is presented at a station turnstile.) In most well-designed transit systems, the “value� stored on a card can not be anonymously exchanged for cash, so in the past these systems have not been attractive to criminal organisations.
It would seem better to attack the transit terminal to obtain the master key, as some of these use SAMs to protect the master key, but others just obscure the key in firmware.
Granted, the mifare Classic card security is weak – this was known back in the mid-90s and is part of the reason why this card was not used in Hong Kong. But there are other, to my mind, more important technical reasons why the mifare Classic card should never be used in large transit systems.

What's hilarious about these Transit card systems. There are already many successful implementations in many countries, yet every time some municipality decides they need one they declare they must build theirs from scratch, with cost overruns and huge loses. Your tax dollars at work.

This just in: "NSW cancels Tcard contract with company === Mr Watkins says the Government and commuters have run out of patience with the company's ongoing delays and chronic failure to meet deadlines. ... ITSL sought another revised completion date of February 2010 back in November, which would have been almost three years past the original completion date. " http://www.abc.net.au/news/stories/2008/01/23/2144894.htm?section=business

Related: When you think trains do you think Boston? I don't, but that NSW government hired Boston to improve their own pathetic train services. I suspect dishing out this sort of business is determined by lobbying, well-placed mates in the private sector and where the government workers/politicians want to take their holidays.

I have a rfid transit bus pass. I like the fact that I pay per time period, and especially that walk up to the school with a check. Or having the transit money taken out of my paycheck. The important part is the fixed payment.

I don't think I would go with one of the deals where you paid for each ride and put money in. Though, I do like those ones, because the scanners are so often broken, which means the people with cash or tickets don't have to pay (out of fairness). I'll take a bus with a broken scanner about once every week or two.

I noticed that some commentators here said because the Dutch RFID public transit card is a low value for public transport only, thus it was not worthy to implement expensive high security.

This is clearly a dangerous attitude toward project planning and management.

Firstly, if not high security, why bother to use IC card, continuing to use paper ticket or magnetic strip is just as good.

Secondly, when investing such sum of money on a public system, you as a planner should think of the future, whether you can extend the system with low cost.

For example, in Hong Kong Octopus card was developed for public transports operated by different companies, because of its high speed and high security design, it was gradually used for cash and other finance transactions.

@n0_j0: Actually, there are several good reasons to move from unsecure paper tickets to equally unsecure RFID tickets. The paper ticket machines are expensive, and because of them containing moving parts, are also expensive to maintain. RFID readers are more reliable, can be software-upgraded on the field, and most of all, are cheaper to maintain.

One of the advantages is that when the system is hacked, you can in some cases salvage the situation by changing the scheme. For example, if someone keeps on duplicating a single card, you can blacklist the card, forcing the person to buy another ticket which then to duplicate. So you don't necessarily get the monthly pass, if you are able to duplicate the day pass. You could also e.g. sign the ticket's validity date, so that it could not be modified, and therefore, cloning would be limited to the validity period. It might even be good, since it would allow people to make backups of their tickets as well (though the obvious problem of keeping it limited to a single person would still remain).

With mechanical punching/reading systems, systems upgrades can be pretty expensive, and once they get hacked, the only thing you can really do is to add anti-counterfeiting features onto the tickets themselves and hope a ticket inspector will notice - something which could easily be done to RFID tickets as well.

So I'm still not at all convinced that plain-text RFID tickets are a bad idea. Calling them "secure" is bad, but there is still the cost-benefit analysis which needs to be made.

@ Kanly
The design of the HK Octopus transit was done well and well managed, and is a perfect example of how well a transit system can be implemented if it is kept simple. Unfortunately, Sydney is a prime example of how not to implement and manage a transit system. It’s unfortunate that since Octopus, both transit operators and implementers have “lost the plot� when it comes to designing effective, efficient transit systems.
@Andy Wong
But this is exactly how transit system security is designed. Please note that we use low-security credit cards every day and we are comfortable about this. The key issue as Visa and MasterCard will tell you is not security but risk, and with a transit system there is a low security risk, so the system doesn’t require high security.
And don’t kid yourself that the Octopus system has high security – it has high speed and high reliability because the transactions are simple, but that doesn’t mean it has high security. Certainly it has very good back-end control, hotlisting and auditing, but not overall system security.
@pom
I think it is easy to confuse low-security RFID tags with contactless transit cards. It would be very easy to use good, low-cost secure contactless cards such as DESFire in transit systems, and this is what many new transit systems are planning to do. It was never a good idea to mifare Classic cards in large transit systems, now or 15 years ago.
However, many transit systems also require lower-cost “disposable� tickets, so they use SRIX, ultralight, etc, chips in paper tickets. Again, with security that meets the risk.

Re: Thales / consultancies and all that

I recently joined the Public Sector where I get to spend taxpayers money for them (you).

I couldn't understand why everything suddenly cost 3 to 4 times as much. This is what I've worked out:

25% is due to a process to ensure a fair and open decision is made. Of course in fact it has the opposite effect (small players, such as citizens, can't understand the process so it just buries bad decisions).

50% of the cost is a risk premium - in the sense the agency spending the money outsources the risk to the contractor. This includes the incompetence of the public servant (such as me). So I can bury all the mistakes on both sides. Theoretically this encourages the contractor not to make mistakes, but (echoing the people who have worked in the big consultancies, which includes me) I have never seen any evidence of competence. Good people tend to be independent and ethical (such as Mr. Schneier...)

The remaining 25% is generally the cost of the work. So in this case it's a 500Bn system... sound about right?

Hmmm, a proprietary algorithm, and the company has so much confidence in it, that it only requires a 48 bit key...
I'm not sure, but I do believe companies have in the past been thrown in the doghouse for less...

Never mind the doghouse, the algorithm has already been broken...

http://www.cs.virginia.edu/~kn5f/Mifare.Cryptanalysis.htm

As expected, despite the protestations from NXP, who apparently plan to release a replacement card.
Now what will the transit system operators do? Throw away their thousands/millions of cards and buy new cards, change their system software, etc?
If they knew what they were getting into with the Mifare Classic card in the first place, or if they have received professional card advice, perhaps they might not have blundered in the first place.
The facts about the Mifare Classic are not new and have been known for over a decade and they are still being ignored.

Dollar value of a single fare on a large-scale basis? Hardly worth the mention ... a grain of sand, on the whole beach.

Gather 1 out of every 100 or 1K grains of sand for profit ... with fuel costs rising and roadways getting more congested, it would seem likely that there will be an increase in ridership. At some point there would seem a likeliness to tap into those ticket revenues.

Here in (large southern town) the poor bus drivers are caught in yet another aspect - political correctness. If a rider gets on a bus and causes enough problems, they get a 'courtesy ride'. This is the common stance (I see plenty of drivers daily.)

Translated? Be a problem child, ride for free. Seems like a social hack is the best bet here - just be a jerk.

Consider the real-world scenario: A single driver, (often female) telling some burly jerk he can't board without a pass. And the load of passengers who really need to leave on time ... the pressure on that driver is enormous.

Best counter to that (previously mentioned) might be a squad of officers who jump on a random bus and check 100%.

Sadly, the current system here is where the passenger puts coins or pass in a machine - you board and get no receipt. Hard to prove if you're legit or not.

Should the dollar value of a group of repeat customers get large enough, maybe some Big Timers will make their own industry, selling cards in whatever form they come. Their viablilty is in the fact (as previously mentioned) that once conterfeit cards are easily cloned, then an occasional Bad Guy gets busted, and " ... an expensive committee will be formed, soft questions will be asked, a silly conclusion will be drawn, more money will be wasted, nobody will be to blame and the cards will be used for the next couple of years anyway... "

It's all interesting, love the comments!