View P5DF081_868077.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

1. general description the nxp mifare sam tm av2 hardware solution is the ideal add-on for reader devices offering additional security services. supporting tdea, aes and rsa capabilities, it offers secure storage and secure communication in a variety of infrastructures. unlike other products in the field, mifare sam av2 has proven intero perability with all of nxp's broad card portfolio, (mifare ultralig ht, mifare ultralight c, mifare 1k, mifare 4k, mifare plus, mifare desf ire, mifare desfire ev1 and smartmx solutions), making it the most versatile a nd secure sam solution on the market today. secured communication when used in combination with a reader ic supporting innovative "x" features, mifare sam av2 provides a significant boost in performance to the reader along with faster communication between reader and module. the "x" feature is a new way to use the sam in a system, with sam connected to the microcontroller and the reader ic simultaneously. the connection between the sam and the reade r is performed using security protocols based on either sy mmetric cryptogr aphy (tdea and aes) or pki rsa asymmetric cryptography. the protocols comply with the state-of-art standards and thereby ensure data confidentiality and integrity. 2. features and benefits 2.1 cryptography ? supports mifare crypto1, tdea (tripl e des encryption algorithm), rsa and aes cryptography ? supports mifare ultraligh t, mifare ultralight c, mifare 1k, mifare 4k, mifare plus, mifare desfire, mifare desfire ev1 ? secure storage and updating of keys (key usage counters) ? 128 key entries for symmetric cryptography and 3 rsa key entries for asymmetric cryptography ? tdea and aes based ke y diversification ? offline cryptography 2.2 communication ? up to four logical channels; simultaneous multiple card support ? support for desfire and mifare plus authentication (with related secure messaging and session key generation) P5DF081 mifare sam av2 rev. 1 ? 12 august 2010 191710 objective short data sheet public
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 2 of 36 nxp semiconductors P5DF081 mifare sam av2 ? secure host to sam an d back end to sam communication with symmetric cryptography 3 pass authentication for confidentiality and integrity ? support high speed baud rates up to 1.5 mbit/s ? secure host to sam an d back end to sam communication with rsa based cryptography ? support iso/iec 7816 baud rates ? true random number generator (trng) 2.3 delivery types ? available in wafer, pcm 1.1 module, or hvqfn package 3. applications ? access management ? public transport ? loyalty programs ? micro payment 4. quick reference data 5. ordering information table 1. quick reference data v dd ; v ss =0v; t amb = ? 25 ? c to +85 ? c symbol parameter conditions min typ max unit v dd supply voltage class a: 5 v range 4.5 5.0 5.5 v class b: 3 v range 2.7 3.0 3.3 v table 2. ordering information type number package name description version P5DF081x0/t1ad2060 pcm1.1 contact chip card module (super 35 mm tape format, 8-contact) sot658-1 P5DF081hn/t1ad2060 hvqfn32 plastic thermal enhanced very thin quad flat package; no leads; 32 terminals; body 5 ? 5 ? 0.85 mm sot617-3
xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 3 of 36 nxp semiconductors P5DF081 mifare sam av2 6. block diagram fig 1. block diagram io1 io3 programmable io1, io2, io3 io2 clk rst_n vdd vss rom 264 kb program memory cpu 7680 b data memory eeprom 80 kb data and program memory crc16 001aal646 fast rng timers 16-bit t0 16-bit t1 ram enhanced public key coprocessor e.g. rsa aes coprocessor triple-des coprocessor uart iso 7816 clock filter security sensors reset generation voltage regulator memory management unit (mmu) clock generation
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 4 of 36 nxp semiconductors P5DF081 mifare sam av2 7. pinning information 7.1 pinning 7.2 pin description 8. functional specification 8.1 hardware interface 8.1.1 contact interface the pad assignment and the electrical characteristics are fully compliant with iso/iec 7816 (part 2 and part 3). the mifare sam av2 operates with class a and class b interface devices. an internal char ge pump provides the eeprom programming voltage. note that pad c6 is not a programmi ng voltage input but is an output line for the clock signal for i2c communication to the rc222 reader chip. pad c8 is used as data line to the reader chip. these two pads for connection to the rc222 are the only ones deviating from the iso standard pin assignment. 8.1.2 external clock frequency and bit rates the basic operation frequency of the mifa re sam av2 is 3.5712 mhz. with this frequency the following standard bit rates can be reached using iso/iec 7816 transmission factors f and d. the mifare sam av2 supports significantly higher transmission speeds. fig 2. pin configuration 001aam116 c1v cc c5 gnd c2 rst_n c6 io3 c3 clk_n c7 io1 c4n.c. c8 io2 table 3. pin description iso/iec 7816/mifare sam av2 iso/iec 7816 mifare sam av2 pad symbol symbol pad description c1 vcc v cc c1 power supply voltage input c2 rst rst_n c2 reset input, active low c3 clk clk_n c3 clock input c4 reserved n.c. c4 n.c. c5 gnd gnd c5 ground (reference voltage) input c6 vpp io3 c6 used for i2c communication to rc222 (sclk) c7 io1 io1 c7 input/output for serial data (host communication) c8 reserved io2 c8 used for i2c communication to rc222 (sdata)
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 5 of 36 nxp semiconductors P5DF081 mifare sam av2 the maximum specified bit rate in any case is 1.5 mbit/s. 8.1.3 card operation procedures all card operation procedures (activation, cold reset, warm reset and deactivation) are fully compliant with ref. 19 , chapter 5. 8.2 transmission procedure and communication 8.2.1 protocol activation sequence all subsequently described operations are compliant with iso/iec 7816-3. 8.2.1.1 answer to reset (atr) the mifare sam av2 offers two modes of operation identified by different atrs. a negotiable mode where the bit rate has to be adjusted via a pps request and a specific mode where the mifare sam av2 switches automatically to f = 128 and d = 32 (highest possible speed) after sending the atr. starting with the negotiable mode, the mode of operation is switched after every warm reset. after a cold reset, the card sends the following atr to the terminal. after this atr, the card is in the negotiabl e mode and waits for a pps request. if a warm reset is issued, the mifare sam av2 switches the mode of operation, enters the specific mode and sends the following atr. table 4. atr after cold reset character value meaning ts 3bh initial character; setting up direct convention t0 dfh ta(1), tc(1), td(1) are present; number of historical characters is 15 ta(1) 18h f = 372; d = 12 tc(1) ffh no extra guard time needed; n = 255 td(1) 81h td(2) is present; protocol t = 1 td(2) f1h ta(3), tb(3), tc(3) and td(3) are present; protocol t=1 ta(3) feh information field size of the card = 254 tb(3) 43h bwt indicator = 4; cwt indicator = 3 tc(3) 00h error detection code = lrc td(3) 3fh ta and tb for t = 15 is present; protocol t = 15 (qualifies global interface bytes) ta(after t = 15) 03h clock stop not supported; class a, class b tb(after t = 15) 83h proprietary use of c6 (io3, reception of serial data from rc222) historical bytes 4dh, 49h, 46h, 41h, 52h, 45h, 20h, 50h, 6ch, 75h, 73h, 20h, 53h, 41h, 4dh ascii value of ?mifare plus sam? tck 3b check character
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 6 of 36 nxp semiconductors P5DF081 mifare sam av2 after every future warm reset, the mode of o peration and therefore also the atr is toggled with the atr after cold reset. 8.2.1.2 protocol and parame ter selection (pps exchange) the pps command allows to individually select the transmissi on factors and the communication protocol. the pps was successful if the resp onse exactly echoes the request. 8.2.2 protocol t = 1 the mifare sam av2 offers a t = 1 prot ocol which is fully compliant with iso/iec 7816-3, chapter 9 . for details on how to calculate the resulting time-outs, refer to iso/iec 7816-3, chapter 9.5 . 8.2.3 apdu structure all instructions sent to the mifare sam av 2 have to be coded into an apdu structure according to iso/iec 7816-4 and inserted into the information field of one or more i-blocks. the commands do not belong to the inter-indu stry class. the coding of the command and response pairs is proprietary, only the structure is compliant with iso/iec 7816-4. table 5. atr after warm reset character value meaning ts 3bh initial character; setting up direct convention t0 dfh ta(1), tc(1) and td(1) are present; number of historical characters is 15 ta(1) 18h f = 128 and d = 32 tc(1) ffh no extra guard time needed; n = 255 td(1) 81h ta(2) and td(2) are present; protocol t = 1 ta(2) f1h specific mode byte: capable of changing the mode of operation; parameters def ined by interface bytes; protocol t = 1 td(2) feh ta(3), tb(3), tc(3), td(3) are present; protocol t=1 ta(3) 43h information field size of the card = 254 tb(3) 00h bwt indicator = 4; cwt indicator = 3 tc(3) 3fh error detection code = lrc td(3) 07h ta and tb for t = 15 is present, protocol t = 15 (qualifies global interface bytes) ta(after t = 15) 83h clock stop not supported, class a and class b tb(after t = 15) 18h proprietary use of c6 (io3, reception of serial data from rc222) historical bytes 4dh, 49h, 46h, 41h, 52h, 45h, 20h, 50h, 6ch, 75h, 73h, 20h, 53h, 41h, 4dh ascii value of ?mifare plus sam? tck 98h check character
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 7 of 36 nxp semiconductors P5DF081 mifare sam av2 8.2.4 uid/serial number the mifare sam av2 ic features a 7 byte uniq ue serial number that is programmed into a locked part of the non-volatile memory that is reserved for the manufacturer. this uid is fixed and cannot be changed. 8.3 mifare sam av1 compatibility mode vs. mifare sam av2 mode unless stated explicitly otherwise, all info rmation in this document refer to both the mifare sam av1 compatibility mode and to the pure mifare sam av2 mode. commands only available in pure mifare sam av2 mode are flagged as "av2 only". differences for commands different in sam av2 with respect to their corresponding sam av1 compatibility version are listed explicitly as well. the main differences between the av1 comp atibility mode and th e av2 mode are the following: ? pki commands are only available in av2 mode ? av2 mode introduces key classes: host keys, picc keys, offlinechange keys and offlinecrypto keys. all symmetric key ent ries are classified into one of them, restricting the possible usage of the key entry. ? av2 mode improves the sam access protec tion by replacing the av1 compatibility host authentication protocols with more secure variants. ? av2 mode improves the sam-host commun ication protection by replacing the av1 compatibility increased security mode (based on cm acing) by three modes of secure messaging after a host authentication (plain, mac protection and full protection). ? av2 mode replaces and adds some key entry configuration options, offering more flexibility in securing the sam (e.g. rega rding key dumping).
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 8 of 36 nxp semiconductors P5DF081 mifare sam av2 8.4 cryptography and key handling 8.4.1 cryptography av1 compatibility mode supports symmetric key cryptographi c algorithms while mifare sam av2 mode supports both symmetric and asymmetric cryptography. 8.4.1.1 symmetric key cryptography mifare sam av2 offers support in seve ral commands for various symmetric key cryptographic algorithms. des and tdea des keys (56 bit) and 2tdea keys (112 bit) are stored in 16 byte strings. 3tdea keys (168 bits) are stored in 24 byte strings. des keys (56 bit) are stored in the same format as the 2tdea keys: the des key is stored twice to form a 2 key tdea key where the 2 keys are identical. aes aes keys are stored in strings of 16 bytes or 24 bytes depending on whether it is an aes 128-bit key or an aes 192-bit key. aes always operates on 16 bytes. therefore data streams are always padded to a length of multiples of 16 bytes. for details of the aes stand ard please refer to public ly available standard ( ref. 31 ). aes macing mifare sam av2 supports sta ndard cmac [ref. 15] for aes. padding is do ne according to the standard. by default, the cmac is truncated to 8 bytes, except if requested explicitly otherwise by the user (sam_generate_mac and sam_verify_mac commands). an alternate mac truncation scheme is used for mifare plus commands for the av2 mode sam-host communication protection and possible via sam_generate_mac and sam_verify_mac commands. mifare classic mifare sam av2 supports mifare classic cr ypto-1 authentication and encryption. 8.4.1.2 asymmetric key cryptography (mifare sam av2 mode only) mifare sam av2 supports rsa encryption, decryption, signature generation and signature verification according to ref. 16 . these algorithms are available in av2 mode via the pki commands. rsa encryption and decryption: the pki functionalities of the mifare sam av2 support rsa decryption. it is used by the pki_updatekeyentries command. the supported algorithm is rsaes-oaep ref. 16 the oaep padding requires a hashing function and a mask generation function (mgf). for the mgf, the sam supports sha-1, sha-224 and sha-256 for hashing (see ref. 9 for the various sha variants); the mgf used is the one specified by ( ref. 17 b.2.1).
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 9 of 36 nxp semiconductors P5DF081 mifare sam av2 rsa signature generation and verification: the pki functionalities of mifare sam av2 support rsa signature handling. it is used by the pki_generatesignature, pki_verifysignatures and pki_updatekeyentrie s commands. the supported algorithm is rsassa-pss (see ref. 16 ). the pki_generatesignature and pki_verifysignatures commands expect the already hashed messa ge mhash as input. the initial hash operation (step 1 and 2 of em sa-pss-encode and emsa-pss-verify, ref. 16 ) is not calculated by this function. hashing algorithms (mifare sam av2 only): mifare sam av2 supports sha-1, sha-224 and sha-256 for hashing according to ref. 17 . these hashing algorithms are available in av2 mode via the pki_generatehash command. 8.4.2 key diversification mifare sam av2 provides several key divers ification methods. in both av1 compatibility mode and in mifare sam av2 mode, the mifare sam av1 key diversification methods and new mifare sam av2 key diversificatio n methods are available; however for av2 only commands (i.e. mfp commands and th e ulc_authenticatepicc) only the new mifare sam av2 diversificat ion methods are available. 8.4.3 key storage (mifare sam av1 compatibility mode) mifare sam av2 in av1 compatibility mode can only store symmetric keys. mifare sam av2 can store up to 128 symmetric keys in up to 3 versions (only 2 versions possible for 3tdea ke ys and aes-192 keys). 8.4.3.1 symmetric keys the mifare sam av2 uses a key storage table (kst) in order to store and manage keys and attributes related to keys. the kst holds 128 entries. every entry cont ains positions to store three des, three 2tdea, two 3tdea, three aes128, two aes192 or six mifare keys plus their attributes. every key entry is referred to by its index, the keyno. key reference number: keyno is the index of the entry in the kst and can have the value 00h to 7fh. key reference number of change entry key: the 1-byte field holds the keyno that is necessary for authentication to run a sam_changekeyentry command. the value feh disables the need for authentication for key load. the value ffh irreversibly locks the entire key entry. key version of change entry key: the 1-byte field holds the key version within the key entry specified for the change entry key. the key version has to be in the range of 00h to ffh. reference number of key usage counter: the 1-byte field holds the reference number of the key usage counter entry which is auto matically incremented each time this key entry is used for authentication, see section 8.4.6 .
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 10 of 36 nxp semiconductors P5DF081 mifare sam av2 8.4.4 key storage (mifare sam av2 mode) mifare sam av2 in mifare sam av2 mode can store both symmetric and asymmetric keys. 8.4.4.1 symmetric keys mifare sam av2 can store up to 128 symmetric keys in up to 3 versions (only 2 versions possible for 3tdea keys and aes- 192 keys) there only differen ce in the content of a key entry compared to av1 compat ibility mode is the addition of an extset byte with extended configuration settings, as can be seen in table 14. storage and configuration options: next to the addition of the extset byte, part of the set configuration settings got redefined when comparing av2 mode to the av1 compatibility mode. four classes of keys are distinguished which re strict the possible usage of a key entry to part of the sam functionality: 1. host keys: used for protecting the sam-host communication (see section 8.5 ) these keys are restricted to the aes key types. 2. picc keys: used for the card communication ; depending on the key type they can be used for authenticating and communicating with a mifare plus, desfire, mifare classic and/or mifare ultralight c card 3. offlinechange keys: used for some key management commands, to allow offline preparation of the cryptograms for these commands (compared to when the key management is done with host keys) these keys are restricted to the aes key types. 4. offlinecrypto keys: used for offline crypto operations: e.g. for communication with the backend or for writing encrypted data on a mifare plus slim or mifare ultralight (c) card. note that the key classes are mutual exclusiv e: one key cannot belong to more than 1 of these classes. kst reset when activating mifare sam av2 mode: from mifare sam av2 mode on, the keys stored in the kst are ident ified as host, picc, offlinechange or offlinecrypto keys. for this reason the kst is reset when activating mifare sam av2 mode, as it is not clear how to assign the existing keys to one of the classes automatically. 8.4.4.2 asymmetric keys mifare sam av2 can store 2 rsa public key pairs and one rsa public key.mifare sam av2 supports rsa keys with a modulus with a size from 256 bit (i.e. 32 bytes) up to 2048 bit (i.e. 256 bytes). pki key storage table: mifare sam av2 uses a pki key storage table (pki_kst) in order to store and manage rsa asymmetric ke y pairs (i.e. private and public keys) and the attributes related to keys. the pki_kst holds 3 entries.
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 11 of 36 nxp semiconductors P5DF081 mifare sam av2 8.4.5 key versioning the mifare sam av2 reserves three bytes in a key entry to store the version of the three available keys in the entry. this version byte contains the key version for all kinds of keys (des, tdea, aes and mifare). the version in formation must be included separately in every key entry of type aes or mifare wh en it is updated by the changekeyentry command. 8.4.6 key usage counters in order to count and limit the number of authentications a key entry can be used for, mifare sam av2 stores a table of 16 key usag e counter entries, 00h to 0fh, which are automatically incremented each time a defined key entry is used for authentication. multiple key entries ca n use the same counter. 8.4.6.1 reference number the property refnokuc codes the reference number of the key usage counter. refnokuc is the index of the entry in the table and can have the value 00h to 0fh, therefore 16 key usage counters can be stored. 8.4.6.2 limit this field stores the current limit for this key usage counter. it is only possible to use a key that is linked to this counter for authenticatio n if the current value (s ee below) is smaller than the current limit. as soon as the current value is equal to, or higher than, the current limit, the usage of all key entries linked to this counter is prohibited. 8.4.6.3 key reference number to change the current kuc entry in order to change the kuc, a successful au thentication by the host application of the mifare sam av2 is necessary. the keynoc kuc defines the reference number of the kst which is used for this. 8.4.6.4 key version to change the current kuc entry the 1-byte field holds the key version within the key entry specified to change the kuc entry. the key version has to be in the range of 00h to ffh. the mifare sam av2 will automatically select the appropr iate key from one of three positions in the entry that has the specified version number. 8.4.6.5 current value the curval field stores the current value of this key usage counter. it is possible to use all keys referring to this counter for authentication only if the current valu e is smaller than the current limit. 8.5 sam - host communication 8.5.1 general principles for sam-host protection mifare sam av2 supports two different mo des: av1 compatibility mode and mifare sam av2 mode. a mifare sam av2 is initia lly in mifare sam av1 compatibility mode. it can be switched to the mifare sam av2 by executing a host authentication with the sam master key using the sam_lockunloc k command. note that mifare sam av2 mode activation is thus only possible if the sam master ke y is configured as an aes128
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 12 of 36 nxp semiconductors P5DF081 mifare sam av2 or aes192 key. during this activation authentication, the maximal message size under command chaining (maxchainblocks) is set. once switched to mifare sam av2 mode there is no mean to switch back. when the mifare sam av2 mode is activated, the key storage table (except the sam master key) gets reset. 8.5.2 mifare sam av1 compatibility mode sam-host protection in av1 compatibility mode, sam access and sam-host communica tion is protected by the increased security mode exactly like fo r the mifare sam av1. the protection mechanism is explained in the following subsection. 8.5.2.1 increased security - cmac calculation the mifare sam av2 offers the possibility to send each command on a higher security level by applying a cmac. if activated, the mifare sam av2 requires a logical channel with an active host authentication to be defi ned for cmac calculation to accept any command. the cmac is calculated and padded according to the nist special publication 800-38b, which gives a recommendation for block cipher modes of operation. the following commands of the mifare sam av2 do not apply the explained cmac mechanism: ? sam_authenticatehost ? sam_getchallenge, sam_internalauthent icate and sam_externalauthenticate commands already protected by encryption ap ply the explained cmac mechanism only for the direction which is not protected: ? sam_changekeyentry fo r the command apdu ? sam_changekucentry for the command apdu ? sam_dumpsessionkey for the response apdu ? sam_changekeymifare for the response apdu 8.5.3 mifare sam av2 mode sam-host protection two kinds of host authentication can be dist inguished. the first is used for locking and unlocking the sam. the second kind is used to get the access rights to execute certain commands. it only affects the sam status for the lc it is exec uted over and can be used to set up a sac over this lc if preferred by the host. once authenticated, three different protection modes on the lc are foreseen: plain, mac protection and full protection (i.e. by macs and encryption). this host authen tication is executed by using the sam_authenticatehost command. note that whether and when host authentications (be it for unlocking or for gaining access rights) are required depends on the sam configuration and is explained in ref. 1 .
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 13 of 36 nxp semiconductors P5DF081 mifare sam av2 8.6 mifare sam av2 command set for better readability of the following command descriptio ns, the logical channel number of the cla byte is set to default 00b. 8.6.1 sam security and configuration commands table 6. sam security and configuration commands command description sam_disablecrypto this command allows t he permanent and irreversible disabli ng of the cryptographic functionality of the mifare sam av2. successful host authentication with one of the th ree keys stored in keyno 00h is required to send this command. sam_lockunlock the command sam_lockunlock (ins = 10h) is used to run a mutual authentication between the sam and host system. the host authentication consists of three parts. such an authentication proves that both th e sam and the host contain the same secret, namely the aes key kx. the terminology, notations and state descriptions for sam_lockunlock are provided in ref. 1 . sam_authenticatehost av1 compatibility mode : the command sam_authenticatehost is used to run a mutual 3-pass authentication between the mifare sam av2 and host system. such an authentication proves t hat both the mifare sam av2 and the host contain the same secret, namely a des, tdea or aes key and gener ates a session key for further cryptographic operations. a host authentication is required to: ? load or update keys into the mifare sam av2 ? modify key usage counter limits ? activate the mifare sam av2 after reset (if configured accordingly in the configuration settings (set) of keyno 00h) sam_activateofflinekey sam_activateofflinekey is to be used in av2 mode to activate both offlinecrypto and offlinechange keys. sam_loadinitvector the command sam_loadinitvector is used to load an init vector for the next cryptographic operation into the mifare sam av2. the loaded init vector will be applied in the nex t cryptographic operation independent from the ?keep iv? setting of the key entry except for the authentication commands w here the init vector is reset to zero. sam_killauthentication av1 compatibility mode: invalidates any kind of authentication in the logical channel the command is issued. sam_selectapplication the command sam_selectapplication is the equivalent of the sele ctapplication command of desfire. the mifare sam av2 generates a list of available keys linked to the specified application id as defined in the key entry property ?df_aid?. the mifare sam av2 generates a list of available keys per desfire aid and desfire key number. for every key number, up to 6 key versions can be stored in the list (so it can read the keys from maximum two key entrie s per desfire aid and desfire key number). this list is filled starting with key entry zero. if the kst contains more than 6 key versions per desfire aid and desfire key number, only the first 6 versions will be listed.
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 14 of 36 nxp semiconductors P5DF081 mifare sam av2 sam_isogetchallenge/ sam_getrandom av1 compatibility mode in av1 compatibility mode, this is the first pa rt of an iso compliant authentication sequence returning a random number. the command can obviously also be used for simply generating a random number but it has to be taken into account that the mifare sam av2 internally is set into a state indicating that an authent ication procedure is ongoing, if the requested random number length is 8 byte or 16 byte. consequently, the command called after getting the random number will be aborted (except sam_isoexternalauthenticate). after this abortion the mifare sam av2 resets its state and returns to normal operation. for a complete and valid authentication proced ure, the three commands sam_isogetchallenge, sam_isoexternalauthenticat e and sam_isointernalauthenticate have to be called in sequence without interrupting the seque nce by another command. av2 mode in av2 mode, this command is only available to get random numbers. in this case, there are no special constraints on the expected length for the challenge. sam_isoexternalauthen ticate this command is part of an iso compliant authentication procedure consisting of sam_isogetchallenge, sam_isoex ternalauthenticate and sam_isoin ternalauthenticate. it can be used by a host for authentic ating the mifare sam av2. note that this command is only available in av1 compatibility mode. such an authentication proves t hat both the mifare sam av2 and the host contain the same secret, namely a des, tdea or aes key, and gene rates a session key for further cryptographic operations. sam_isointernalauthent icate this command is part of an iso compliant authentication procedure consisting of sam_isogetchallenge, sam_isoex ternalauthenticate and sam_isoin ternalauthenticate. it can be used by a host for authentic ating the mifare sam av2. note that this command is only available in av1 compatibility mode. such an authentication proves t hat both the mifare sam av2 and the host contain the same secret, namely a des, tdea or aes key, and gene rates a session key for further cryptographic operations. sam_getversion the sam_getversion co mmand returns manufacturing related data of the mifare sam av2. the sam_getversion command can be used to de tect whether a sam has been switched to the mifare sam av2 mode. sam_sleep will force the mifare sam av2 to put a co nnected rc222 into sleep mode and itself into idle mode to reduce power consumption. the mifare sam av2 will answer the command and afterwards switch to idle mode. the mifare sam av2 will automatically return to normal operation after receiving the first character of the next command. the rc222 will stay in sleep mode until a command is issued which utilizes the reader ic. then the mifare sam av2 automatically carries out the wake-up sequence before starting the requested operation. table 6. sam security and configuration commands ?continued command description
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 15 of 36 nxp semiconductors P5DF081 mifare sam av2 8.6.2 sam key management commands table 7. sam key management commands command description av1 compatibility mode sam_changekeyentry this command upda tes any key entry of the kst. the complete data set of the full key entry must always be sent, and it will be programmed to the non-volatile memory of the mifare sam av 2 as defined in the non-volatile promas. sam_getkeyentry the sam_getkeyentry co mmand allows reading the contents of the key entry specified in the parameter keyno. instead of the full keys on positions a, b and c, only their key version will be returned, each packed in one byte. this command can be issued without valid (host) authentication. sam_changekucentry this command updates any key usag e counter entry stored in the mifare sam av2. always limit, keynockuc and keyvckuc have to be sent; the parameter promas defines which properties are programmed into the mifare sam av2 non-volatile memory. successful host authentication with the key specified in keynockuc of the current kuc entry is required. sam_getkucentry the sam_getk ucentry command allows reading the data of the key usage counter entry specified within the parameter refnokuc. this command can be issued without valid (host) authentication. sam_dumpsessionkey the command sam_dumpsessionkey can be used to retrieve the session key generated by the mifare sam av2. the session key could be retrieved either in plain or encrypted with the session key of any logical channel. a crc is appended before encryption as usual. this feature is necessary if cr yptographic operations like en-/ decipher should be handled by the terminal microcontroller inst ead of the mifare sam av2. as this feature can be seen as a potential security risk if not used in the correct way, it can be en-/disabled using the configuration settings of every key entry. sam_disablekeyentry the sam_disablekeyent ry command disables a key entry. after executing this command, the corresponding disable flag in the key entry is set and the key entry cannot be used anymore for authentication and key change procedures. the key entry can still be read by a sam_getkeyentry command. to reactivate t he entry, a sam_changekeyentry command has to be issued. all fields in the key entry can still be changed by this command even if the entry has been disabled. av2 mode the following rows give an outlook of the changes compared to the av1 compatibility mode. all commands except sam_getkucentry got partially or completely rede fined for the av2 mode. for more information see ref. 1 . sam_changekeyentry and sam_changekucentry in the av1 version, there are two possibilit ies for changing key and kuc entries via the sam_changekeyentry and sam_changekucentry respectively. which possibility is used, depends on whether the "allow crypto with secret ke y" of the change key, i.e. the key referenced by keynocek or keynockuc respectively, was set. if set, this allowed for offline preparation of the key/kuc changing cryptogram. in the new mifare sam av2 mode, these two po ssibilities are still supported, but which possibility is used depends on the key class of t he change key. change keys are either host keys or offlinechange keys. the second class will allow offline command generation. sam_getkeyentry the sam_getkeyentry co mmand allows reading the contents of the key entry specified in the parameter keyno. instead of the full keys on positions a, b and c, only their key version will be returned, each packed in one byte. this command can be issued without valid (host) authentication.
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 16 of 36 nxp semiconductors P5DF081 mifare sam av2 8.6.3 data processing commands sam_dumpsessionkey the command sam_dumpsessionkey can only be used to retrieve the session key of an established authentication with a desfire or mifare plus picc. so an active picc authentication (for these card types) is required. the session key can be retrieved in plain or encrypted, depending on the sam-host protection mode of the logical channel. in plain and mac protec tion mode, the dump is done in plain; in full protection the key is encrypted (as any other response data field). under mac protection, the response data field can optionally be encryp ted if requested via setting bit 0 of p1. this command cannot be used for secret key dumping. sam_dumpsecretkey sam_dumpsecretkey allows dumping any of the picc keys (except mifare classic keys) or offlinecrypto keys. sam_disablekeyentry in av2 mode, two possibilitie s are supported, similar to the sam_changekeyentry command. which possibility is used depends on the key class of the change key. change keys are either host keys or offlinechange keys. the second class will allow offline command generation. table 7. sam key management commands ?continued command description table 8. data processing commands command description av1 compatibility mode sam_verify_mac the sam_verify_mac command verifies th e mac which was sent by the desfire picc or any other system based on t he given maced plain text data and the currently valid cryptographic key. the applied mac algorithm depends on the key typ. the command can also be used for verifying only a part of a mac. the numb er of mac bytes to be verified is defined by parameter p2. sam_generate_mac the sam_generate_mac command creates a mac which is m eant to be sent to the desfire picc or any other system based on the given plain text data and the currently valid cryptographic key. the applied mac algorithm depends on the key type. sam_decipher_data the sam_decipher_data command deciphers data packages sent by a desfire picc, any other system or a mifare card based on the currently valid cryptographic key and returns plain data to the pcd. sam_encipher_data the sam_encipher_data command create s data packages which are meant to be sent to a desfire picc or any ot her system based on the given plain text data and the currently valid cryptographic key. to do so, the plain data is en-ciphered in cipher block chaining send mode. crc and padding bytes are appended automatically. av2 mode the mifare sam av1 supported the exec ution of cryptographic operations (macin g, encryption) using the sam data processing commands with a key that allo wed "crypto with secret key". so the sa me primitives as used for the desfire communication are also accessible for so-called offline cryptograph ic operations (i.e. crypto oper ations that are not part of the sam-host or sam-picc communication protocols). for the mifare sam av2 this kind of function ality is still supported. the "crypto with secret key" operation is replaced by a separate key class, called offlinecrypto keys. the existi ng sam data processing commands are extended to support full length mac generation and verification; also new commands for executing standard cbc encryption and decryption are provided. the existing sam data processing commands (sam_gener ate_mac, sam_verify_mac, sam_encipher_data and sam_decipher_data) can still be used to support desfire communication, by issuing them in an lc with an active picc authentication (sam_authenticatep icc). these commands and the new sam_encipheroffline_data and sam_decipheroffline_data can be used with offlinecrypto keys if issued in an lc with an active offlinecrypto key.
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 17 of 36 nxp semiconductors P5DF081 mifare sam av2 sam_verify_mac the sam_verify_mac command verifies th e mac which was sent by the desfire picc or any other system based on the given maced plain te xt data and the currently valid cryptographic key. the valid key has been activated using a vali d picc authentication ( sam_authenticatepicc, sam_isoauthenticate picc) in case of a picc key or using a valid key activation (sam_activateofflinekey) in ca se of an offlinecrypto key. the applied mac algorithm depends on the key type. in case of the aes key types and the (3)des key types 3 and 6, the standard cmac algorithm is applied. sam_generate_mac the sam_generate_mac command creates a mac which is m eant to be sent to the desfire picc or any other system based on the given plain text data and the currently valid cryptographic key. the valid key has been activated using a valid picc authentication (sam_authenticatepicc, sam_isoauthenticate picc) in case of a picc key or using a valid key activation (sam_activateofflinekey) in ca se of an offlinecrypto key. the applied mac algorithm depends on the key type. in case of the aes key types and the (3)des key types 3 and 6, the standard cmac algorithm is applied. sam_decipher_data same operation as in mifare sam av1 compatibility mode performed with either a valid picc authentication (sam_authentic atepicc, sam_isoauthenticatepicc or sam_authenticatemifare) in case of a picc key or a valid key activation (sam_activateofflinekey) in ca se of an offlinecrypto key. sam_encipher_data same operation as in av1 compat ibility mode and sa me description. sam_decipheroffline_ data the new sam_decipheroffline_data command decrypts data received from any other system based on the given cipher text data and the current ly valid cryptographic offlinecrypto key. the valid key has been activated using a valid key activation (sam_activateofflinekey). the applied decryption is the block cipher algorithm depending on the key type in cbc mode. the iv needs to be loaded via the sam_loadinitvecto r command before issuing this command. if no iv was loaded, the zero byte iv is applied. no p adding is removed from the decrypted plain text, so the output length equals the input length. the total input size must be a multiple of the block size of the underlying block cipher (depending on the key type). in case of command chaining, the sam immediately starts returning decrypted data for the received blocks. the new sam_encipheroffline_data command encr ypts data received from any other system based on the given cipher text data and the current ly valid cryptographic offlinecrypto key. the valid key has been activated using a valid key activation (sam_activateofflinekey). the applied decryption is the block cipher algorithm depending on the key type in cbc mode. the iv needs to be loaded via the sam_loadinitvecto r command before issuing this command. if no iv was loaded, the zero byte iv is applied. no padding is added to the plain text, so the output length equals the input length. as a consequence, the total input size must be a mu ltiple of the block size of the underlying block cipher (depending on the key type). in case of command chaining, the sam immediately starts returning encrypted data for the received blocks. table 8. data processing commands ?continued command description
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 18 of 36 nxp semiconductors P5DF081 mifare sam av2 8.6.4 public key infrastructure (pki) commands pki commands are available to generate public key pairs, to import public keys or key pairs, to export public keys or key pairs, to generate and to validate signatures, to compute hashes suitable for signature op erations and to manage the symmetric key storage table. pki commands are only available in av2 mode. table 9. public key infrastructure (pki) commands command description pki_generatekeypair the pki command pki_generatekeypair creates a pair of a public and a private key. mifare sam av2 only supports the crt format. a successful host authentication in the lc using sam_authentica tehost with a host key is required to execute the pki_generatekeypair command. pki_importkey the pki command pki_importkey imports an rsa key. this can be either a public key or a full key pair (including a private key). when a change key (see ref. 1 ) is specified, a successful host authentication in the lc using sam_authenticatehost with a host key is required to execute the pki_importkey command. pki_exportprivatekey the pki command pki _exportprivatekey exports a full rsa key entry (i.e including the private key if present). the key pair is exported in crt format. this command is intended for private key backup after having it created with mifare sam av2. for this reason, this command will only be accept ed if the key entry includes a private key and private key export is allowed by the pki set co nfiguration of the addressed key. the command is part of the restricted command set and requires protection with a host key change key. pki_exportpublickey the pki command pki_exportpublicke y exports the public key part of a rsa key pair. the command is part of the general command set, so its protection depends on the general sam-host communication protection. pki_updatekeyentries the pki_updatekeyentries command ca n be used to change key entries of the symmetric key storage (kst). executing this command does no t require any protection coming from the change key of the key entries (e.g. a host authen tication in case of a host key). instead the command's execution is protected by asymmetric techniques usin g the pki support of the sam. the command is protected by enc rypting the key entries using the rsa encryption. on top a digital signature is added using the rsa signature algorithm. this allows offline preparation of the cryptogram. the same hashing algorithm is to be used for both mgfs and for the digital signature handling (as indicated by the p1 byte). pki_generatehash the pki command pki_gereratehash comput es the hash on a data string. the algorithm to be used to compute the hash is selected through p1. pki_generatesignature the pki command pki_generatesignature generates a signature on a hash given as input using one of the two private keys stored in the pki key storage table. pki_sendsignature the pki command pki_sendsignature returns a pre-computed signature. the returned signature is protected accordin g to the sam-host protection in place on the corresponding logical channel. pki_verifysignature the pki command pki_verifysignature veri fies the correctness of a signature.
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 19 of 36 nxp semiconductors P5DF081 mifare sam av2 8.6.5 mifare plus in non-x-mode commands this section describes the sam commands that can be used to prepare mifare plus commands. the sam maintains the mifare plus state (e.g. the read and write counters). table 10. mifare plus in non-x mode commands command description sam_authenticatemfp sam_authe nticatemfp can be used for all mifare plus authentications (e.g. sl1, sl2, sl3, originality keys, sl2 re-authentication). the choice of whether a first or following authentication is to be performed is indicated in the parameters of the command. also the user has to indicate which session key derivation needs to be used afterwards: no session keys needed (sl1 card authentication, origina lity keys authentication), key derivation to continue with sam_authenticatemifa re (sl2) or session key derivation to continue with normal mifare plus transaction (sl3). sam_authenticatemfp only supports the 2-part version of the mifa re plus authentication. sam_combinedreadmfp sam_combinedreadmfp handles either a mifare plus read command, a mifare plus read response or both. sam_combinedwritemfp sam_combinedwritemfp handles either a mifare plus write command (write, increment, decrement, transfer, restore, incr ement transfer or decrement transfer) or a mifare plus write response. bit 0 of p1 indi cates whether it is a command or a response. sam_changekeymfp sam_changekeymfp computes the command required to replace a mifare plus key with one of the keys stored in the sam. sam_virtualcardsupportmfp sam_virtualcardsupportmfp hand les the mifare plus vcs and vcsl commands. one sam_virtualcardsupport can handle up to 5 command sets. a command set covers a block of vcs commands and one concluding vcsl command. sam_selectvirtualcardmfp sam_selectvirtualcardmfp handles the mifare plus svc command. sam_proximitycheckmfp sam_proximitychec kmfp is performed in two steps. in the first step, given the data collected during the execution of the proximit y check protocol with the mifare plus picc, the sam computes the mac needed for the final proximity check command. in the second step, the sam verifies the mac re ceived from the mifare plus picc.
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 20 of 36 nxp semiconductors P5DF081 mifare sam av2 8.6.6 mifare classic in non-x-mode commands the commands in this section can both be us ed to execute a transaction with a mifare classic card and with a mifare plus card in sl2. in the second case, sam_authenticatemifare is to be used afte r sam_authenticatemfp to complete a mfp sl2 authentication. in both cases, after the authentication, the other sam_xxxmifare commands and the data processing commands sam_decipher_data and sam_encipher_data can be used for further processing. 8.6.7 desfire and ulc in non-x-mode commands table 11. mifare classic in non-x-mode commands command description sam_authenticate mifare n this procedure, both the mifare card as well as the mifare sam av2 device show in an encrypted way that they posses the same se cret which especially means the same key. sam_changekey mifare av1 compatibility mode this command is intended to change a key in a mifa re card. the command offers the possibility to prepare an encrypted stream to be written to a mifare 1k or mifare 4k card containing the desired keys and the given access conditions on the one h and and reading out a single mifare key to be used for any kind of mifare transacti on in a host system directly on th e other hand. in the latter case, the key can be retrieved encrypted from the mifare sam av2 using the current available session key of the channel (host authentication required). the first case requires an active mifare authentication for producing the stream to be sent to th e card.av2 mode (used for key retrieval) in mifare sam av2 mode, the existing command, sam_changekeymifare (used for key retrieval), can still be used to retrieve a picc key of key type 010, i.e. a mifare classic key. the use of this command to change keys on mifa re classic cards is the same as the one described for the av1 compatibility mode. the only difference with av1 is that whether the secret key is retrieved in plain or encrypted depends on the sam-host protecti on mode of the logical channel. table 12. desfire and ulc in non-x-mode commands command description sam_authenticatepicc in this procedure both the picc as well as the mifare sam av2 device show in an encrypted way that they posses the same secret which especially means the same key. this procedure not only confirms that bo th entities are permitted to do operations on each other but also creates a session key which can be used to keep the further communication path secure. as the name ?sessi on key? implicitly indicates, each time a new authentication procedure is successfully completed a new key for further cryptographic operations is obtained. sam_isoauthen ticatepicc the iso authentication procedure is inten ded to authenticate with a card using the standard iso commands getchalle nge, externalauthenticate and internalauthenticate. this authentication proc edure can be used to authenticate a desfire picc but also another mifare sam av2. however, the mifare sam av2 will treat the authentication pr ocedure as a picc authentic ation, which means that commands requiring a host authentication will not be available. sam_changekeypicc this command generates the cryptogram that has to be sent to the picc in order to change any key stored in the picc. both the current and the new key need to be stored in the kst to execute this command. this means a new picc key needs to be loaded into the mifare sam av2, prior to issuing this command.
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 21 of 36 nxp semiconductors P5DF081 mifare sam av2 8.6.8 rc522 configuration commands 8.6.9 iso14443 commands table 13. rc522 configuration commands command description rc_readregister read the content of one or mo re register(s) of the connected reader chip. the command allows reading 255 registers with one co mmand. if a register address is listed more than once in the data field, the content of this register will be re-read every time. rc_writeregister write the content of one or mo re register(s) of the connected reader chip. the command allows writing 1 27 registers with one command. if a register address with its related content is listed more than once in the data field, the content of this register will be re-written every time. rc_rfcontrol this command allows the radio frequency field to be turned off and on. the basic behavior is the reset functionality where the controller turn s off the field for the time given in the data field. if a zero value is passed, the field is tota lly turned off. after turning off the field, to turn it on again, the command can be issued with any value other than zero. take into account that the passed time value also in this ca se will force the mifare sam av2 to wait this additional time until turning on the field again. rc_init establishes the serial connection between mifare sam av2 and rc222 and initializes the reader chip with the register values stored in the selected register value set. rc_loadregister valueset stores a customer defined register value set for the rc222 in the non-volatile memory of the mifare sam av2. this set can then be used fo r initializing the reader chip with the rc_init command. the address of and the related value for the register have to be placed consecutively in the command data field of the apdu. table 14. iso14443 commands command description iso14443-3_request_wakeup issue a request or wake-up command. iso14443-3_anticollision_select perform bit-wise anticollis ion and select. the antico llision and the following select are performed according to the select code in the data field. iso14443-3_activateidle carries out one or several request - anticollision - select sequences and returns the sak and the uid of the select ed card(s). the at qa is returned for every request issued, this means for every newly activated card. due to the fact that the resulting atqa is the or-function of all atqas, the value may change frequently. iso14443-3_activatewakeup the command reactivates and selects a card that has previously been set to halt state. the command takes the uid of the card to reactivate. iso14443-3_halta the command puts a selected card into halt state. iso14443-3_transparentexchange exchange bytes/bits transparently. the mifare sam av2 will take the user data and send it without changing, inserting or appending any content to the contactless card. appending of a crc, time-out settings, etc. have to be configured by directly writing the rc2 22 registers. take into account that switching settings of the reader chip influence all subsequent mifare sam av2 commands proposing the correct reader chip settings, i.e. iso14443- 4_exchange. iso14443-4_rats_pps execute a combined rats and pps sequence to prepare a card for t=cl data exchange. the cid assigned to the card will be assigned to the current logical channel. this means, every further iso14443-4 command issued in this logical channel will be executed using this cid automatically.
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 22 of 36 nxp semiconductors P5DF081 mifare sam av2 8.6.10 mifare classic in x-mode commands the commands in this section can both be us ed to execute a transaction with a mifare classic card and with a mifare plus card in sl2. in the second case, mf_authenticate, mf_authenticatedread or mf_aut henticatedwrite is to be used after mfp_authenticate to complete a mfp sl2 authen tication. afterwards, the other mf_xxx commands can be used for further processing. iso14443-4_init initialize the t = cl protocol. the intent of this command is to configure the protocol for data exchanges. this is necessary if a card was already activated and configured for doing data exchanges without using the iso14443-4_rats _pps command. iso14443-4_exchange exchange bytes according to iso/iec 14443-4 t = cl protocol. iso14443-4_presencecheck check if an activated card is still in the field. iso14443-4_deselect deselect an activated card. the cid is freed by this command. if the deselect fails, the cid will not be freed and cannot be used for activating another card. this behavior might be overridden by sett ing a flag in the p1 byte. cids can also be freed using the iso14443-4_freecid command. iso14443-4_freecid free one, more, or all currently assigned cids. this command might be necessary if severa l deselect commands failed and the cids were not forced to be freed but the card is deactivated or no longer available in the field. table 14. iso14443 commands ?continued command description table 15. mifare classic in x-mode commands command description mf_authenticate performs an authentication with a mifare ca rd. the mifare key has to be stored in the mifare sam av2 and is referenced by a parame ter in the command data field. the key can be diversified if necessary. mf_read read one or several blocks of a mifare card and return the data. if more than one block is read, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data field. the order of the returned data is the same as the order of addresses in the data field. mf_write write one or several blocks of a mifare card. if more than one block is written, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data field. the command supports writing of 16 bytes encrypted for mifare 1k and mifare 4k cards as well as writing 16 bytes or 4 bytes pl ain for mifare ultralight cards. the length can be selected by bit 0 of parameter byte p2. if 16 bytes block write is selected, the mifare sam av2 decides whether encryption shall be used by checking the authentication state. if a mifare authentication has been completed, the data is encrypted. encrypted writing of 4 byte blocks is not supported. mf_valuewrite write one or several value blocks of a mifare ca rd. if more than one block is written, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data field. since a mifare card uses 12 bytes for storing a four-byte value, the address to write in the last four bytes has to be specified by the user (?address? parameter). mf_increment increment one or several value blocks on a mifare card. every in crement is confirmed automatically by sending the transfer command directly afterwards. the user has to define the source address of the value block to be incremented and the destination address of the value block to store the result. if more than one block is incremented, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data field.
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 23 of 36 nxp semiconductors P5DF081 mifare sam av2 mf_decrement decrement one or several value blocks on a mifare card. every decrement is confirmed automatically by sending the transfer command di rectly afterwards. the user has to define the source address of the value block to be decremented and the destination address of the value block to store the result. if more than one block is decremented, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data field. mf_restore copy one or several value blocks on a mifare card. if more than one block is copied, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data field. the order of the status code is the same as the order of addresses in the data field. mf_authenticated read performs an authentication with subsequent reading of blocks on a mifare card. the command allows authenticating and reading several different blocks on the card within one command. several blocks can be read without re -authenticating, but also several blocks with different authentications. for each block addr ess needing a new authentication, the key to authenticate with and whether it s hall be diversified has to be specified. if a key is used for accessing different blocks but a new authenticat ion is necessary, these blocks have to be listed consecutively in the data field and the re-u se to be indicated by a flag. if more than one block is read, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data field. the order of the returned data is the same as the order of addresses in the data field. mf_authenticated write performs an authentication with subsequent writing of blocks on a mifare card. the command allows authenticating and writing several different blocks on the card within one command. several blocks can be written without re -authenticating, but also several blocks with different authentications. for each block address needing a new authentication, the key to authenticate with and w hether it shall be diversified has to be specified. if a key is used for accessing different blocks, these blocks have to be listed consecutively in the data field and the re-use to be indicated by a flag. if more than one block is written, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data field. mf_changekey this command is intended to change a key in a mifare card. the command offers the possibility to prepare and write an encrypted data stream to a mifare 1k or mifare 4k card containing the desired keys and the given access conditions. the first case requires an active mifare authentication for producing the stream to be sent to the card. this command is able to generate a diversified mifare standard key, based on a mifare key stored in the mifare sam av2, a tdea key stored in the mifare sam av2, the uid of the mifare standard picc and the block address on the mifare standard card. the tdea key applied for the diversification is referenced in the mifare key entry. table 15. mifare classic in x-mode commands ?continued command description
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 24 of 36 nxp semiconductors P5DF081 mifare sam av2 8.6.11 mifare plus in x-mode commands this chapter describes the commands for the mifare plus picc?s when the mifare sam av2 is used in mifare sam av2 mode. when a mifare plus communication is established between the sam and a mifare plus picc, the corresponding sam logical channel maintains the state (e.g. the read and write counters) required to manage the se cure messaging with the mifare plus picc. table 16. mifare plus in x-mode commands command description mfp_writeperso mfp_writeperso is a multi-block writ e command. it performs up to 13 mfp writeperso commands. if more than 13 values are to be updated, several mfp_writeperso are to be issued. there is no command chaining for this command. mfp_authenticate mfp_authenticate pe rforms all mifare plus authen tications (e.g. sl1, sl2, sl3, originality keys...). the choice of whether a first or following authentication is to be performed is indicated in the parameters of the command. also the user has to indicate which session key derivation needs to be used afterwards: no session keys needed (sl1 card authentication, originality keys authentication), key derivation to continue with mf_authenticate (sl2) or se ssion key derivation to continue with normal mifare plus transaction (sl3). mfp_combinedread mfp_combinedread performs one mifare plus read command. mfp_combinedwrite mfp_combinedwrite performs a mifa re plus write command where a write command can be a mifare plus write, increment, decrement, transfer, restore, increment transfer or decrement transfer command. each mfp_combinedwrite command is restricted to one mifare plus write command. mfp_changekey mfp_changekey replaces one of the mifare plus picc keys by one of the keys stored in the sam.
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 25 of 36 nxp semiconductors P5DF081 mifare sam av2 mfp_proximitycheck mfp_proximitycheck performs the comp lete mifare plus proximity check between mifare sam av2 and the mifare plus picc. it performs the ppc, the one or more pc?s and the vpc command. as this is the x-mode command , the proximity time measurem ent is handled by a mfrc52x reader ic time-out. the reader ic will use the iso14443-3 minimal frame delay time, as a time-out value for the picc response to the mi fare plus proximity check command(s) sent. in case the proximity check is executed with an mfp authentication, the mac session key of this authentic ation will be used for the mifare plus verify proximity check (vpc). the command also foresees random vpc processing as recommended in some case s for privacy reasons. mfp_virtualcardsupport mfp_virtualcardsupport sends as many mifare plus vcs and vcsl commands to the mifare plus picc as s pecified in the command. mfp_virtualcardsupport accepts up to 5 command sets. mfp_virtualcardsupport returns the mifare plus picc responses to the corresponding vcsl commands. a command set is made of commands. for each command the key duo is specified (i.e. the sam key to be used for mac and the sam key to be used for enc) together with the vciid to be advertised by the sam to the mifare plus picc. given a command set, sizeof(command set)-1 vcs commands are sent wi th one concluding vcsl command. mfp_selectvirtualcard mfp_selectvirt ualcard sends a mifare plus svc command to the mifare plus picc. if no successful entry for this iid can be fou nd (from mfp_virtualcardsupport processing), the sam will still send an svc command (with random mac) to the card. on successful execution (both valid and invalid iid) , the internal vc table is invalidated. note that mifare sam av2 does not support multiple vc selection protocols to be executed in parallel. the user needs to ensure the vc se lection is completed before starting another on any of the lcs, as starting vc select ion with sam_virtualcardsupportmfp or mfp_virtualcardsupport will also invalidate the existing internal vc table (if any). table 16. mifare plus in x-mode commands ?continued command description
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 26 of 36 nxp semiconductors P5DF081 mifare sam av2 8.6.12 desfire and ulc in x-mode commands table 17. desfire and ulc in x-mode commands command description desfire_authenticatepicc in this procedure both the picc as well as the mifare sam av2 device, show in an encrypted way that they posses the sa me secret which especially means the same key. this procedure not only confirms that both entities are permitted to do operations on each other but also creates a session key which can be used to keep the communication path secure. as the name ?session key? implicitly indicates, each time a new authentication procedure is su ccessfully completed a new key for further cryptographic operations is obtained. desfire_changekeypicc this command generates the cryptogram that has to be sent to the picc in order to change any key stored in the picc. both the current and the new key need to be stored in the kst to execute this comma nd. this means a new picc key needs to be loaded into the mifare sam av 2, prior to issuing this command. desfire_writex write data encrypted or maced on a desfire picc. this command shall be used to issue the changekeysettings, writedata, credit, debit, limitedcredit or writerecord command. it takes the data to be sent to the desfire and applies the encryption or macing mechanism starting from an indicated index. the user is responsible for providing the correct command frame including the command code, the parameter bytes and the plain data as specified for the desfire picc. the indication from which position on the crypto mec hanism shall be applied will normally be the first data byte of th e command frame. the mifare sam av2 will automatically adapt the amount of bytes to send to the picc after encryption of data or adding the mac, respectively. desfire_readx read encrypted or maced data from the desfire picc. this command shall be used to issue the readdata, getvalue, or readrecords command. it takes the data to be sent to the desfire and applies the decryption and mac verification mechanism to the received data. afterwards the mifare sam av2 returns the decrypted or verified plain data. the user is responsible for providing the correct command frame including the command code and the parameter bytes as specified for the desfire picc. this command frame will be sent directly to the desfire. this is also the case for commands applying application chaining. ulc_ authenticatepicc the ulc_authenticatepicc command is needed to authenticate to a mifare ultralight c card.
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 27 of 36 nxp semiconductors P5DF081 mifare sam av2 9. limiting values [1] stresses beyond those listed may cause permanent damage to t he device. these are stress ra tings only and functional operatio n of the device at these or any other conditions beyond those indicated under ?recommended operat ing conditions? is not implied. exposur e to absolute-maximum-rated conditions for extende d periods may affect device reliability. [2] mil standard 883-d method 3015; human body model; c = 100 pf, r = 1.5 k ? ; t amb = ? 25 ? c to +85 ? c. [3] depending on appropriate thermal resistance of the package. 10. characteristics table 18. limiting values [1] in accordance with the absolute maximum rating system (iec 60134). voltages are referenced to vss (ground = 0 v). symbol parameter conditions min max unit v dd supply voltage ? 0.5 +6.0 v v i input voltage on any signal pad ? 0.5 v dd +0.5 v i i input current on pads io1, io2 or io3 - ? 15.0 ma i o output current i lu latch-up current v i <0orv i >v dd - ? 100 ma v esd electrostatic discharge volt age on pads vdd, vss, clk, rst, io1, io2, io3 [2] - ? 4.0 kv on pads la, lb [2] - ? 2.0 kv p tot (pack) total power dissipation per package [3] -1 w table 19. recommended operating conditions symbol parameter conditions min typ max unit v dd supply voltage 5 v operation 4.5 5.0 5.5 v 3 v operation 2.7 3.0 3.3 v v i input voltage on digital inputs and digital i/o pads 0 - v dd v t amb ambient temperature ? 25 - +85 ?c table 20. electrical characteri stics of ic supply voltage v dd ; v ss =0v; t amb = ? 25 ? c to +85 ? c symbol parameter conditions min typ max unit v dd supply voltage class a: 5 v range 4.5 5.0 5.5 v class b: 3 v range 2.7 3.0 3.3 v
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 28 of 36 nxp semiconductors P5DF081 mifare sam av2 11. abbreviations table 21. abbreviations acronym description 2tdea 2 key tdea 3tdea 3 key tdea aes advanced encryption standard aid application identifier apdu application protocol data unit appdata application data atqa answer to request (type a) atr answer to reset ats answer to select auth mode authentication mode authent authentication cbc cipher block chaining (a block cipher mode) cid card identifier cla class cmac ciphered-based mac cmdcode command code cmdsettings command settings crc cyclic redundancy check crc16 16 bit crc crc32 32 bit crc crt chinese remainder theorem curval current value of key usage counter cwt character waiting time des data encryption standard df_aid desfire aid df_keyno desfire key number dfkeyno desfire key number div diversification divinp diversification input dri divisor receive integer dsi divisor send integer eeprom electrically erasable pr ogrammable re ad only memory ek(x) encrypted ?x? ekno(x) encrypted number ?x? fifo first in first out fips federal information processing standard fsc frame size for card fsci frame size for card integer fsd frame size for device
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 29 of 36 nxp semiconductors P5DF081 mifare sam av2 fsdi frame size for device integer fwi frame waiting time integer ins instruction code iso international organization for standardization iv initial vector (input parameter to some block cipher modes) keycompmeth key compilation method keyno key reference number keynocek key reference number of change entry key keynockuc key reference number to change the current kuc entry keynom key reference number of mifare key keyv key version keyva key (version a) keyvb key (version b) keyvc key (version c) keyvcek key version of change entry key keyvckuc key version to change the current kuc entry keyvm key version of mifare key kst key storage table (the place where the sam stores the symmetric keys and their configuration) kst key storage table kuc key usage counter lc logical channel (the iso-7816 concept) lfi last frame indicator loadreg number of register value set to be loaded lrc longitudinal redundancy check lsb least significant byte mac message authentication code mad mifare application directory mfp mifare plus mgf mask generation function msb most significant byte numcards number of cards oaep optimal asymmetric encryption padding pcd proximity coupling device picc proximity integrated circuit card pki public key infrastructure pki_kst the asymmetric counterpart of the kst: for storage of the pki keys and their configuration. pps protocol and parameter selection promas programming mask pss probabilistic signature scheme table 21. abbreviations ?continued acronym description
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 30 of 36 nxp semiconductors P5DF081 mifare sam av2 rats request for answer to select refnokuc reference number of key usage counter regaddress register address regcontent register content reqa request command, type a rfu reserved for future use rnda random number a rnda? random number a rotated left over 1 byte rndb random number b rndb? random number b rotated left over 1 byte rsa asymmetric cryptography rsaes-oaep improved encryption/decryption sch eme; based on the optimal asymmetric encryption padding scheme rsa-oaep asymmetric cryptography based on optimal asymmetric encryption padding for key agreement rsassa-pss improved probabilistic signature scheme with appendix; based on the probabilistic signature scheme sac secure authenticated channel sak select acknowledge sam secure application module mifare sam av2 one of the sam use mode sel select code set configuration settings for kst entry sha- 256 secure hash algorithm sha-1 secure hash algorithm sha-224 secure hash algorithm sl3 mifare plus security level 3 sn serial number storereg number of register value set to be stored sw status word tdea triple data encryption algorithm trng true random number generator uid unique identifier va version of key a vb version of key b vc version of key c wupa wake-up command, type a xor exclusive or table 21. abbreviations ?continued acronym description
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 31 of 36 nxp semiconductors P5DF081 mifare sam av2 12. references [1] data sheet ? P5DF081 mifare sam av2 bu-id doc. no. 1645** [2] reader software library ? desfire & desfire sam; programmer's reference manual, bu-id doc. no. 0893** [3] application note ? mifare desfire; implementation hints and example, bu-id doc. no. 0945** [4] iso 14443-3 ? iso/iec14443-3:2008 [5] iso 14443-4 ? iso/iec14443-4:2008 [6] data sheet ? mf1plusx0y1 mainstream contactless smart card ic for fast and easy solution development, bl-id doc. no. 1637** 1 [7] data sheet ? mf1ics50 functional specific ation, bu-id doc. no. 0010** [8] data sheet ? mf1ics20 functional specification, bu-id doc. no. 1322** [9] data sheet ? mf1ics70 functional specification, bu-id doc. no. 0435** [10] data sheet ? mf3icd81 mifare desfire f unctional specification, bu-id doc. no. 1340** [11] data sheet ? mf0icu1 functional specificat ion, bu-id doc. no. 0286** [12] data sheet ? mf0icu2 functional specificat ion, bu-id doc. no. 1376** [13] des ? data encryption standard (des), nist fips pub 46-3, october1999, http://csrc.nist.gov/publicati ons/fips/fips46-3/fips46-3.pdf [14] user manual ? mf3icd81 guidance, delivery and operation manual, bu-id doc no. 1469** [15] wafer specification ? p5cd016/021/041 and p5cx081 family, bu-id doc no. 1561** [16] pkcs1 ? pkcs #1 v2.1: rsa cryptography standard, rsa laboratories, june 2002 [17] sha ? fips 180-2: secure hash standard (shs) ? current version of the secure hash standard (sha-1, sha-224, sha-256, sha-384, and sha-512), 1 august 2002, amended 25 february 2004, fips publication [18] iso7816-2 ? iso/iec 7816-2:2002 [19] iso7816-3 ? iso/iec 7816-3:2002 [20] iso7816-4 ? iso/iec 7816-4:2004 [21] aes ? fips197 [22] iso 10116 ? iso/iec 10116 block cipher [23] cmac ? recommendation for block cipher modes of operation: the cmac mode for authentication, nist special publication 800-38b, may 2005, http://csrc.nist.gov/ publications/nistpubs/8 00-38b/sp_800-38b.pdf 1. ** ... document version number
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 32 of 36 nxp semiconductors P5DF081 mifare sam av2 [24] cmac errata ? recommendation for block cipher modes of operation: the cmac mode for authentication, nist special publication 800-38b, errata, http://csrc.nist.gov/public ations/nistpubs/800-38b/up dated_cmac_examples.pdf [25] bc-methods ? recommendation for block cipher modes of operation - methods and techniques, nist special publication 800-38a, december 2001, http://csrc.nist.gov/ publications/nistpubs/8 00-38a/sp800-38a.pdf [26] nist special publication 800-38a ? recommendation for block cipher modes of operation: methods and techniques, 2001. [27] nist special publication 800-38b ? recommendation for block cipher modes of operation: the cmac mode for authentication [28] iso/iec standard ? iso/iec 14443 identification cards - contactless integrated circuit cards - proximity cards [29] recommendation for block cipher modes of operation: methods and techniques ? fips pub 197 advanced encryption standard [30] iso/iec standard ? iso/iec 9797-1 information technology -- security techniques - message authentication code s (macs) - part 1: mechanisms using a block cipher [31] aes ? recommendation for the triple data encryption algorithm (tdea) block cipher, nist special publication 800-67, may 2008, http://csrc.nist.gov/ publications/nistpubs/ 800-67/sp800-67.pdf 13. revision history table 22: revision history document id release date data sheet status change notice supersedes P5DF081_sds v.1.0 20100812 objective short data sheet - -
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 33 of 36 nxp semiconductors P5DF081 mifare sam av2 14. legal information 14.1 data sheet status [1] please consult the most recently issued document before initiating or completing a design. [2] the term ?short data sheet? is explained in section ?definitions?. [3] the product status of device(s) described in this document may have changed since this document was published and may differ in case of multiple device s. the latest product status information is available on the internet at url http://www.nxp.com . 14.2 definitions draft ? the document is a draft versi on only. the content is still under internal review and subject to formal approval, which may result in modifications or additions. nxp semiconductors does not give any representations or warranties as to the accuracy or completeness of information included herein and shall hav e no liability for the consequences of use of such information. short data sheet ? a short data sheet is an extract from a full data sheet with the same product type number(s) and title. a short data sheet is intended for quick reference only and should not be relied upon to contain detailed and full information. for detailed and full information see the relevant full data sheet, which is available on request vi a the local nxp semiconductors sales office. in case of any inconsistency or conflict with the short data sheet, the full data sheet shall prevail. product specification ? the information and data provided in a product data sheet shall define the specification of the product as agreed between nxp semiconductors and its customer , unless nxp semiconductors and customer have explicitly agreed otherwis e in writing. in no event however, shall an agreement be valid in which the nxp semiconductors product is deemed to offer functions and qualities beyond those described in the product data sheet. 14.3 disclaimers limited warranty and liability ? information in this document is believed to be accurate and reliable. however, nxp semiconductors does not give any representations or warranties, expressed or implied, as to the accuracy or completeness of such information and shall have no liability for the consequences of use of such information. in no event shall nxp semiconductors be liable for any indirect, incidental, punitive, special or consequential damages (including - without limitation - lost profits, lost savings, business interruption, costs related to the removal or replacement of any products or rework charges) whether or not such damages are based on tort (including negligence), warranty, breach of contract or any other legal theory. notwithstanding any damages that customer might incur for any reason whatsoever, nxp semiconductors? aggregate and cumulative liability towards customer for the products described herein shall be limited in accordance with the terms and conditions of commercial sale of nxp semiconductors. right to make changes ? nxp semiconductors reserves the right to make changes to information published in this document, including without limitation specifications and product descriptions, at any time and without notice. this document supersedes and replaces all information supplied prior to the publication hereof. suitability for use ? nxp semiconductors products are not designed, authorized or warranted to be suitable for use in life support, life-critical or safety-critical systems or equipment, nor in applications where failure or malfunction of an nxp semiconductors product can reasonably be expected to result in personal injury, death or severe property or environmental damage. nxp semiconductors accepts no liability for inclusion and/or use of nxp semiconductors products in such equipment or applications and therefore such inclusion and/or use is at the customer?s own risk. applications ? applications that are described herein for any of these products are for illustrative purpos es only. nxp semiconductors makes no representation or warranty that such applications will be suitable for the specified use without further testing or modification. customers are responsible for the design and operation of their applications and products using nxp semiconductors products, and nxp semiconductors accepts no liability for any assistance with applications or customer product design. it is customer?s sole responsibility to determine whether the nxp semiconductors product is suitable and fit for the customer?s applications and products planned, as well as fo r the planned application and use of customer?s third party customer(s). customers should provide appropriate design and operating safeguards to minimize the risks associated with their applications and products. nxp semiconductors does not accept any liability related to any default, damage, costs or problem which is based on any weakness or default in the customer?s applications or products, or the application or use by customer?s third party customer(s). customer is responsible for doing all necessary testing for the customer?s applic ations and products using nxp semiconductors products in order to av oid a default of the applications and the products or of the application or use by customer?s third party customer(s). nxp does not accept any liability in this respect. limiting values ? stress above one or more limiting values (as defined in the absolute maximum ratings system of iec 60134) will cause permanent damage to the device. limiting values are stress ratings only and (proper) operation of the device at these or any other conditions above those given in the recommended operating conditions section (if present) or the characteristics sections of this document is not warranted. constant or repeated exposure to limiting values will permanently and irreversibly affect the quality and reliability of the device. terms and conditions of commercial sale ? nxp semiconductors products are sold subject to the gener al terms and conditions of commercial sale, as published at http://www.nxp.com/profile/terms , unless otherwise agreed in a valid written individual agreement. in case an individual agreement is concluded only the terms and conditions of the respective agreement shall apply. nxp semiconductors hereby expressly objects to applying the customer?s general terms and conditions with regard to the purchase of nxp semiconducto rs products by customer. no offer to sell or license ? nothing in this document may be interpreted or construed as an offer to sell products t hat is open for acceptance or the grant, conveyance or implication of any lic ense under any copyrights, patents or other industrial or intellectual property rights. export control ? this document as well as the item(s) described herein may be subject to export control regulations. export might require a prior authorization from national authorities. document status [1] [2] product status [3] definition objective [short] data sheet development this document contains data from the objecti ve specification for product development. preliminary [short] data sheet qualification this document contains data from the preliminary specification. product [short] data sheet production this document contains the product specification.
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 34 of 36 nxp semiconductors P5DF081 mifare sam av2 quick reference data ? the quick reference data is an extract of the product data given in the limiting values and characteristics sections of this document, and as such is not comple te, exhaustive or legally binding. non-automotive qualified products ? unless this data sheet expressly states that this specific nxp semicon ductors product is automotive qualified, the product is not suitable for automotive use. it is neither qualified nor tested in accordance with automotive testing or application requirements. nxp semiconductors accepts no liabili ty for inclusion and/or use of non-automotive qualified products in automotive equipment or applications. in the event that customer uses t he product for design-in and use in automotive applications to automotive specifications and standards, customer (a) shall use the product without nxp semiconductors? warranty of the product for such automotive applicat ions, use and specifications, and (b) whenever customer uses the product for automotive applications beyond nxp semiconductors? specifications such use shall be solely at customer?s own risk, and (c) customer fully indemnifies nxp semiconductors for any liability, damages or failed product claims resulting from customer design and use of the product for automotive app lications beyond nxp semiconductors? standard warranty and nxp semiconduct ors? product specifications. 14.4 trademarks notice: all referenced brands, produc t names, service names and trademarks are the property of their respective owners. mifare ? is a trademark of nxp b.v. mifare plus ? is a trademark of nxp b.v. mifare ultralight ? is a trademark of nxp b.v. desfire ? is a trademark of nxp b.v. 15. contact information for more information, please visit: http://www.nxp.com for sales office addresses, please send an email to: salesaddresses@nxp.com
P5DF081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2010. all rights reserved. objective short data sheet public rev. 1 ? 12 august 2010 191710 35 of 36 nxp semiconductors P5DF081 mifare sam av2 16. tables table 1. quick reference data . . . . . . . . . . . . . . . . . . . . .2 table 2. ordering information . . . . . . . . . . . . . . . . . . . . .2 table 3. pin description iso/iec 7816/mifare sam av2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4 table 4. atr after cold reset . . . . . . . . . . . . . . . . . . . . . .5 table 5. atr after warm reset . . . . . . . . . . . . . . . . . . . . .6 table 6. sam security and configuration commands . .13 table 7. sam key management commands . . . . . . . . .15 table 8. data processing commands . . . . . . . . . . . . . .16 table 9. public key infrastructure (pki) commands. . . .18 table 10. mifare plus in non-x mode commands . . . . .19 table 11. mifare classic in non-x-mode commands. . .20 table 12. desfire and ulc in non-x-mode commands . 20 table 13. rc522 configuration commands . . . . . . . . . . . 21 table 14. iso14443 commands . . . . . . . . . . . . . . . . . . . 21 table 15. mifare classic in x-mode commands . . . . . 22 table 16. mifare plus in x-mode commands . . . . . . . . 24 table 17. desfire and ulc in x-mode commands . . . . 26 table 18. limiting values . . . . . . . . . . . . . . . . . . . . . . . . 27 table 19. recommended operating conditions . . . . . . . 27 table 20. electrical characteristics of ic supply voltage . 27 table 21. abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . 30 table 22: revision history . . . . . . . . . . . . . . . . . . . . . . . . 34 17. figures fig 1. block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . .3 fig 2. pin configuration . . . . . . . . . . . . . . . . . . . . . . . . . .4
nxp semiconductors P5DF081 mifare sam av2 ? nxp b.v. 2010. all rights reserved. for more information, please visit: http://www.nxp.com for sales office addresses, please se nd an email to: salesaddresses@nxp.com date of release: 12 august 2010 191710 please be aware that important notices concerning this document and the product(s) described herein, have been included in section ?legal information?. 18. contents 1 general description . . . . . . . . . . . . . . . . . . . . . . 1 2 features and benefits . . . . . . . . . . . . . . . . . . . . 1 2.1 cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2.2 communication. . . . . . . . . . . . . . . . . . . . . . . . . 1 2.3 delivery types . . . . . . . . . . . . . . . . . . . . . . . . . . 2 3 applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 4 quick reference data . . . . . . . . . . . . . . . . . . . . . 2 5 ordering information . . . . . . . . . . . . . . . . . . . . . 2 6 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 3 7 pinning information . . . . . . . . . . . . . . . . . . . . . . 4 7.1 pinning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 7.2 pin description . . . . . . . . . . . . . . . . . . . . . . . . . 4 8 functional specification . . . . . . . . . . . . . . . . . . 4 8.1 hardware interface . . . . . . . . . . . . . . . . . . . . . . 4 8.1.1 contact interface. . . . . . . . . . . . . . . . . . . . . . . . 4 8.1.2 external clock frequency and bit rates . . . . . . . 4 8.1.3 card operation procedures . . . . . . . . . . . . . . . . 5 8.2 transmission procedure and communication . . 5 8.2.1 protocol activation sequence . . . . . . . . . . . . . . 5 8.2.1.1 answer to reset (atr) . . . . . . . . . . . . . . . . . . 5 8.2.1.2 protocol and parameter selection (pps exchange) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 8.2.2 protocol t = 1 . . . . . . . . . . . . . . . . . . . . . . . . . . 6 8.2.3 apdu structure. . . . . . . . . . . . . . . . . . . . . . . . . 6 8.2.4 uid/serial number. . . . . . . . . . . . . . . . . . . . . . . 7 8.3 mifare sam av1 compatibility mode vs. mifare sam av2 mode . . . . . . . . . . . . . . . . . 7 8.4 cryptography and key handling . . . . . . . . . . . . 8 8.4.1 cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . 8 8.4.1.1 symmetric key cryptography . . . . . . . . . . . . . . 8 des and tdea. . . . . . . . . . . . . . . . . . . . . . . . . .8 aes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8 aes macing. . . . . . . . . . . . . . . . . . . . . . . . . . . .8 mifare classic . . . . . . . . . . . . . . . . . . . . . . . . .8 8.4.1.2 asymmetric key cryptography (mifare sam av2 mode only) . . . . . . . . . . . . 8 8.4.2 key diversification. . . . . . . . . . . . . . . . . . . . . . . 9 8.4.3 key storage (mifare sam av1 compatibility mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 8.4.3.1 symmetric keys . . . . . . . . . . . . . . . . . . . . . . . . 9 8.4.4 key storage (mifare sam av2 mode) . . . . . 10 8.4.4.1 symmetric keys . . . . . . . . . . . . . . . . . . . . . . . 10 8.4.4.2 asymmetric keys . . . . . . . . . . . . . . . . . . . . . . 10 8.4.5 key versioning . . . . . . . . . . . . . . . . . . . . . . . . 11 8.4.6 key usage counters . . . . . . . . . . . . . . . . . . . . 11 8.4.6.1 reference number . . . . . . . . . . . . . . . . . . . . . 11 8.4.6.2 limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 8.4.6.3 key reference number to change the current kuc entry . . . . . . . . . . . . . . . . . . . 11 8.4.6.4 key version to change the current kuc entry . 11 8.4.6.5 current value . . . . . . . . . . . . . . . . . . . . . . . . . . 11 8.5 sam - host communication . . . . . . . . . . . . . . . 11 8.5.1 general principles for sam-host protection. . . 11 8.5.2 mifare sam av1 compatibility mode sam-host protection . . . . . . . . . . . . . . . . . . . 12 8.5.2.1 increased security - cmac calculation . . . . . 12 8.5.3 mifare sam av2 mode sam-host protection . . . . . . . . . . . . . . . . . . . 12 8.6 mifare sam av2 command set. . . . . . . . . . 13 8.6.1 sam security and configuration commands. . 13 8.6.2 sam key management commands . . . . . . . . 15 8.6.3 data processing commands . . . . . . . . . . . . . 16 8.6.4 public key infrastructure (pki) commands . . 18 8.6.5 mifare plus in non-x-mode commands . . . 19 8.6.6 mifare classic in non-x-mode commands . 20 8.6.7 desfire and ulc in non-x-mode commands 20 8.6.8 rc522 configuration commands . . . . . . . . . . 21 8.6.9 iso14443 commands . . . . . . . . . . . . . . . . . . 21 8.6.10 mifare classic in x-mode commands . . . . . 22 8.6.11 mifare plus in x-mode commands . . . . . . . 24 8.6.12 desfire and ulc in x-mode commands . . . 26 9 limiting values . . . . . . . . . . . . . . . . . . . . . . . . 27 10 characteristics . . . . . . . . . . . . . . . . . . . . . . . . 27 11 abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . 28 12 references. . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 13 revision history . . . . . . . . . . . . . . . . . . . . . . . 32 14 legal information . . . . . . . . . . . . . . . . . . . . . . 33 14.1 data sheet status . . . . . . . . . . . . . . . . . . . . . . 33 14.2 definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 14.3 disclaimers . . . . . . . . . . . . . . . . . . . . . . . . . . 33 14.4 trademarks . . . . . . . . . . . . . . . . . . . . . . . . . . 34 15 contact information . . . . . . . . . . . . . . . . . . . . 34 16 tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 17 figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 18 contents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

▲Up To Search▲

Price & Availability of P5DF081

	To Download P5DF081 Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .