Counter Expertise Review of the

In February 2008 TNO produced a public report summarising its security analysis of the Dutch OVChipkaart. The TNO analysis had been commissioned by Translink Systems (TLS) to assess a technical presentation at a recent conference of the Chaos Computer Club (CCC), which claimed that the Mifare Classic card technology and algorithm had been broken and were essentially unfit to underpin the security of the TLS OV-Chipkaart system. Any such claims are damaging to public confidence and when substantiated, would require a significant and costly programme of remedial work for the transport companies and potentially cause distress and inconvenience for travellers. Therefore the TNO report's findings, conclusions and recommendations are extremely sensitive, not only from a business viewpoint, but also for government planning and for public acceptance of the system. For this reason the Dutch Ministry of Transport, Public Works and Water Management authorised an independent Counter Expertise (CE) task to review the TNO report. The selected Counter Expertise Bureau (CEB) was the Information Security Group (ISG) at Royal Holloway University of London and the project was led by the ISG Smart Card Centre (SCC). The CEB was selected on the basis of independence, the information security and smart card expertise of the project team, as well as extensive experience of transport system security as a whole. The Het Expertise Centrum (HEC) was responsible for general facilitation of the task and acted as the interface between the Ministry and the CEB.