Support for MIFARE DESFire

[dev-zzo]

I would very much like to see Chameleon supporting emulation of DESFire cards. I reckon this was already implemented according to the WISSEC paper, but is not shred with general public. Any plans on putting it on github?

[exander77]

I second this. MIFARE DESFire is a must.

[andruszd]

Me to for MIFARE DESFire EV1 and MIFARE DESFire EV2 versions

On 13 October 2016 at 16:04, Ing. Radomír Polách notifications@github.com
wrote:

I second this. MIFARE DESFire is a must.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#31 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AC90mE5Tr35IfzaoBNtkZoKTbtVftMTmks5qzkhlgaJpZM4KVkDW
.

[david-oswald]

I agree - however DESFire has a very complex protocol (three different modes of communication to start with, many functions, ...) -> we will likely start with a subset (in the WISSEC paper, it was mainly just authentication). If anyone wants to further contribute here pls contact us (or do it and send us a pull request for the complete DESFire emulation :) )

[Hoopy-Frood]

Thanks David! If I can have the authentication code, I think I can hard code the file system of a target card. Please do see if you can include the DESFire authentication in the code.

[dev-zzo]

FYI, this is what's lying around the 'nets:
http://www.ti.com.cn/cn/lit/an/sloa213/sloa213.pdf
Quite nice for TI guys to provide everyone with such a nice reference implementation... ;-)

[dev-zzo]

Oh well. I'll get things rolling in my fork.

[dev-zzo]

By the way, any suggestions for a good (= compliant, stable, documented APIs) reader for these cards? Will have to test with something, right? AFAIK, proxmark3 does not support DESFire cards, and that's the only one "reader" I have.

[david-oswald]

libfreefare has DESFire support, so it works with any libnfc-compliant reader. The libfreefare code could also be useful as a reference how the reader side works.
However there are some quirks in the freefare code, e.g., it forces the DESFire to speak at 424 kBit/s, which is not supported on the Chameleon currently. So you'd have to patch the respective code parts to use 106 kBit/s. libfreefare uses the APDU-wrapped mode by default, ie puts the native DESFire commands into an APDU (Note: there is also an APDU mode with ISO7816 commands, I think this is used rather infrequently in reality though). I think a DESFire emulation should support at least the native commands and the APDU-wrapped ones. So there probably have to be RX/TX functions that handle this transparently.

[dev-zzo]

Since everyone is really looking forward to having support for DESFire in Chameleon, I think it is OK to ask for some help. :-) Could anyone who has the actual cards do a few captures of PDU traffic between cards and readers, for reference? Selecting the card, authenticating, selecting an app, reading a file... that kind of stuff. Including the 14443-4 headers please. Bonus points for full captures of 14443-4 and 7816 exchanges! Thanks!

FWIW, I think I have implemented ISO 14443-4 layer and stuff below it, so I'm working on implementing DESFire commands now. Not sure at which point it will be ready for testing, but I am confident we'll have something before mid-November.

[david-oswald]

Maybe the captures here help:

http://adamsblog.aperturelabs.com/2013/02/atmel-sam7xc-crypto-co-processor-key.html

Otherwise give us a few days and we'll get/find something.

[martinbeier]

@dev-zzo thanks for your effort on the DESFire stuff.
afaik pm3 has some DESFire support...

If you still need captures of DESFire card communication, I could contribute.
I have some DESFire + DESFire EV1 + DESFire EV2 cards.
I think it would be handy to have at least the common command set, that all DESFire cards support.
(native commands and the APDU-wrapped)

[dev-zzo]

@david-oswald Thanks for the link, I will go through it ASAP!

@martinbeier Would be awesome if you could play with them cards and share PDU traces. As for the command set, I am currently at the basic DESFire level; I believe EV1 and EV2 are supersets but I don't have docs to back that.

[martinbeier]

@dev-zzo I can confirm your assumption, DESFire EV1 and EV2 are fully backward compatible