From 5bb12724aee538716af9596d53ccf6c4b3bee2b4 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 30 Aug 2019 08:51:31 +0200 Subject: [PATCH] add: updated the loclass document --- doc/loclass_notes.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 doc/loclass_notes.md diff --git a/doc/loclass_notes.md b/doc/loclass_notes.md new file mode 100644 index 000000000..d77e8ba57 --- /dev/null +++ b/doc/loclass_notes.md @@ -0,0 +1,22 @@ +# About LOCLASS attack + +This document is primarily intended for understanding `hf iclass loclass` and used files with it. + +LOCLASS aim is to recoved the used masterkey for that specific reader configued in Elite mode / High Security mode. + +LOCLASS, is a two part attack. First is the online part where you gather needed information from the reader by presenting a carefully selected CSN and save the responses to file. For the first part you run `hf iclass sim 2` and take notice of the saved filename. + +The second part is offline, where the information gathered from the first step is used in a series of DES operations to figure out the used +masterkey. run `hf iclass loclass f abc.bin' + +If you don't have access to a iClass SE reader configured in Elite mode there is a test file which you can use. +`hf iclass loclass f iclass_dump.bin` + + +# Unit testing +In order to verify that loclass is actually working, there is a "unit" test mode. run `hf iclass loclass t`. +This test mode uses two files. +- iclass_dump.bin + this is a sample file from `hf iclass sim 2`, with complete keytable recovery, using 128 carefully selected CSN and the file contains the MAC results from reader. +- iclass_key.bin + this is file shall contain the legacy masterkey, AA1 key. loclass uses it to verify that permution / reversing / generation of key is correct. \ No newline at end of file