EXPLOITING KEYSPACE REDUCTION AND RELAY ATTACKS IN 3DES AND AES-PROTECTED NFC TECHNOLOGIES

Summary from the TLDR InfoSec newsletter

Modern NFC cards used in hotel keys, tickets, and access systems can be attacked not by breaking 3DES or AES, but by abusing how keys and memory are handled after authentication. By relaying the legit reader–card handshake and then partially overwriting key bytes, attackers can shrink the effective keyspace from astronomically large to something brute‑forceable with modest hardware. Weak or missing integrity checks, non‑atomic key writes, and flawed non‑NXP clone cards make it possible to recover full keys from one or a few tags, sometimes in under a minute. Proper key diversification, locking key pages, enabling CMAC/secure messaging, and migrating to stronger platforms like DESFire EV3 sharply reduce these risks.