Closer to the Bits.

The transponder threat surface

Contactless credentials split cleanly by frequency. Low frequency (125 kHz) is the world of vehicle immobilizers and legacy access fobs: Hitag2, Megamos Crypto, Texas Instruments DST, EM4100, HID Prox. High frequency (13.56 MHz) is the world of NFC — MIFARE Classic, Ultralight, DESFire, NTAG, iCLASS. The two bands demand different antennas and different tools, but they share one property that makes this paper possible: for a large installed base, the secret protecting the credential is computed by a cipher that no longer holds.

The consequences are not academic. A cloned immobilizer transponder starts a car. A recovered MIFARE Classic sector key opens a door, refills a stored-value purse, or forges a hotel master. A cleartext EM4100 badge is copied in seconds. The question a security team should ask is never "is it encrypted?" but "which cipher, and is that cipher broken?"

A tour of the broken ciphers

What follows is a working attacker's map, not a literature review. Each entry states what the cipher protects, how it fails, and — the part that matters for a tool you would actually deploy — whether SSR-Labs reproduces it against a known-answer test (a published input/output vector), or merely implements the specification where no such vector exists.

Crypto-1 (MIFARE Classic)

A 48-bit stream cipher with a filter generator over an LFSR. Nohl et al. reverse-engineered the silicon in 2008; Garcia et al. formalized the attacks. The nested, darkside, mfkey32 and hardnested techniques recover sector keys from sniffed authentications or a single known key. SSR-Labs ships its own in-house Crypto-1 engine (ssrcrypto.dll) covering mfkey32, nested, nested_multi, darkside, static-nested and the Fudan FM11RF08S static-nested case — with a live blind crack of a MIFARE S50 in roughly 42 seconds on CPU.

Hitag2 (ID46)

A 48-bit cipher guarding a huge population of vehicle immobilizers and remote entry systems. Verdult, Garcia and Balasch's "Gone in 360 Seconds" (2012) turned two sniffed authentications into a practical key recovery. SSR-Labs' Hitag2 core is verified bit-exact against the AdamLaurie/RFIDler reference vector D8A13560 (post-init keystream) and drives dictionary, weak-key, masked and GPU-accelerated recovery.

Megamos Crypto (ID48)

The 96-bit-key, 57-bit-state cipher behind VAG-group immobilizers of the 2005–2013 era — famous for the two-year injunction that delayed its publication. With the transponder's partial key material recovered from the tag, SSR-Labs' native solver returns the full 96-bit key candidates immediately.

Texas Instruments DST40 & DST80

DST40's 40-bit key fell to Bono et al. in 2005 (the Exxon SpeedPass / immobilizer break); DST80 (Wouters et al., 2020) shares the round function. SSR-Labs implements the DST40 cipher against the public vectors 5CA1BA and CD6504, and DST80 against four Apache-licensed vectors — then brute-forces the 40-bit space on CPU or GPU.

KeeLoq, iCLASS legacy, Atmel CryptoMemory

KeeLoq's NLFSR block cipher (verified here against vector E44F4CDF) underpins rolling-code remotes; SSR-Labs models the cipher and hop-decoding but deliberately ships no manufacturer keys. iCLASS legacy key diversification (hash0 over single-DES) is verified against nine Proxmark vectors plus a DES vector. The Atmel SecureMemory/CryptoMemory stream cipher is the one honest asterisk in the set — see §3.

Methodology: prove the break, don't assume it

A cipher implementation that looks right and even round-trips can still be subtly wrong — a swapped tap, an off-by-one in the key schedule, a byte-order slip. Such a bug produces confident, useless output. SSR-Labs' answer is a single rule applied without exception: every shipped cipher is checked, bit-for-bit, against a published known-answer test (KAT), and a one-button self-test runs the whole set on start-up.

The one exception is stated openly rather than hidden. The Atmel SecureMemory/CryptoMemory cipher has a fully published specification (Garcia et al., CCS 2010; Biryukov et al., 2011) but no public numeric test vector. SSR-Labs implements it faithfully and verifies what can be verified — the 109-/117-bit state geometry, the modular-addition and rotation primitives, determinism, and a behavioural invariant the paper itself derives (an output-correlation of exactly ¾). Bit-exactness we mark pending, because integrity means never labelling "spec-true" as "verified".

// Oracle gate — the kernel proposes, our verified core disposes.
foreach (Match m in Regex.Matches(gpuStdout, "[0-9A-Fa-f]{12}")) {
    ulong cand = Convert.ToUInt64(m.Value, 16);
    // re-derive the keystream with SSR-Labs' own Hitag2 cipher:
    if (auths.All(a => Keystream32(cand, uid, a.Nonce) == a.Ks))
        return cand;   // confirmed — safe to report
}

Excerpt — SSR-Labs suite, Ht2GpuBridge. In-house code.

Benchmarks: how fast, honestly

Speed is where marketing usually detaches from truth, so here are numbers we measured — CPU figures per single thread, GPU figures on one NVIDIA GeForce RTX 5050 (entry-class Blackwell, OpenCL 3.0), each GPU kernel first verified on that same card against its KAT. The two GPU kernels are SSR-Labs' own OpenCL, built as zero-dependency hosts: no CUDA toolkit, no SDK, no registry entry — they run on a stock GeForce driver.

What SSR-Labs has that others don't

• An in-house Crypto-1 engine. Faster than the classic upstream through O(16) validation and thread-local scratch.
• Oracle-gated GPU cracking. Every GPU result is re-verified by our own reference cipher before it is trusted. Speed from the GPU, certainty from our core.
• Two in-house OpenCL kernels (DST40, Hitag2), each with a zero-dependency host that loads the driver's OpenCL runtime directly — no CUDA toolkit, no SDK install, no registry ICD entry.
• Known-answer discipline as policy. Fourteen engines verified bit-exact; the one spec-only cipher is flagged, never dressed up as verified.
• One reader layer for all of it. PN532, full Proxmark3 pass-through, FR-RATEL/iCopy, ACR122U, Chameleon, and an in-house ESP32-S3 LF add-on — selected once, used everywhere.
• PulsPirat, the built-in signal analyzer, hardened against ~14,000 real captured samples with zero crashes; plus integrated public CVEs (Saflok, KioSoft, FM11RF08S, Be-Tech, Telenot).

Defensive recommendations

The reason to measure a break precisely is to retire the thing that breaks. For asset owners and security teams:

Scope & responsible use

The SSR-Labs suite is a diagnostic instrument for owners and authorized testers. It is built exclusively from public and open-source research; it contains no manufacturer or conditional-access keys, no leaked specifications, and no turnkey vehicle-theft or pay-TV tooling. Rolling-code and relay attacks are modelled at an awareness level so defenders understand their exposure — not packaged as one-click openers. Every capability in this paper is intended for lawful, authorized security assessment.

References

1. Nohl, Evans, Starbug, Plötz. Reverse-Engineering a Cryptographic RFID Tag. USENIX Security, 2008.
2. Garcia, de Koning Gans, Muijrers, van Rossum, Verdult, Schreur, Jacobs. Dismantling MIFARE Classic. ESORICS, 2008.
3. Verdult, Garcia, Balasch. Gone in 360 Seconds: Hijacking with Hitag2. USENIX Security, 2012.
4. Verdult, Garcia, Ege. Dismantling Megamos Crypto: Wirelessly Lockpicking a Vehicle Immobilizer. USENIX Security, 2015 (written 2013).
5. Bono, Green, Stubblefield, Juels, Rubin, Szydlo. Security Analysis of a Cryptographically-Enabled RFID Device (TI DST40). USENIX Security, 2005.
6. Wouters, Van den Herrewegen, Garcia, Oswald, Gierlichs, Preneel. Dismantling DST80-based Immobiliser Systems. IACR TCHES, 2020.
7. Garcia, van Rossum, Verdult, Schreur. Dismantling SecureMemory, CryptoMemory and CryptoRF. ACM CCS, 2010.
8. Biryukov, Kizhvatov, Zhang. Cryptanalysis of the Atmel Cipher in SecureMemory, CryptoMemory and CryptoRF. ACNS, 2011 (IACR ePrint 2011/707).
9. Meijer, Verdult. Ciphertext-only Cryptanalysis on Hardened MIFARE Classic Cards. ACM CCS, 2015.
10. Indesteege, Keller, Dunkelman, Biham, Preneel. A Practical Attack on KeeLoq. EUROCRYPT, 2008.
11. Garcia, de Koning Gans, Verdult, Meriac. Dismantling iCLASS and iCLASS Elite. ESORICS, 2012.