BPN 1163 A faulty chip remains a faulty chip

On the day that chipmaker Intel celebrates its 40th anniversary, the Dutch semiconductor manufacturer NXP is refused an injunction to prevent indepenndent scientific researchers to publish about a faulty chip. The action by NXP Semiconductors, an offshoot of Royal Philips, looked like an American court action; only the damage suit was not filed yet.

However the judge in The Netherlands was not impressed with the request for an injunction and lets researchers publish their report on how they cracked the public transport chip card. The manufacturer of the chip card, NXP Semiconductors, had asked the judge for an injunction as it feared damage from publication. For the court the freedom of speech succeeds the potential damage.

Six month ago the researcher of the Radboud University in Nijmegen told the press that they had succeeded in cracking the code of the public transport chip card. Presently the public transport companies are in the process of introducing the chip card as form of payment. It is apolitically sensitive project, as the introduction has been postponed already several times. Besides the chip card is also in use at many ministries as entry pass for the civil servants.

The chip manufacturer NXP demanded a publication injunction, arguing that it would damage the trade of the chips and the security of its clients. However the court did not follow NXP and thought it of importance that the scientific research should be published and society should be informed about the defects of the chip card. If NXP would suffer commercial damage, the court said, it was due to production and trade of a defective chip by NXP.

The researchers discovered the secret algorithm of the Mifare Classic, a chip used in billions of access cards. The algorithm produces a secret code safeguarding the cards from copying. However the researchers found that it was easy to manipulate these chip cards and that free rides in public transport could be organised with simple computers and card readers. The researchers informed the ministries, including the one of public transport, and NXP. Later they informed the press that public transport chip cards could be cracked. However they did not publish details to allow the involved parties to take counter measures. However when the researchers wanted to present their findings at a scientific conference in Spain, they found NXP on their path.

In the meantime it became known that a Chinese company is selling a copy of the chip already since 2004. The company had to unravel the algorithm in order to copy the chip. It is unclear whether illegal access cards have been produced.

The ruling sets a precedent. Never before had a company attempted to stop a publication of independent scientific research in The Netherlands. If the court would have granted the injunction to NXP, companies could have prevented unwelcome results to be published.

Blog Posting Number: 1163

Tags: security, algorithm