Exercise: Challenge/response functions

Scenario

Your goal is to break an RFID card that is used to enter a building. You know what type of card is being used, and you bought a blank card. In addition, you have access to a card reader (terminal).

In addition, you can eavesdrop the communication between a valid card and the entrance terminal of the building.

Finally, you know that the challenges, responses, and keys all consist of four (decimal) numbers.

Your goal is to get access to the building.

Step 1: Reverse Engineering

The first step consists of determining the mathematics of the challenge-response function. You could do this by using your own blank card and terminal, where you can determine the key and challenge. You could do so for different challenges and use this to determine a pattern among the responses.

Try challenges and keys

		Key
Challenge				Response
		Compute

Did you figure out the math behind the challenge-response function? Go to step #2.

Step 2: Break the challenge-response function

Once you determined how the challenge-response function works, you can try to break it. This means that you try to recover the key based on the challenges and responses of a certain card that you can eavesdrop.

Eavesdrop

		Key
		????
Challenge				Response
		Compute

Eavesdrop

Did you recover the secret key? Go to step #3.