Studying the pseudo random number generator of a low-cost RFID tag

Due to severe limitations in their computational and storage capabilities, many low-cost RFID tags have been shown to implement quite weak authentication protocols, largely due to weakness in their pseudorandom number generators (PRNG). This aim of this is to examine the PRNG in use within the authentication protocol of the new NXP MIFARE Ultralight C RFID low-cost card. The article investigates the nonces generated by the card during the authentication protocol to assess their randomness, and to test any possible attacks down this path. We confirm the validity of the methodology by applying similar techniques to the Mifare 1K Classic, confirming previously discovered weaknesses. We conclude that in the light of our analysis, the PRNG of the Ultralight C is a major improvement over that of the Mifare 1K, and that the nonces generated by the former can't be easily distinguished from truly random ones.