By 2009, cryptographic research had reverse engineered the cipher and a variety of attacks were published that effectively broke the security.[1][2][3][4][5]
NXP responded by issuing "hardened" (but still backwards compatible) cards, the MIFARE Classic EV1. However, in 2015 a new attack rendered the cards insecure,[6][7] and NXP now recommends migrating away from MIFARE Classic.[8]
The usual operation of Crypto1 and Hitag2 ciphers uses nonlinear feedback only during the initialization/authentication stage, switching to operation as a LFSR with a nonlinear output filter (filter generator) for the rest of the communications.
^de Koning Gans, Gerhard; J.-H. Hoepman; F.D. Garcia (2008-03-15). "A Practical Attack on the MIFARE Classic"(PDF). 8th Smart Card Research and Advanced Application Workshop (CARDIS 2008), LNCS, Springer. Archived from the original(PDF) on 2022-04-22. Retrieved 2020-07-19.
^
Nohl, Karsten; David Evans; Starbug Starbug; Henryk Plötz (2008-07-31). "Reverse-engineering a cryptographic RFID tag". SS'08 Proceedings of the 17th Conference on Security Symposium. USENIX: 185–193.
^Garcia, Flavio D.; Gerhard de Koning Gans; Ruben Muijrers; Peter van Rossum, Roel Verdult; Ronny Wichers Schreur; Bart Jacobs (2008-10-04). "Dismantling MIFARE Classic"(PDF). 13th European Symposium on Research in Computer Security (ESORICS 2008), LNCS, Springer. Archived from the original(PDF) on 2021-02-23. Retrieved 2020-07-19.
^Garcia, Flavio D.; Peter van Rossum; Roel Verdult; Ronny Wichers Schreur (2009-03-17). "Wirelessly Pickpocketing a Mifare Classic Card"(PDF). 30th IEEE Symposium on Security and Privacy (S&P 2009), IEEE. Archived from the original(PDF) on 2022-01-02. Retrieved 2020-07-19.
