Is the MiFare Classic RFID system blown?

May 25, 2008

A decisive breakthrough has been made in the cryptanalysis of the Crypto1 encryption algorithm of the MiFare Classic RFID system used in many contactless travel payment systems including the Transport for London Oyster card. According to a newly published report by Nicolas Courtois, Karsten Nohl and Sean O'Neil, the encryption can be cracked in a few seconds on PC hardware, without the laborious precalculation of rainbow tables. The researchers conclude that the security of the algorithm is "close to zero".