Paper 2026/100

BREAKMEIFYOUCAN!: Exploiting Keyspace Reduction and Relay Attacks in 3DES and AES-protected NFC Technologies

Abstract

This paper presents an in-depth analysis of vulnerabilities in MIFARE Ultralight C (MF0ICU2), MIFARE Ultralight AES (MF0AES), NTAG 223 DNA (NT2H2331G0 and NT2H2331S0), NTAG 224 DNA (NT2H2421G0 and NT2H2421S0), and widely circulated counterfeit Ultralight C cards based on Giantec GT23SC4489, Feiju FJ8010, and USCUID-UL. We reveal multiple avenues to substantially weaken the security of each technology and its implementation across a range of configurations. We demonstrate how, through relay-based man-in-the-middle techniques and partial key overwrites --- optionally combined with tearing techniques --- an attacker can reduce the keyspace of two-key Triple DES (2TDEA) from $2^{112}$ to $2^{28}$ or less in certain real-world deployments, thereby making brute-force key recovery feasible with modest computational resources. We further discuss how the MIFARE Ultralight AES protocol can be similarly affected, particularly when CMAC integrity checks are not enforced. We also find that the security offered by NTAG 223 DNA and NTAG 224 DNA is undermined by the absence of integrity checks on commands and the calculation of a CMAC over Secure Unique NFC (SUN) messages, providing an unauthenticated ciphertext oracle that facilitates key recovery. Field observations, especially in hospitality deployments, underscore the urgent need for proper configuration, key diversification, and counterfeit detection.

Note: Revision 1.1: Additions: • Support of the Ultralight AES authentication bypass in the Proxmark3 • Proxmark3 standalone mode to unlock an Ultralight C/AES without relay • More USCUID-UL fingerprinting data (1A00 with spurious data) • Discovery of a FJ8010 case in hospitality • Reference to Biham and Shamir CRYPTO ’97 paper • References to GPU port of counterfeit key recovery by Connor and Sam • Mention that KDF check technique also applies to other technologies such as DESFire • Counterfeit authentication based on collisions: add footnote and Proxmark3 options • Mention updated NXP datasheets Errata: • Remove wrong extrapolation from recovery of 12.625 bits per segment to 50.5 bits per card • Fix typos