Dutch semiconductor manufacturer NXP is making a mistake suing Radboud University Nijmegen in the Netherlands, says Karsten Nohl, a University of Virginia graduate student who worked with others to break the MIFARE cryptographic algorithm. “It’s a terrible decision, there is no legal case to be made,” Nohl says. “This was reverse engineered legally without any help from NXP.”

NXP has sued the university to block details of a security flaw in NXP’s MIFARE Classic contactless smart cards. The MIFARE Classic line of products is possibly the world’s most widely deployed contactless product, used for many transit and physical security applications.

The university had sent its research to NXP for review before publishing it, Nohl says. The university did this to inform NXP of the vulnerability in hopes that the chip manufacturer would remedy the situation and inform users that the systems are weak. In the future researchers might not be as kind and instead just publish the research without letting NXP review it first. While Nohl has just about completed his work on MIFARE, if he were to do any additional work he would probably publish it without pre-informing NXP.