MIFARE™ is a popular line of smart cards that can be read wirelessly over short distances. They can store identity information as well as monetary value and are most commonly used as tickets or passes in mass transit systems. The technology is owned by NXP Semiconductors, a Dutch spin-off of Philips. The security of some MIFARE™ products was called into question in the mid-2000s when it was discovered that an encryption scheme in a widely used card was vulnerable to attack.
The product line consists of several different contactless smart cards, i.e., wirelessly accessible credit-card sized devices with some form of integrated computer intelligence. The MIFARE™ Classic, introduced in the mid-1990s, is little more than a few advanced circuits and some memory. The MIFARE™ Ultralight, available in both encrypted and unencrypted formats, is inexpensive enough to be used for disposable tickets. At the higher end of the product range are microprocessor-based cards like the MIFARE™ DESFire, ProX, and SmartMX that feature a higher degree of security and flexibility.
All cards in the family share the ability to store money or identity information, usually in encrypted form. NXP Semiconductors, a Dutch spin-off of electronics giant Philips, owns the rights to the technology and licenses it to other companies in addition to producing its own line of cards. A fully functional MIFARE™-based system often involves several different companies, each providing a part of the overall system. Readers and back-end systems may be purchased from one supplier, while the cards may come from another.
Many mass transit providers around the world use rebranded versions of MIFARE™ smart cards as monthly passes, rechargeable passes, or even disposable tickets. The Massachusetts Bay Transit Authority (MBTA) Charlie Card and the Oyster card issued by Transport for London have both used MIFARE™ Classic technology. In some regions, value stored on these mass transit cards can be used to make purchases in convenience stores or from other merchants. Other uses of the technology include as student or faculty ID cards, tickets for sporting events, or to limit building entrances to specific personnel.
In 2007, security researchers began investigating the proprietary encryption scheme used in MIFARE™ Classic cards. The encryption technique was found to be vulnerable to several types of attacks; within a year several different groups had shown that the cards could easily be read and even duplicated. NXP responded with the MIFARE™ Plus, a backward-compatible device that uses the more sophisticated Advanced Encryption Standard (AES) to protect its contents. Systems that use the older Classic line remain vulnerable, but can implement additional security measures on card readers and in the back-end to partially reduce this vulnerability.