Mifare card security

Question

Some days ago I connected a USB contact-less Smart-Card reader and sniffed that USB port via an USB Sniffer tool. Afterward, I put a 1k Mifare card on the reader and read 1 byte.

I take a look at the sniffer tool output and understand that the keys (read key and write key) transferred to the card without any encryption!

Now I want to know is this mechanism really safe??! If I change my reader's API to make it behave like a Mifare card and move it close to the original reader and sniff the communication between two card readers via my computer can't I gain the keys?!

Is this possible to make a Reader behave like a mifare card in the field of another contactless reader?

---

Update : As I know it is mandatory to load keys on mifare card, before sending authenticate command! As you see below, I load keys on card! [It is FF FF FF FF FF FF by default].

Simultaneously I sniffed the USB port that my ACRA122U connected to! As you see below, the keys was sent in plain!

What is wrong with what I did?!

Note: Miss Hedayat (My Colleage), also confirmed it! :))

Answer 1

You are not sniffing the communication between the reader and the MIFARE Classic card but between the PC and the reader (USB CCID).

In order to communicate with a MIFARE Classic card, you have to load the access keys onto the reader. That's what the "load authentication keys" command (in your screenshot) does. In the case of the ACR122U, keys are stored into volatile memory on the reader. Other readers may support non-volatile key slots too (see the readers' documentation and the PC/SC specification section on contactless memory cards).

Later, when you issue an authentication command, the reader will perform the MIFARE Classic mutual authentication, which is basically a challenge response authentication and key agreement protocol. So instead of sending the actual key to the card, the reader will receive a random number from the card, will encrypt the random number with the key and will return that encrypted random number to the card. The card will then decrypt the random number with the same key and can thus verify if the reader used the correct key.

Answer 2

No, the keys are not transferred in plain, since there is no need to transfer any key in the scenario of reading one byte, depending on the configuration they may need to be applied. I have no idea, what your sniffer output tells you.

No, Mifare (Classic) is not safe, but this is a separate question sufficiently answered at SO. Summarized: the key is too short and therefore the cryptographic algorithm used is too weak.

No, a reader can't disguise as card; even if it could: you seem to think, that the keys are broadcast and then you could simply grab them from air, which is far from the mark.