MIFARE DUOX

MIFARE DUOX (NXP, launched 2024) is the first MIFARE product with asymmetric (public-key) cryptography built in. It keeps the familiar DESFire-style model of applications and files with AES keys, and adds elliptic-curve cryptography (ECC) next to it. The name is a nod to having both: symmetric and asymmetric.

#The problem it's aimed at

Classic access systems with secure cards still rely on shared symmetric keys. For a reader to check a card, it has to hold the same secret the card does, so every reader in a deployment holds the site's keys. Pull the key out of one reader, or one leaky integration, and the whole site is exposed.

#What ECC changes

With public-key crypto (see Public-key cards):

• The card holds a private key that never leaves the chip.
• Readers verify the card with a public key or certificate. That's information they can hold without being able to make cards.
• Cards can carry certificates, so a reader can check "this credential was issued by the organisation I trust" even when it's offline.
• Key agreement (ECDH) lets the card and reader set up a fresh encrypted session without a pre-shared secret.

#Where it fits

DUOX targets the places DESFire and its predecessors live, such as building access and campus cards, plus uses where proving who issued a credential matters, like digital ID and mobile-credential ecosystems. Because it keeps the DESFire-style model, existing systems can adopt the asymmetric features step by step.