Today, we were able to read data from sector 0 using existing NFC API in android.
Knowing the plaintext response from a sector of the MiFare is the key component in the latter part of our project in order to break the crypto 1 algorithm.
Crypto1 Algo:
Payload XOR KeyStream = Cyphertext
The idea is that the keystream can be kept constant because of the repeating nonce issue in MiFare Classic cards. If we also know the cyphertext and the payload, we can reconstruct the keystream.
Below is a brief trace of the actual response of the Q card.
Q Card
—————
SAK: 0x08
ATQA: 0x0400
ID: AA:65:8F:DB
Data
Sector 0
[00] AA 65 8F DB 9B 88 04 00
46 51 75 52 4D 10 13 08
[01] 20 00 54
..
[03] A0:A1:A2:A3:A4:A5 MAD access key
WxW 69:67:89 C1