How do Mifare cards work?

Question

Information Security

I apologize if this question has been asked, but I couldn't find anything similar.

a little background

Когда-то давно заинтереосвался возможностью вход в Windows по картам, сначала искал готовые варианты: Как в Windows настроить вход по RFID карте?. В итоге разработал совю, но вот проблема: моя система использует для авторизации карты HID и Em-Marin, то есть вся защита строится на номерах карт. Меня такое неу устраивает поэтому

I decided to study the principle of operation of Mifare cards and came across a key problem. As far as I understand, access key A or B is already required to access the sectors of the card. If I have old Mifare cards (bank cards), then I can’t get the key, only brute force? It cannot be somehow reset by clearing the contents of the card or erased in another way? Maybe there is some default key? If I buy a new Mifare card in the store, will this key come with it or will it need to be set during the first use? And the question is: is it better to store the access code to the card on the computer or ask the user to enter it when logging in for a secure login with the card?

PS I read the official specification of the cards and the acr122u reader, but everything is not written there, including how to change the key.

Answer 1

This is a sore point, smart card logon with certificates. There is no universal and simple suitable solution, even a paid one. Everywhere there are terrible creepy crutches that you either cannot master yourself in a reasonable time, or they work terribly crookedly. There, in general, there is a simple authorization system, public keys are stored on the cards, private keys are stored on the domain controller, when you enter using the card, the key pairs are checked. And, of course, not the certificate files themselves are checked, but their hashes. By analogy with imsi keys in mobile SIM cards. Therefore, you need to start by looking for suitable rewritable SC cards, where to find them at all - to be honest, I have no idea.
In theory, dry and briefly - as you know, there are 2 types of SC standard cards - those where the key (or a set of some data, or a certificate file) is tightly sewn one-time (bank), and those where it can be overwritten by hand as needed.
Both of them, in addition, can be protected by a pin code that blocks the card in the event of N attempts to enter the wrong pin code.
Well, the whole infrastructure is built, of course, on the creation of its own CA in AD, which will steer the release of pairs of certificates and associate them with end accounts. And the mechanism for reading data from the card in Windows is simple, no additional software is needed, the system already has everything you need in the core, connected the SC card reader and Windows itself already offers, if the computer is in the domain, enter using a smart card.

Answer 2

The issue is partially resolved: the factory code from Mifare Classic is FF FF FF FF FF FF, but it's not clear what to do with used cards from which there are no codes