Karsten Nohl Former Graduate Student Computer Science Department University of Virginia Contact Information E-mail: PGP: 0ECC 358C 2595 1058 7861 4400 7DE2 766E 787C 2265 S/MIME: Certificate, CA

About me

CV, Research Statement

I've been a graduate student at the University of Virginia from 2005 to 2008. At the moment, I live and work in Berlin. My PhD thesis proposes techniques for realizing Implementable Privacy for RFID Systems. My current research focuses on cryptography for small devices and touches on microchip security, privacy protection, and the economics of information. My advisor is David Evans.

GSM Security

Following our previous research of disclosing vulnerabilities in widely deployed systems, we are currently investigating several aspects of the GSM cell phone standard. The first major stream of this research computes a rainbow tables code book to decrypt A5/1.

Some news articles covering our GSM research:

Publications

• Karsten Nohl. Implementable Privacy for RFID Systems. PhD Dissertation. January 2009.
  

• Karsten Nohl, Erik Tews, and Ralf-Philipp Weinmann. Cryptanalysis of the DECT Standard Cipher.
  International Workshop on Fast Software Encryption (FSE). February 2010.
  
• Karsten Nohl and David Evans. Privacy through Noise: A Design Space for Private Identification.
  Annual Computer Security Applications Conference (ACSAC 2009). December 2009.
  
• Mate Soos, Karsten Nohl, and Claude Castelluccia. Extending SAT Solvers to Cryptographic Problems.
  Theory and Applications of Satisfiability Testing (SAT 2009). July 2009.
  
• Sean O’Neil, Karsten Nohl, and Luca Henzen. EnRUPT Hash Function.
  A submission to the NIST SHA-3 Hashing Competition. August 2008.
  
• Karsten Nohl and David Evans. Design Trade-Offs for Realistic Privacy (Book Chapter).
  Paris Kitsos and Yan Zhang (Ed.): RFID Security: Techniques, Protocols and System-On-Chip Design. 2008.
  
• Karsten Nohl and David Evans. Hiding in Groups: On the Expressiveness of Privacy Distributions.
  23rd International Information Security Conference (SEC 2008). September 2008.
  
• Karsten Nohl, Starbug, Henryk Plötz, and David Evans. Reverse-Engineering a Cryptographic RFID Tag.
  USENIX Security. August 2008.
  
• Karsten Nohl. Privacy through Noise: A Design Space for Private Identification.
  Secure Component and System Identification Workshop (SECSI). March 2008.
  
• Karsten Nohl and David Evans. Quantifying Information Leakage in Tree-Based Hash Protocol (Extended Technical Report).
  8th International Conference on Information and Communications Security (ICICS). December 2006.
  

Ongoing Hardware Security Research

We are continuing to reverse-engineer and pen-test embedded security functions. The current state of three of our projects was presented at 26th Chaos Communications Congress (26C3) in Berlin.

The GSM project and two other projects were previously presented at the Hacking at Random (HAR) conference:

Starbug and I illustrated the state of reverse engineering smart cards (also summarized by Heise) in a talk at 25th Chaos Communications Congress:

TI EVM Firmware

We strongly believe that security systems generally get compromised at some point. In the case of smart card installations, a compromise typically mandates the entire reader infrastructure and all cards to be replaced. This excessive cost of security breaches is avoidable when the reader infrastructure can be upgraded to implement countermeasures and support new cards.

Towards a multi-standard fully-upgradable RFID reader, we implemented Mifare Classic support in the Texas Instruments TRF7960 RFID Evaluation Module. This module provides a sound base for countermeasures including card fingerprinting, and appears to be a good upgrade platform from Mifare Classic to cards with stronger encryption. Further development on this platform is coordinated through this mailing list

This software includes a patch for the EVM stock firmware (TRF7960_Parallel_SPI_Firmware_Ver3-2_EXP.zip), which is available through the RFID-TRF7960/61 extranet. Contact TI to get access.

Mifare Security

Henryk Plötz and Starbug from the CCC Berlin and I announced the break of the crypto algorithm in Mifare Classic RFID smartcards at the 24C3 congress in December 2007. The Mifare Classic card is used in many micro-payment application including the Oyster card, the CharlieCard, and the OV-Chipkaart.

To address concerns about the security of the Dutch OV-Chipkaart, we have issued this press release:

In response to our work, the research agency TNO assessed the security of the OV-chipkaart system and found our claims to be accurate in a report issued Feb 29th. We welcome the report's call for the currently used cards to be replaced with more secure cards, but question the estimate that an attack will not happen within two years.

To help further understand the security of Mifare Classic-based systems, we assess the strength of the underlying cryptographic cipher and find that secret keys can be recovered within minutes on a typical PC:

NXP, the manufacturer of the Mifare cards, announced an improved version that addresses all recent points of critique: it's build around standard cryptography and even provides some level of privacy protection.

The smart-card group at Royal Holloway, University of London released a third (and final) assessment of OV-Chipkaart's security for the Dutch government. The assessment confirms our analysis and recommends operators of Mifare Classic-based systems to migrate to more secure cards with publicly scrutinized cryptography:

Through further analysis of Crypto-1, we found the cipher to be highly vulnerable to algebraic attacks. Our most efficient attack takes only seconds on a PC, can operate on passively sniffed data from meters away, and works despite strong random numbers in Mifare Plus. The results were first announced at EuroCrypt 2008's rump session.

Our technique of hardware reverse-engineering used to recover the Mifare Crypto-1 cipher will be presented at Usenix Security:

Steve Ragan at The Tech Harald covers our story in great detail and with extensive technical expertise in a series of articles:

Some news articles covering the story include:

Please note that we have not compromised the security of credit cards as some of the articles suggest. As far as we can tell, RFID-enabled credit cards have no security (yet?), and hence there is nothing to compromise.

Further clarifications on our smartcard work have been posted to our research blog.

Google has a video of our talk at 24C3 (slides):