1 files changed, 24 insertions, 15 deletions
diff --git a/paper/easycard.tex b/paper/easycard.tex
index 321e5ef..101ce22 100644
--- a/paper/easycard.tex
+++ b/paper/easycard.tex
@@ -2,6 +2,8 @@
 \usepackage[english]{babel}
 \usepackage{graphicx}
 \usepackage{subfigure}
+\usepackage[T1]{fontenc}
+\usepackage{times}
 \pagestyle{plain}
 
 \usepackage{url}
@@ -64,13 +66,17 @@ the technology designed for and used by operators of security relevant systems
 such as banking.
 
 %%%%%%%%%%%%%%%%%%%
-\section{Technical Background}
+\section{System overview}
+TODO Karsten
 
 FIXME: Describe system -- Mifare Classic + Unique keys + (online?) fraud detection
 
 %%%%%%%%%%%%%%%%%%%
 \section{MIFARE Classic security}
 
+%%%%%%%%%%%%%%%%%%%
+\subsection{MIFARE Classic weaknesses}
+
 FIXME: Summarize the existing research on mifare classic systems
 
 MIFARE Classic security came under increased scrutiny following a talk at the 24\th{} Chaos Communication Congress in December 2007 which described some of the first results of silicon reverse engineering research on the MIFARE Classic 1k chip. For reasons of responsible disclosure not all details were published, but these were then independently, and partially orthogonally, research by a group of Dutch security researchers out of Radboud University Nijmegen, fueled the rollout of a new Dutch public transport payment system based on MIFARE Classic, the OV Chipkaart.
@@ -81,17 +87,20 @@ MIFARE Classic security came under increased scrutiny following a talk at the 24
 % Card-only attacks
 
 %%%%%%%%%%%%%%%%%%%
-\section{MIFARE Classic Attack Tools}
+\subsection{MIFARE Classic Attack Tools}
+
+\subsubsection{Crapto1}
+TODO: introduce libnfc
+\subsubsection{MFOC}
+\subsubsection{MFCUK}
+\subsubsection{CryptoMiniSat}
+
+The above attacks exploit predictable random numbers and information leakage through parity bits. Both weaknesses are fixed in newer versions of the MIFARE Card such as the MIFARE Plus card in MIFARE Classic emulation~\footnote{MIFARE Plus also supports strong AES encryption. The MIFARE DESfire card also provides strong encryption and fixes the random numbers in MIFARE Classic emulation mode, but still leaks information through parity bits}.
 
-\subsection{Crapto1}
-\subsection{libnfc}
-\subsection{MFOC}
-\subsection{MFCUK}
-\subsection{CryptoMiniSat}
-FIXME: summarize results (12 seconds per key), state that attack applies to Mifare DESfire, Mifare Plus in Classic emulation mode
+FIXME: summarize results (12 seconds per key), state that attack applies to MIFARE DESfire, MIFARE Plus in Classic emulation mode
 
 %%%%%%%%%%%%%%%%%%%
-\section{Analyzing the EasyCard}
+\section{EasyCard analysis}
 
 The following results were generated using new EasyCard obtained from a vending machines in a Taipei MRT station in August 2010.
 
@@ -235,10 +244,10 @@ The result of this analysis can be found in the next section:
 
 \section{EasyCard data format}
 
-\subsubsection{Sector 0 and 1: The header}
+\subsection{Sector 0 and 1: The header}
 FIXME
 
-\subsubsection{Sector 2: The card balance as value block}
+\subsection{Sector 2: The card balance as value block}
 
 The first two blocks of sector 2 store the current remaining debit account
 balance as a MIFARE Classic VALUE BLOCK.  The format of this block is
@@ -254,7 +263,7 @@ sufficient to read and decrement the VALUE block.
 Re-charging the card must happen using authentication with key B, as only
 key B has permissions to increment and/or write to this sector.
 
-\subsubsection{Sector 3 through 5: The transaction log}
+\subsection{Sector 3 through 5: The transaction log}
 
 Every time a transaction is made with the card, an entry in the transaction log 
 on the card itself is generated.  Every entry occupies one full 16-byte block.
@@ -304,7 +313,7 @@ the same number in this field.
 
 FIXME: Transaction log pointer
 
-\subsubsection{Sector 7: The last MRT entry/exit record}
+\subsection{Sector 7: The last MRT entry/exit record}
 
 Block 2 (Offset 0x1e0) contains a record describing the last MRT station
 that was entered using this EasyCard.
@@ -324,7 +333,7 @@ It is assumed that this information is used by the system to compute both the
 distance (and thus fee) to be paid by the current ride, as well as any
 applicable discount in case a connection is made from MRT into a bus.
 
-\subsubsection{Sector 15: Maximum daily spending}
+\subsection{Sector 15: Maximum daily spending}
 
 Block 2 (Offset 0x3e0) contains a record used for keeping track of
 the amount of money spent on a single day.  This is needed in order
@@ -500,7 +509,7 @@ end it will be the consumer who pays them indirectly due to higher prices
 including such fees.
 
 
-\section{Improvement potential}
+\section{EasyCard improvement potential}
 
 The author of this paper argues that use of the current EasyCard system
 should immediately be restricted to payment for public transportation,