Authentication is only one step
The 2026 “BREAKMEIFYOUCAN!” study examines MIFARE Ultralight C, Ultralight AES, NTAG 223/224 DNA and several compatible or counterfeit products. Its central lesson is that protocol state, writable key storage, integrity checks, key diversification and hardware quality can determine the outcome even when a device uses 3DES or AES.
This is a deployment and protocol case, not a break of the AES primitive. The tag model and configuration matter: results from one counterfeit family do not automatically apply to genuine NXP silicon or every installation.
Hardware evidence limit: in §14 the authors report obtaining a few NTAG 223 DNA StatusDetect samples but no NTAG 224 DNA samples. Their NTAG 224 DNA interpretations are preliminary, based on documentation and similarities to tested products; they are not measurements on that model.
The relay leaves the tag authenticated
In the paper’s relay scenario, the attacker’s goal is to leave the tag in an authenticated state. The legitimate reader may time out while the tag accepts the relayed exchange. That is more specific than the usual story of persuading a reader that a distant card is nearby.
Subsequent actions depend on the tag’s access controls and command integrity. Where authenticated key storage remains writable, partial overwrites can reduce the unknown key material. Multiple tags sharing a key can make recovery easier. These conditions belong next to the result; “uses AES” alone does not describe the system.
Configuration changes the attack surface
| Condition to inspect | Why it matters |
|---|---|
| Locked versus writable key/configuration pages | Controls whether the relevant post-authentication overwrite path is available. |
| Command integrity, including enforced CMAC where supported | Enforced Ultralight AES CMAC protects against unauthorized command injection. The paper separately describes relayed tearing of genuine WRITE commands, conditional on reader timing and the relevant writable storage; CMAC does not make these distinct attack paths equivalent. |
| Shared versus diversified keys | Several tags using the same secret can support attacks that are unavailable in that form with per-tag keys. Diversification does not prove every other path safe. |
| Genuine versus compatible/counterfeit hardware | Randomness, lock behavior and implementation details differ. Fast results on weak counterfeit generators are separate from genuine-tag results. |
| Relay timing and authenticated state | A reader timeout does not by itself demonstrate that the tag returned to an unauthenticated state. |
Demonstration, extrapolation and theory
The paper distinguishes implemented attacks from workload estimates and theoretical proposals. In particular, its single-tag Ultralight C proposal in §17 is theoretical. It requires unlocked key pages and access to a legitimate reader. The first 28-bit segment alone is estimated to require about 777 days at two reader-assisted attempts per second; further recovery stages follow. The assumed number of EEPROM writes also exceeds the guaranteed endurance, and the paper’s five-million-write experiment does not demonstrate completion of that first stage. It must not be presented as the fast counterfeit-tag demonstration.
This exhibit follows revision 1.1, dated 28 August 2026. The revision corrects an earlier recovered-bit extrapolation. Numbers copied from an older summary can therefore misrepresent the paper’s current evidence.
A browser demonstration cannot measure physical distance securely. Crypto Lab’s distance-bounding work is a related protocol lesson; this museum exhibit supplies the device history and the distinctions between authentication, proximity, integrity and key storage.
Primary source and connections
Nathan Nye and coauthors, “BREAKMEIFYOUCAN!: Exploiting Keyspace Reduction and Relay Attacks in 3DES and AES-protected NFC Technologies”, ePrint 2026/100, revision 1.1 (28 August 2026). This is a preprint; ePrint posting does not establish peer review. See §4, §12.1–12.3 for command integrity and tearing, §14 for the NTAG sample limitation, §17 and Appendix A; PDF pp. 3–5, 15–16, 19–22 and 23–30.
AES · DES and Triple DES · Compare measured attacks, extrapolations and physical fault access