Recover Mifare Classic key from authentication trace - rfid

Question

I have been given a Mifare Classic authentication trace and was wondering if there are any tools or tutorials I could use to obtain the key?
Start | End | Src | Data
---------|---------|-----|--------
0 | 4704 | Rdr | 60 00 f5 7b
6708 | 11380 | Tag | 21 91 c4 03
82240 | 83552 | Rdr | 26
249792 | 250848 | Rdr | 26
252020 | 254388 | Tag | 04 00
333568 | 336032 | Rdr | 93 20
337204 | 343092 | Tag | 45 c7 a6 23 07
446208 | 456672 | Rdr | 93 70 45 c7 a6 23 07 f8 f6
457908 | 461428 | Tag | 88 be 59
1870544 | 1875248 | Rdr | 60 00 f5 7b
1877252 | 1881924 | Tag | be fd 8b 22
1953424 | 1954736 | Rdr | 26
2120208 | 2121264 | Rdr | 26
2122452 | 2124820 | Tag | 04 00
2205152 | 2207616 | Rdr | 93 20
2208788 | 2214676 | Tag | 45 c7 a6 23 07
2317024 | 2327488 | Rdr | 93 70 45 c7 a6 23 07 f8 f6
2328724 | 2332244 | Tag | 88 be 59
2538400 | 2543104 | Rdr | 60 00 f5 7b
2545108 | 2549844 | Tag | b3 38 4c d0
2651552 | 2660864 | Rdr | 55 09 6b fe ec fa ba c2 !crc
2662100 | 2666836 | Tag | a3! bf! 4f 07
17282768 |17287536 | Rdr | ef b6 fc 33 !crc

Answer 1

The paper Garcia et al.: Dismantling MIFARE Classic (ESORICS 2008) should give you a good starting point:
"The second and more efficient attack uses a cryptographic weakness of
the CRYPTO1 cipher allowing us to recover the internal state of the
cipher given a small part of the keystream. To mount this attack, one
only needs one or two partial authentication from a reader to recover
the secret key within one second, on ordinary hardware. This attack
does not require any pre-computation and only needs about 8 MB of
memory to be executed.
When an attacker eavesdrops communication
between a tag and a reader, the same methods enable us to recover all
keys used in the trace and decrypt it. This gives us sufficient
information to read a card, clone a card, or restore a card to a
previous state. We have successfully executed these attacks against
real systems, including the London Oyster Card and the Dutch
OV-Chipkaart."
In addition, the CRAPTO1 library (it's based on the above paper and some other discoveries) should give you a starting point on how to implement a tool to recover keys from recorded MIFARE Classic traces.
The interesting parts of this trace are:
446208 | 456672 | Rdr | 93 70 45 c7 a6 23 07 f8 f6
That's the reader's select command, from which you can get the tag's UID: 45 c7 a6 23.
1870544 | 1875248 | Rdr | 60 00 f5 7b
That's an authentication command with Key A for sector 0.
1877252 | 1881924 | Tag | be fd 8b 22
That's the random number sent by the tag in response to the authentication command. THe command is aborted after the tag sent the random number.
2538400 | 2543104 | Rdr | 60 00 f5 7b
That's an authentication command with Key A for sector 0.
2545108 | 2549844 | Tag | b3 38 4c d0
That's the random number sent by the tag in response to the authentication command.
2651552 | 2660864 | Rdr | 55 09 6b fe ec fa ba c2 !crc
That's the reader's random number (enciphered with keystream ks1) and the reader's response to the tag's challenge (random number) based on the authentication key (enciphered with keystream ks2).
2662100 | 2666836 | Tag | a3! bf! 4f 07
That's the tag's response to the reader's challenge (random number) based on the authentication key (enciphered with keystream ks3).
I wonder if my calculation is correct and the key is 36 ... 41!?