Contactless Smart Card Security: Encryption, Mutual Authentication, and Threat Models

How a contactless transaction is protected

The radio layer

A card using ISO 14443 (HF, 13.56 MHz) is powered by the reader's field and exchanges APDU commands. Without cryptography, the link is sniffable — which is why the data must be protected above the physical layer.

Encryption

Sensitive data is encrypted, typically with 3DES or AES. A shared or derived session key means an eavesdropper captures ciphertext, not card numbers.

Mutual authentication

I

n

m

u

t

u

a

l

a

u

t

h

e

n

t

i

c

a

t

i

o

n

t

h

e

c

a

r

d

a

n

d

t

h

e

r

e

a

d

e

r

e

a

c

h

p

r

o

v

e

t

h

e

y

h

o

l

d

t

h

e

s

e

c

r

e

t

k

e

y

b

e

f

o

r

e

a

n

y

s

e

n

s

i

t

i

v

e

o

p

e

r

a

t

i

o

n

.

T

h

i

s

s

t

o

p

s

f

a

k

e

r

e

a

d

e

r

s

(

s

k

i

m

m

e

r

s

)

f

r

o

m

h

a

r

v

e

s

t

i

n

g

c

a

r

d

d

a

t

a

a

n

d

s

t

o

p

s

f

a

k

e

c

a

r

d

s

f

r

o

m

f

o

o

l

i

n

g

a

t

e

r

m

i

n

a

l

.

T

h

e

s

e

s

s

i

o

n

k

e

y

i

s

o

f

t

e

n

d

e

r

i

v

e

d

f

r

e

s

h

p

e

r

t

r

a

n

s

a

c

t

i

o

n

,

s

o

a

c

a

p

t

u

r

e

d

e

x

c

h

a

n

g

e

c

a

n

n

o

t

b

e

r

e

p

l

a

y

e

d

.

Threat model and mitigations

Threat	What it is	Defense
Eavesdropping	Sniffing the radio exchange	Encryption (3DES/AES) + short range
Skimming	Rogue reader grabs card data	Mutual authentication; card never reveals secrets
Relay / ghost	Relaying a tap over distance	Distance-binding, transaction timers
Cloning	Copying a card	Secure element + unique crypto keys

Standards you will meet

Frequently Asked Questions

Related Resources