View P5DF081HN_8360137.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

1. general description the nxp mifare sam av2 hardware solution is the ideal add-on for reader devices offering additional security services. supporting tdea, aes and rsa capabilities, it offers secure storage and secure communication in a variety of infrastructures. unlike other products in the field, mifare sam av2 has proven intero perability with all of nxp's broad card portfolio, (mifare ultralig ht, mifare ultralight c, mifare 1k, mifare 4k, mifare plus, mifare desf ire, mifare desfire ev1 and smartmx solutions), making it the most versatile a nd secure sam solution on the market today. secured communication when used in combination with a reader ic supporting innovative "x" features, mifare sam av2 provides a significant boost in performance to the reader along with faster communication between reader and module. the "x" feature is a new way to use the sam in a system, with sam connected to the microcontroller and the reader ic simultaneously. the one variant, identified with t1ad2060, can be connected to rc52x contactless reader ics, the other variant, identified t1ar1070, can be connected to rc663 using the x-feature. apart from the difference in the interface, both variants have the same functionality. the connection between the sam and the reade r is performed using security protocols based on either sy mmetric cryptogr aphy (tdea and aes) or pki rsa asymmetric cryptography. the protocols comply with the state-of-art standards and thereby ensure data confidentiality and integrity. 2. features and benefits 2.1 cryptography ? supports mifare crypto1, tdea (tripl e des encryption algorithm), rsa and aes cryptography ? supports mifare ultraligh t, mifare ultralight c, mifare 1k, mifare 4k, mifare plus, mifare desfire, mifare desfire ev1 ? secure storage and updating of keys (key usage counters) ? 128 key entries for symmetric cryptography and 3 rsa key entries for asymmetric cryptography ? tdea and aes based ke y diversification ? offline cryptography p5df081 mifare secure ac cess module sam av2 rev. 3.2 ? 17 december 2013 191732 product short data sheet company public
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 2 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 2.2 communication ? up to four logical channels; simultaneous multiple card support ? support for desfire and mifare plus authentication (with related secure messaging and session key generation) ? secure host to sam an d back end to sam communication with symmetric cryptography 3 pass authentication for confidentiality and integrity ? support high speed baud rates up to 1.5 mbit/s ? secure host to sam an d back end to sam communication with rsa based cryptography ? support iso/iec 7816 baud rates ? true random number generator (trng) 2.3 delivery types ? available in wafer, pcm 1.1 module, or hvqfn package 3. applications ? access management ? public transport ? loyalty programs ? micro payment 4. quick reference data 5. ordering information table 1. quick reference data v dd ; v ss =0v; t amb = ? 25 ? c to +85 ? c symbol parameter conditions min typ max unit v dd supply voltage class a: 5 v range 4.5 5.0 5.5 v class b: 3 v range 2.7 3.0 3.3 v table 2. ordering information type number package name description version p5df081x0/t1ad2060 pcm1.1 contact chip card module (super 35 mm tape format, 8 contact), minimum order quantity: 10.000 sot658-1 p5df081x0/t1ad2060s pcm1.1 contact chip card module (super 35 mm tape format, 8 contact), minimum order quantity: 1.000 sot658-1 P5DF081HN/t1ad2060 hvqfn32 plastic thermal en hanced very thin quad flat package; no leads; 32 terminals; body 5 x 5 x 0.85 mm sot617-3 p5df081ua/t1ad2060 fcc sawn wafer 150 mm on film frame carrier - p5df081x0/t1ar1070 pcm1.1 contact chip card module (super 35 mm tape format, 8 contact), minimum order quantity: 10.000 sot658-1
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 3 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 p5df081x0/t1ar1070s pcm1.1 contact chip card module (super 35 mm tape format, 8 contact), minimum order quantity: 1.000 sot658-1 P5DF081HN/t1ar1070 hvqfn32 plastic thermal en hanced very thin quad flat package; no leads; 32 terminals; body 5 x 5 x 0.85 mm sot617-3 p5df081ua/t1ar1070 fcc sawn wafer 150 mm on film frame carrier - table 2. ordering information ?continued type number package name description version
xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 4 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 6. block diagram fig 1. block diagram io1 io3 programmable io1, io2, io3 io2 clk rst_n vdd vss rom 264 kb program memory cpu 7680 b data memory eeprom 80 kb data and program memory crc16 001aal646 fast rng timers 16-bit t0 16-bit t1 ram enhanced public key coprocessor e.g. rsa aes coprocessor triple-des coprocessor uart iso 7816 clock filter security sensors reset generation voltage regulator memory management unit (mmu) clock generation
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 5 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 7. pinning information 7.1 pinning 7.2 pinning 7.3 pin description fig 2. pin configuration pcm1.1 001aam116 c1v cc c5 gnd c2 rst_n c6 io3 c3 clk_n c7 io1 c4n.c. c8 io2 remark: central pad is isolated. fig 3. pin configuration hvqfn32 1vss n.c. io3 n.c. io1 lb io2 dm vcc la rstn n.c. n.c. n.c. clk dp 32 31 30 29 28 27 26 25 9 10 11 12 13 14 15 16 n.c. n.c. n.c. n.c. n.c. n.c. n.c. n.c. 8 7 6 5 4 3 2 24 17 18 19 20 21 22 23 aaa-005250 p5df081 transparent top view terminal 1 index area n.c. n.c. n.c. n.c. n.c. n.c. n.c. n.c. table 3. pin description pcm 1.1 mifare sam av2 iso/iec 7816 mifare sam av2 pad symbol symbol pad description c1 vcc v cc c1 power supply voltage input c2 rst rst_n c2 reset input, active low c3 clk clk_n c3 clock input c4 reserved n.c. c4 n.c.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 6 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 c5 gnd gnd c5 ground (reference voltage) input c6 vpp io3 c6 used for i2c communication to rc52x or rc663 (sclk) c7 io1 io1 c7 input/output for serial data (host communication) c8 reserved io2 c8 used for i2c communication to rc52x or rc663 table 4. pin description hvqfn32 mifare sam av2 hvqfn32 mifare sam av2 pad symbol symbol pad description 1 vss gnd 1 ground (reference voltage) input 2 n.c. n.c. 2 not connected 3 io3 io3 3 used for i2c communication to rc 4 n.c. n.c. 4 not connected 5 io1 io1 5 input/output for serial data (host communication) 6 lb n/a 6 not used 7 io2 io2 7 used for i2c communication to rc (sdata) 8 dm n/a 8 not used 9 n.c. n.c. 9 not connected 10 n.c. n.c. 10 not connected 11 n.c. n.c. 11 not connected 12 n.c. n.c. 12 not connected 13 n.c. n.c. 13 not connected 14 n.c. n.c. 14 not connected 15 n.c. n.c. 15 not connected 16 n.c. n.c. 16 not connected 17 dp n/a 17 not used 18 clk clk_n 18 clock input 19 n.c. n.c. 19 not connected 20 n.c. n.c. 20 not connected 21 n.c. n.c. 21 not connected 22 rstn rst_n 22 reset input, active low 23 la n/a 23 not used 24 vcc vcc 24 power supply voltage input table 3. pin description pcm 1.1 mifare sam av2 ?continued iso/iec 7816 mifare sam av2 pad symbol symbol pad description
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 7 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8. functional specification 8.1 hardware interface 8.1.1 contact interface the pad assignment and the electrical characteristics are fully compliant with iso/iec 7816 (part 2 and part 3). the mifare sam av2 operates with class a and class b interface devices. an internal char ge pump provides the eeprom programming voltage. note that pad c6 is not a programmi ng voltage input but is an output line for the clock signal for i2c communication to the rc52x or rc663 reader chip. pad c8 is used as data line to the reader chip. these two pads for connection to the rc52x or rc663 are the only ones deviating from the iso standard pin assignment. 8.1.2 external clock frequency and bit rates the basic operation frequency of the mifa re sam av2 is 3.5712 mhz. with this frequency the following standard bit rates can be reached using iso/iec 7816 transmission factors f and d. the mifare sam av2 supports significantly higher transmission speeds. the maximum specified bit rate in any case is 1.5 mbit/s. 8.1.3 card operation procedures all card operation procedures (activation, cold reset, warm reset and deactivation) are fully compliant with ref. 19 , chapter 5. 8.2 transmission procedure and communication 8.2.1 protocol activation sequence all subsequently described operations are compliant with iso/iec 7816-3. 8.2.1.1 answer to reset (atr) the mifare sam av2 offers two modes of operation identified by different atrs. a negotiable mode where the bit rate has to be adjusted via a pps request and a specific mode where the mifare sam av2 switches automatically to f = 128 and d = 32 (highest possible speed) after sending the atr. starting with the negotiable mode, the mode of operation is switched after every warm reset. after a cold reset, the card sends the following atr to the terminal. table 5. atr after cold reset character value meaning ts 3bh initial character; setting up direct convention t0 dfh ta(1), tc(1), td(1) are present; number of historical characters is 15 ta(1) 18h f = 372; d = 12 tc(1) ffh no extra guard time needed; n = 255 td(1) 81h td(2) is present; protocol t = 1
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 8 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 after this atr, the card is in the negotiabl e mode and waits for a pps request. if a warm reset is issued, the mifare sam av2 switches the mode of operation, enters the specific mode and sends the following atr. after every future warm reset, the mode of o peration and therefore also the atr is toggled with the atr after cold reset. td(2) f1h ta(3), tb(3), tc(3) and td(3) are present; protocol t=1 ta(3) feh information field size of the card = 254 tb(3) 43h bwt indicator = 4; cwt indicator = 3 tc(3) 00h error detection code = lrc td(3) 3fh ta and tb for t = 15 is present; protocol t = 15 (qualifies global interface bytes) ta(after t = 15) 03h clock stop not supported; class a, class b tb(after t = 15) 83h proprietary use of c6 (io3, reception of serial data from rc52x or rc663) historical bytes 4dh, 49h, 46h, 41h, 52h, 45h, 20h, 50h, 6ch, 75h, 73h, 20h, 53h, 41h, 4dh ascii value of ?mifare plus sam? tck 3b check character table 6. atr after warm reset character value meaning ts 3bh initial character; setting up direct convention t0 dfh ta(1), tc(1) and td(1) are present; number of historical characters is 15 ta(1) 18h f = 128 and d = 32 tc(1) ffh no extra guard time needed; n = 255 td(1) 81h ta(2) and td(2) are present; protocol t = 1 ta(2) f1h specific mode byte: capable of changing the mode of operation; parameters def ined by interface bytes; protocol t = 1 td(2) feh ta(3), tb(3), tc(3), td(3) are present; protocol t=1 ta(3) 43h information field size of the card = 254 tb(3) 00h bwt indicator = 4; cwt indicator = 3 tc(3) 3fh error detection code = lrc td(3) 07h ta and tb for t = 15 is present, protocol t = 15 (qualifies global interface bytes) ta(after t = 15) 83h clock stop not supported, class a and class b tb(after t = 15) 18h proprietary use of c6 (io3, reception of serial data from rc52x or rc663) historical bytes 4dh, 49h, 46h, 41h, 52h, 45h, 20h, 50h, 6ch, 75h, 73h, 20h, 53h, 41h, 4dh ascii value of ?mifare plus sam? tck 98h check character table 5. atr after cold reset ?continued character value meaning
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 9 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.2.1.2 protocol and parame ter selection (pps exchange) the pps command allows to individually select the transmissi on factors and the communication protocol. the pps was successful if the resp onse exactly echoes the request. 8.2.2 protocol t = 1 the mifare sam av2 offers a t = 1 prot ocol which is fully compliant with iso/iec 7816-3, chapter 9 . for details on how to calculate the resulting time-outs, refer to iso/iec 7816-3, chapter 9.5 . 8.2.3 apdu structure all instructions sent to the mifare sam av 2 have to be coded into an apdu structure according to iso/iec 7816-4 and inserted into the information field of one or more i-blocks. the commands do not belong to the inter-indu stry class. the coding of the command and response pairs is proprietary, only the structure is compliant with iso/iec 7816-4. 8.2.4 uid/serial number the mifare sam av2 ic features a 7 byte uniq ue serial number that is programmed into a locked part of the non-volatile memory that is reserved for the manufacturer. this uid is fixed and cannot be changed. 8.3 mifare sam av1 compatibility mode vs. mifare sam av2 mode unless stated explicitly otherwise, all info rmation in this document refer to both the mifare sam av1 compatibility mode and to the pure mifare sam av2 mode. commands only available in pure mifare sam av2 mode are flagged as "av2 only". differences for commands different in sam av2 with respect to their corresponding sam av1 compatibility version are listed explicitly as well. the main differences between the av1 comp atibility mode and th e av2 mode are the following: ? pki commands are only available in av2 mode ? av2 mode introduces key classes: host keys, picc keys, offlinechange keys and offlinecrypto keys. all symmetric key ent ries are classified into one of them, restricting the possible usage of the key entry. ? av2 mode improves the sam access protec tion by replacing the av1 compatibility host authentication protocols with more secure variants. ? av2 mode improves the sam-host commun ication protection by replacing the av1 compatibility increased security mode (based on cm acing) by three modes of secure messaging after a host authentication (plain, mac protection and full protection). ? av2 mode replaces and adds some key entry configuration options, offering more flexibility in securing the sam (e.g. rega rding key dumping).
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 10 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.4 cryptography and key handling 8.4.1 cryptography av1 compatibility mode supports symmetric key cryptographi c algorithms while mifare sam av2 mode supports both symmetric and asymmetric cryptography. 8.4.1.1 symmetric key cryptography mifare sam av2 offers support in seve ral commands for various symmetric key cryptographic algorithms. des and tdea des keys (56 bit) and 2tdea keys (112 bit) are stored in 16 byte strings. 3tdea keys (168 bits) are stored in 24 byte strings. des keys (56 bit) are stored in the same format as the 2tdea keys: the des key is stored twice to form a 2 key tdea key where the 2 keys are identical. aes aes keys are stored in strings of 16 bytes or 24 bytes depending on whether it is an aes 128-bit key or an aes 192-bit key. aes always operates on 16 bytes. therefore data streams are always padded to a length of multiples of 16 bytes. for details of the aes stand ard please refer to public ly available standard ( ref. 31 ). aes macing mifare sam av2 supports sta ndard cmac [ref. 15] for aes. padding is do ne according to the standard. by default, the cmac is truncated to 8 bytes, except if requested explicitly otherwise by the user (sam_generate_mac and sam_verify_mac commands). an alternate mac truncation scheme is used for mifare plus commands for the av2 mode sam-host communication protection and possible via sam_generate_mac and sam_verify_mac commands. mifare classic mifare sam av2 supports mifare classic cr ypto-1 authentication and encryption. 8.4.1.2 asymmetric key cryptography (mifare sam av2 mode only) mifare sam av2 supports rsa encryption, decryption, signature generation and signature verification according to ref. 16 . these algorithms are available in av2 mode via the pki commands. rsa encryption and decryption: the pki functionalities of the mifare sam av2 support rsa decryption. it is used by the pki_updatekeyentries command. the supported algorithm is rsaes-oaep ref. 16 the oaep padding requires a hashing function and a mask generation function (mgf). for the mgf, the sam supports sha-1, sha-224 and sha-256 for hashing (see ref. 9 for the various sha variants); the mgf used is the one specified by ( ref. 17 b.2.1).
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 11 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 rsa signature generation and verification: the pki functionalities of mifare sam av2 support rsa signature handling. it is used by the pki_generatesignature, pki_verifysignatures and pki_updatekeyentrie s commands. the supported algorithm is rsassa-pss (see ref. 16 ). the pki_generatesignature and pki_verifysignatures commands expect the already hashed messa ge mhash as input. the initial hash operation (step 1 and 2 of em sa-pss-encode and emsa-pss-verify, ref. 16 ) is not calculated by this function. hashing algorithms (mifare sam av2 only): mifare sam av2 supports sha-1, sha-224 and sha-256 for hashing according to ref. 17 . these hashing algorithms are available in av2 mode via the pki_generatehash command. 8.4.2 key diversification mifare sam av2 provides several key divers ification methods. in both av1 compatibility mode and in mifare sam av2 mode, the mifare sam av1 key diversification methods and new mifare sam av2 key diversificatio n methods are available; however for av2 only commands (i.e. mfp commands and th e ulc_authenticatepicc) only the new mifare sam av2 diversificat ion methods are available. 8.4.3 key storage (mifare sam av1 compatibility mode) mifare sam av2 in av1 compatibility mode can only store symmetric keys. mifare sam av2 can store up to 128 symmetric keys in up to 3 versions (only 2 versions possible for 3tdea ke ys and aes-192 keys). 8.4.3.1 symmetric keys the mifare sam av2 uses a key storage table (kst) in order to store and manage keys and attributes related to keys. the kst holds 128 entries. every entry cont ains positions to store three des, three 2tdea, two 3tdea, three aes128, two aes192 or six mifare keys plus their attributes. every key entry is referred to by its index, the keyno. key reference number: keyno is the index of the entry in the kst and can have the value 00h to 7fh. key reference number of change entry key: the 1-byte field holds the keyno that is necessary for authentication to run a sam_changekeyentry command. the value feh disables the need for authentication for key load. the value ffh irreversibly locks the entire key entry. key version of change entry key: the 1-byte field holds the key version within the key entry specified for the change entry key. the key version has to be in the range of 00h to ffh. reference number of key usage counter: the 1-byte field holds the reference number of the key usage counter entry which is auto matically incremented each time this key entry is used for authentication, see section 8.4.6 .
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 12 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.4.4 key storage (mifare sam av2 mode) mifare sam av2 in mifare sam av2 mode can store both symmetric and asymmetric keys. 8.4.4.1 symmetric keys mifare sam av2 can store up to 128 symmetric keys in up to 3 versions (only 2 versions possible for 3tdea keys and aes- 192 keys) there only differen ce in the content of a key entry compared to av1 compat ibility mode is the addition of an extset byte with extended configuration settings, as can be seen in table 14. storage and configuration options: next to the addition of the extset byte, part of the set configuration settings got redefined when comparing av2 mode to the av1 compatibility mode. four classes of keys are distinguished which re strict the possible usage of a key entry to part of the sam functionality: 1. host keys: used for protecting the sam-host communication (see section 8.5 ) these keys are restricted to the aes key types. 2. picc keys: used for the card communication ; depending on the key type they can be used for authenticating and communicating with a mifare plus, desfire, mifare classic and/or mifare ultralight c card 3. offlinechange keys: used for some key management commands, to allow offline preparation of the cryptograms for these commands (compared to when the key management is done with host keys) these keys are restricted to the aes key types. 4. offlinecrypto keys: used for offline crypto operations: e.g. for communication with the backend or for writing encrypted data on a mifare plus slim or mifare ultralight (c) card. note that the key classes are mutual exclusiv e: one key cannot belong to more than 1 of these classes. kst reset when activating mifare sam av2 mode: from mifare sam av2 mode on, the keys stored in the kst are ident ified as host, picc, offlinechange or offlinecrypto keys. for this reason the kst is reset when activating mifare sam av2 mode, as it is not clear how to assign the existing keys to one of the classes automatically. 8.4.4.2 asymmetric keys mifare sam av2 can store 2 rsa public key pairs and one rsa public key.mifare sam av2 supports rsa keys with a modulus with a size from 256 bit (i.e. 32 bytes) up to 2048 bit (i.e. 256 bytes). pki key storage table: mifare sam av2 uses a pki key storage table (pki_kst) in order to store and manage rsa asymmetric ke y pairs (i.e. private and public keys) and the attributes related to keys. the pki_kst holds 3 entries.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 13 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.4.5 key versioning the mifare sam av2 reserves three bytes in a key entry to store the version of the three available keys in the entry. this version byte contains the key version for all kinds of keys (des, tdea, aes and mifare). the version in formation must be included separately in every key entry of type aes or mifare wh en it is updated by the changekeyentry command. 8.4.6 key usage counters in order to count and limit the number of authentications a key entry can be used for, mifare sam av2 stores a table of 16 key usag e counter entries, 00h to 0fh, which are automatically incremented each time a defined key entry is used for authentication. multiple key entries ca n use the same counter. 8.4.6.1 reference number the property refnokuc codes the reference number of the key usage counter. refnokuc is the index of the entry in the table and can have the value 00h to 0fh, therefore 16 key usage counters can be stored. 8.4.6.2 limit this field stores the current limit for this key usage counter. it is only possible to use a key that is linked to this counter for authenticatio n if the current value (s ee below) is smaller than the current limit. as soon as the current value is equal to, or higher than, the current limit, the usage of all key entries linked to this counter is prohibited. 8.4.6.3 key reference number to change the current kuc entry in order to change the kuc, a successful au thentication by the host application of the mifare sam av2 is necessary. the keynoc kuc defines the reference number of the kst which is used for this. 8.4.6.4 key version to change the current kuc entry the 1-byte field holds the key version within the key entry specified to change the kuc entry. the key version has to be in the range of 00h to ffh. the mifare sam av2 will automatically select the appropr iate key from one of three positions in the entry that has the specified version number. 8.4.6.5 current value the curval field stores the current value of this key usage counter. it is possible to use all keys referring to this counter for authentication only if the current valu e is smaller than the current limit. 8.5 sam - host communication 8.5.1 general principles for sam-host protection mifare sam av2 supports two different mo des: av1 compatibility mode and mifare sam av2 mode. a mifare sam av2 is initia lly in mifare sam av1 compatibility mode. it can be switched to the mifare sam av2 by executing a host authentication with the sam master key using the sam_lockunloc k command. note that mifare sam av2 mode activation is thus only possible if the sam master ke y is configured as an aes128
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 14 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 or aes192 key. during this activation authentication, the maximal message size under command chaining (maxchainblocks) is set. once switched to mifare sam av2 mode there is no mean to switch back. when the mifare sam av2 mode is activated, the key storage table (except the sam master key) gets reset. 8.5.2 mifare sam av1 compatibility mode sam-host protection in av1 compatibility mode, sam access and sam-host communica tion is protected by the increased security mode exactly like fo r the mifare sam av1. the protection mechanism is explained in the following subsection. 8.5.2.1 increased security - cmac calculation the mifare sam av2 offers the possibility to send each command on a higher security level by applying a cmac. if activated, the mifare sam av2 requires a logical channel with an active host authentication to be defi ned for cmac calculation to accept any command. the cmac is calculated and padded according to the nist special publication 800-38b, which gives a recommendation for block cipher modes of operation. the following commands of the mifare sam av2 do not apply the explained cmac mechanism: ? sam_authenticatehost ? sam_getchallenge, sam_internalauthent icate and sam_externalauthenticate commands already protected by encryption ap ply the explained cmac mechanism only for the direction which is not protected: ? sam_changekeyentry fo r the command apdu ? sam_changekucentry for the command apdu ? sam_dumpsessionkey for the response apdu ? sam_changekeymifare for the response apdu 8.5.3 mifare sam av2 mode sam-host protection two kinds of host authentication can be dist inguished. the first is used for locking and unlocking the sam. the second kind is used to get the access rights to execute certain commands. it only affects the sam status for the lc it is exec uted over and can be used to set up a sac over this lc if preferred by the host. once authenticated, three different protection modes on the lc are foreseen: plain, mac protection and full protection (i.e. by macs and encryption). this host authen tication is executed by using the sam_authenticatehost command. note that whether and when host authentications (be it for unlocking or for gaining access rights) are required depends on the sam configuration and is explained in ref. 1 .
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 15 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.6 mifare sam av2 command set for better readability of the following command descriptio ns, the logical channel number of the cla byte is set to default 00b. 8.6.1 sam security and configuration commands table 7. sam security and configuration commands command description sam_disablecrypto this command allows t he permanent and irreversible disabli ng of the cryptographic functionality of the mifare sam av2. successful host authentication with one of the th ree keys stored in keyno 00h is required to send this command. sam_lockunlock the command sam_lockunlock (ins = 10h) is used to run a mutual authentication between the sam and host system. the host au thentication consists of three parts. such an authentication proves that both the sam and the host contain the same secret, namely the aes key kx. the terminology, notations and state descriptions for sam_lockunlock are provided in ref. 1 . sam_authenticatehost av1 compatibility mode : the command sam_authenticatehost is used to run a mutual 3-pass authentication between the mifare sam av2 and host system. such an authentication proves t hat both the mifare sam av2 and the host contain the same secret, namely a des, tdea or aes key and gener ates a session key for further cryptographic operations. a host authentication is required to: ? load or update keys into the mifare sam av2 ? modify key usage counter limits ? activate the mifare sam av2 after reset (if configured accordingly in the configuration settings (set) of keyno 00h) sam_activateofflinekey sam_activateofflinekey is to be us ed in av2 mode to activate both offlinecrypto and offlinechange keys. sam_loadinitvector the command sam_loadinitvector is used to load an init vector for the next cryptographic operation into the mifare sam av2. the loaded init vector will be applied in the nex t cryptographic operation independent from the ?keep iv? setting of the key entry except for the authentication commands w here the init vector is reset to zero. sam_killauthentication av1 compatibility mode: invalidates any kind of authentication in the logical channel the command is issued. sam_selectapplication the command sam_selectapplication is the equivalent of the sele ctapplication command of desfire. the mifare sam av2 generates a list of available keys linked to the specified application id as defined in the key entry property ?df_aid?. the mifare sam av2 generates a list of available keys per desfire aid and desfire key number. for every key number, up to 6 key versions can be stored in the list (so it can read the keys from maximum two key entrie s per desfire aid and desfire key number). this list is filled starting with key entry zero. if the kst contains more than 6 key versions per desfire aid and desfire key number, only the first 6 versions will be listed.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 16 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 sam_isogetchallenge/ sam_getrandom av1 compatibility mode in av1 compatibility mode, this is the first pa rt of an iso compliant authentication sequence returning a random number. the command can obviously also be used for simply generating a random number but it has to be taken into account that the mifare sam av2 internally is set into a state indicating that an authent ication procedure is ongoing, if the requested random number length is 8 byte or 16 byte. consequently, the command called after getting the random number will be aborted (except sam_isoexternalauthenticate). after this abortion the mifare sam av2 resets its state and returns to normal operation. for a complete and valid authentication proced ure, the three commands sam_isogetchallenge, sam_isoexternalauthenticat e and sam_isointernalauthenticate have to be called in sequence without interrupting the seque nce by another command. av2 mode in av2 mode, this command is only available to get random numbers. in this case, there are no special constraints on the expected length for the challenge. sam_isoexternalauthen ticate this command is part of an iso compliant authentication procedure consisting of sam_isogetchallenge, sam_isoex ternalauthenticate and sam_isoin ternalauthenticate. it can be used by a host for authentic ating the mifare sam av2. note that this command is only available in av1 compatibility mode. such an authentication proves t hat both the mifare sam av2 and the host contain the same secret, namely a des, tdea or aes key, and gene rates a session key for further cryptographic operations. sam_isointernalauthent icate this command is part of an iso compliant authentication procedure consisting of sam_isogetchallenge, sam_isoex ternalauthenticate and sam_isoin ternalauthenticate. it can be used by a host for authentic ating the mifare sam av2. note that this command is only available in av1 compatibility mode. such an authentication proves t hat both the mifare sam av2 and the host contain the same secret, namely a des, tdea or aes key, and gene rates a session key for further cryptographic operations. sam_getversion the sam_getversion co mmand returns manufacturing related data of the mifare sam av2. the sam_getversion command can be used to de tect whether a sam has been switched to the mifare sam av2 mode. sam_sleep will force the mifare sam av2 to put a co nnected rc52x or rc663 into sleep mode and itself into idle mode to reduce power consumption. the mifare sam av2 will answer the command and afterwards switch to idle mode. the mifare sam av2 will automatically return to normal operation after receiving the first character of the next command. the rc52x or rc6 63 will stay in sleep mode until a command is issued which utilizes the reader ic. then the mifare sam av2 automatically carries out the wake-up sequence before starting the requested operation. table 7. sam security and configuration commands ?continued command description
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 17 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.6.2 sam key management commands table 8. sam key management commands command description av1 compatibility mode sam_changekeyentry this command upda tes any key entry of the kst. the complete data set of the full key entry must always be sent, and it will be programmed to the non-volatile memory of the mifare sam av 2 as defined in the non-volatile promas. sam_getkeyentry the sam_getkeyentry co mmand allows reading the contents of the key entry specified in the parameter keyno. instead of the full keys on positions a, b and c, only their key version will be returned, each packed in one byte. this command can be issued without valid (host) authentication. sam_changekucentry this command updates any key usag e counter entry stored in the mifare sam av2. always limit, keynockuc and keyvckuc have to be sent; the parameter promas defines which properties are programmed into the mifare sam av2 non-volatile memory. successful host authentication with the key specified in keynockuc of the current kuc entry is required. sam_getkucentry the sam_getk ucentry command allows reading the data of the key usage counter entry specified within the parameter refnokuc. this command can be issued without valid (host) authentication. sam_dumpsessionkey the command sam_dumpsessionkey can be used to retrieve the session key generated by the mifare sam av2. the session key could be retrieved either in plain or encrypted with the session key of any logical channel. a crc is appended before encryption as usual. this feature is necessary if cr yptographic operations like en-/ decipher should be handled by the terminal microcontroller instead of the mifare sam av2. as th is feature can be seen as a potential security risk if not used in the correct wa y, it can be en-/disabled using the configuration settings of every key entry. sam_disablekeyentry the sam_disablekeyent ry command disables a key entry. after executing this command, the corresponding disable flag in the key entry is set and the key entry cannot be used anymore for authentication and key change procedures. the key entry can still be read by a sam_getkeyentry command. to reactivate t he entry, a sam_changekeyentry command has to be issued. all fields in the key entry can still be changed by this command even if the entry has been disabled. av2 mode the following rows give an outlook of the changes compared to the av1 compatibility mode. all commands except sam_getkucentry got partially or completely rede fined for the av2 mode. for more information see ref. 1 . sam_changekeyentry and sam_changekucentry in the av1 version, there are two possibilit ies for changing key and kuc entries via the sam_changekeyentry and sam_changekucentry respectively. which possibility is used, depends on whether the "allow crypto with secret ke y" of the change key, i.e. the key referenced by keynocek or keynockuc respectively, was set. if set, this allowed for offline preparation of the key/kuc changing cryptogram. in the new mifare sam av2 mode, these two po ssibilities are still supported, but which possibility is used depends on the key class of t he change key. change keys are either host keys or offlinechange keys. the second class will allow offline command generation. sam_getkeyentry the sam_getkeyentry co mmand allows reading the contents of the key entry specified in the parameter keyno. instead of the full keys on positions a, b and c, only their key version will be returned, each packed in one byte. this command can be issued without valid (host) authentication.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 18 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.6.3 data processing commands sam_dumpsessionkey the command sam_dumpsessionkey can only be used to retrieve the session key of an established authentication with a desfire or mifare plus picc. so an active picc authentication (for these card types) is required. the session key can be retrieved in plain or encrypted, depending on the sam-host protection mode of the logical channel. in plain and mac protec tion mode, the dump is done in plain; in full protection the key is encrypted (as any other response data field). under mac protection, the response data field can optionally be encryp ted if requested via setting bit 0 of p1. this command cannot be used for secret key dumping. sam_dumpsecretkey sam_dumpsecretkey allows dumping an y of the picc keys (except mifare classic keys) or offlinecrypto keys. sam_disablekeyentry in av2 mode, two possibilities are s upported, similar to the sam_changekeyentry command. which possibility is used depends on the key class of the change key. change keys are either host keys or offlinechange keys. the second class will allow offline command generation. table 8. sam key management commands ?continued command description table 9. data processing commands command description av1 compatibility mode sam_verify_mac the sam_verify_mac command verifies th e mac which was sent by the desfire picc or any other system based on t he given maced plain text data and the currently valid cryptographic key. the applied mac algorithm depends on the key typ. the command can also be used for verifying only a part of a mac. the numb er of mac bytes to be verified is defined by parameter p2. sam_generate_mac the sam_generate_mac command creates a mac which is m eant to be sent to the desfire picc or any other system based on the given plain text data and the currently valid cryptographic key. the applied mac algorithm depends on the key type. sam_decipher_data the sam_decipher_data command deciphe rs data packages sent by a desfire picc, any other system or a mifare card based on the currently valid cryptographic key and returns plain data to the pcd. sam_encipher_data the sam_encipher_data command create s data packages which are meant to be sent to a desfire picc or any ot her system based on the given plain text data and the currently valid cryptographic key. to do so, the plain data is en-ciphered in cipher block chaining send mode. crc and padding bytes are appended automatically. av2 mode the mifare sam av1 supported the exec ution of cryptographic operations (macin g, encryption) using the sam data processing commands with a key that allo wed "crypto with secret key". so the sa me primitives as used for the desfire communication are also accessible for so-called offline cryptograph ic operations (i.e. crypto oper ations that are not part of the sam-host or sam-picc communication protocols). for the mifare sam av2 this kind of function ality is still supported. the "crypto with secret key" operation is replaced by a separate key class, called offlinecrypto keys. the existi ng sam data processing commands are extended to support full length mac generation and verification; also new commands for executing standard cbc encryption and decryption are provided. the existing sam data processing commands (sam_gener ate_mac, sam_verify_mac, sam_encipher_data and sam_decipher_data) can still be used to support desfire communication, by issuing them in an lc with an active picc authentication (sam_authenticatep icc). these commands and the new sam_encipheroffline_data and sam_decipheroffline_data can be used with offlinecrypto keys if issued in an lc with an active offlinecrypto key.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 19 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 sam_verify_mac the sam_verify_mac command verifies th e mac which was sent by the desfire picc or any other system based on the given maced plain te xt data and the currently valid cryptographic key. the valid key has been activated using a vali d picc authentication ( sam_authenticatepicc, sam_isoauthenticate picc) in case of a picc key or using a valid key activation (sam_activateofflinekey) in ca se of an offlinecrypto key. the applied mac algorithm depends on the key type. in case of the aes key types and the (3)des key types 3 and 6, the standard cmac algorithm is applied. sam_generate_mac the sam_generate_mac command creates a mac which is m eant to be sent to the desfire picc or any other system based on the given plain text data and the currently valid cryptographic key. the valid key has been activated using a valid picc authentication (sam_authenticatepicc, sam_isoauthenticate picc) in case of a picc key or using a valid key activation (sam_activateofflinekey) in ca se of an offlinecrypto key. the applied mac algorithm depends on the key type. in case of the aes key types and the (3)des key types 3 and 6, the standard cmac algorithm is applied. sam_decipher_data same operation as in mifare sam av1 compatibility mode performe d with either a valid picc authentication (sam_aut henticatepicc, sam_isoauthenticatepicc or sam_authenticatemifare) in case of a picc key or a valid key activation (sam_activateofflinekey) in ca se of an offlinecrypto key. sam_encipher_data same operation as in av1 compatibility mode and same description. sam_decipheroffline_ data the new sam_decipheroffline_data command decrypts data received from any other system based on the given cipher text data and the current ly valid cryptographic offlinecrypto key. the valid key has been activated using a valid key activation (sam_activateofflinekey). the applied decryption is the block cipher algorithm depending on the key type in cbc mode. the iv needs to be loaded via the sam_loadinitvecto r command before issuing this command. if no iv was loaded, the zero byte iv is applied. no p adding is removed from the decrypted plain text, so the output length equals the input length. the total input size must be a multiple of the block size of the underlying block cipher (depending on the key type). in case of command chaining, the sam immediately starts returning decrypted data for the received blocks. the new sam_encipheroffline_data command encr ypts data received from any other system based on the given cipher text data and the current ly valid cryptographic offlinecrypto key. the valid key has been activated using a valid key activation (sam_activateofflinekey). the applied decryption is the block cipher algorithm depending on the key type in cbc mode. the iv needs to be loaded via the sam_loadinitvecto r command before issuing this command. if no iv was loaded, the zero byte iv is applied. no padding is added to the plain text, so the output length equals the input length. as a consequence, the total input size must be a mu ltiple of the block size of the underlying block cipher (depending on the key type). in case of command chaining, the sam immediately starts returning encrypted data for the received blocks. table 9. data processing commands ?continued command description
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 20 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.6.4 public key infrastructure (pki) commands pki commands are available to generate public key pairs, to import public keys or key pairs, to export public keys or key pairs, to generate and to validate signatures, to compute hashes suitable for signature op erations and to manage the symmetric key storage table. pki commands are only available in av2 mode. table 10. public key infrastructure (pki) commands command description pki_generatekeypair the pki command pki_generatekeypair cr eates a pair of a public and a private key. mifare sam av2 only supports the crt format. a succe ssful host authentication in the lc using sam_authenticatehost with a host key is requ ired to execute the pki_generatekeypair command. pki_importkey the pki command pki_impor tkey imports an rsa key. this can be either a public key or a full key pair (including a private key). when a change key (see ref. 1 ) is specified, a successful host authentication in the lc using sam_authent icatehost with a host key is required to execute the pki_importkey command. pki_exportprivatekey the pki command pki _exportprivatekey exports a full rsa key entry (i.e including the private key if present). the key pair is exported in crt format. this command is intended for private key backup after having it created with mifare sam av2. for this reason, this command will only be accept ed if the key entry includes a private key and private key export is allowed by the pki set co nfiguration of the addressed key. the command is part of the restricted command set and requires protection with a host key change key. pki_exportpublickey the pki command pki_exportpublicke y exports the public key part of a rsa key pair. the command is part of the general command set, so its protection depends on the general sam-host communication protection. pki_updatekeyentries the pki_updatekeyentries command ca n be used to change key entries of the symmetric key storage (kst). executing this command does no t require any protection coming from the change key of the key entries (e.g. a host authen tication in case of a host key). instead the command's execution is protected by asymmetric techniques usin g the pki support of the sam. the command is protected by enc rypting the key entries using the rsa encryption. on top a digital signature is added using the rsa signature algorithm. this allows offline preparation of the cryptogram. the same hashing algorithm is to be used for both mgfs and for the digital signature handling (as indicated by the p1 byte). pki_generatehash the pki command pki_gereratehash computes the hash on a data string. the algorithm to be used to compute the hash is selected through p1. pki_generatesignature the pki command pki_generatesignature generates a si gnature on a hash given as input using one of the two private keys stored in the pki key storage table. pki_sendsignature the pki command pki_sendsignature returns a pre-computed signature. the returned signature is protected accordin g to the sam-host protection in place on the corresponding logical channel. pki_verifysignature the pki comm and pki_verifysignature verifies the correctness of a signature.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 21 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.6.5 mifare plus in non-x-mode commands this section describes the sam commands that can be used to prepare mifare plus commands. the sam maintains the mifare plus state (e.g. the read and write counters). table 11. mifare plus in non-x mode commands command description sam_authenticatemfp sam_authe nticatemfp can be used for all mifare plus authentications (e.g. sl1, sl2, sl3, originality keys, sl2 re-authentication). the choice of whether a first or following authentication is to be performed is indicated in the parameters of the command. also the user has to indicate which session key derivation needs to be used afterwards: no session keys needed (sl1 card authentication, origina lity keys authentication), key derivation to continue with sam_authenticatemifa re (sl2) or session key derivation to continue with normal mifare plus transaction (sl3). sam _authenticatemfp only supports the 2-part version of the mifare plus authentication. sam_combinedreadmfp sam_combinedreadmfp handles either a mifare plus read command, a mifare plus read response or both. sam_combinedwritemfp sam_combinedwritemfp handles either a mifare plus write command (write, increment, decrement, transfer, restore, incr ement transfer or decrement transfer) or a mifare plus write response. bit 0 of p1 indi cates whether it is a command or a response. sam_changekeymfp sam_changekeymfp computes the co mmand required to replace a mifare plus key with one of the keys stored in the sam. sam_virtualcardsupportmfp sam_virtualcardsupportmfp hand les the mifare plus vcs and vcsl commands. one sam_virtualcardsupport can handle up to 5 command sets. a command set covers a block of vcs commands and one concluding vcsl command. sam_selectvirtualcardmfp sam_selectvirtualcard mfp handles the mifare plus svc command. sam_proximitycheckmfp sam_proximitychec kmfp is performed in two steps. in the first step, given the data collected during the execution of the proximit y check protocol with the mifare plus picc, the sam computes the mac needed for the final proximity check command. in the second step, the sam verifies the mac re ceived from the mifare plus picc.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 22 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.6.6 mifare classic in non-x-mode commands the commands in this section can both be us ed to execute a transaction with a mifare classic card and with a mifare plus card in sl2. in the second case, sam_authenticatemifare is to be used afte r sam_authenticatemfp to complete a mfp sl2 authentication. in both cases, after the authentication, the other sam_xxxmifare commands and the data processing commands sam_decipher_data and sam_encipher_data can be used for further processing. 8.6.7 desfire and ulc in non-x-mode commands table 12. mifare classic in non-x-mode commands command description sam_authenticate mifare n this procedure, both the mifare card as well as the mifare sam av2 device show in an encrypted way that they posses the same secret which especially means the same key. sam_changekey mifare av1 compatibility mode this command is intended to change a key in a mifa re card. the command offers the possibility to prepare an encrypted stream to be written to a mifare 1k or mifare 4k card containing the desired keys and the given access conditions on the one h and and reading out a single mifare key to be used for any kind of mifare transacti on in a host system directly on th e other hand. in the latter case, the key can be retrieved encrypted from the mifare sam av2 using the current available session key of the channel (host authentication required). the first case requires an active mifare authentication for producing the stream to be sent to th e card.av2 mode (used for key retrieval) in mifare sam av2 mode, the existing command, sam_changekeymifare (used for key retrieval), can still be used to retrieve a picc key of key type 010, i.e. a mifare classic key. the use of this command to change keys on mifa re classic cards is the same as the one described for the av1 compatibility mode. the only difference with av1 is that whether the secr et key is retrieved in plain or encrypted depends on the sam-host protection mode of the logical channel. table 13. desfire and ulc in non-x-mode commands command description sam_authenticatepicc in this procedure both the picc as well as the mifare sam av2 device show in an encrypted way that they posses the same secret which especially means the same key. this procedure not only confirms that both entities are permitted to do operations on each other but also creates a session key which can be used to keep the further communication path secure. as the name ?session key? implicitly indicates, each time a new authentication procedure is successfully completed a new key for further cryptographic operations is obtained. sam_isoauthenticatepicc the iso authentication procedure is intended to authenticate with a card using the standard iso commands getchallenge, externalauthent icate and internalauthenticate. this authentication procedure can be used to aut henticate a desfire picc but also another mifare sam av2. however, the mifare sam av2 will treat the authentication procedure as a picc authentication, which me ans that commands requiring a host authentication will not be available. sam_changekeypicc this command generates the cryptogram that has to be sent to the picc in order to change any key stored in the picc. both the current and the new key need to be stored in the kst to execute this command. this means a new picc key needs to be loaded into the mifare sam av2, prior to issuing this command.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 23 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.6.8 rc52x or rc663 configuration commands 8.6.9 iso14443 commands table 14. rc522x or rc663 configuration commands command description rc_readregister read the content of one or mo re register(s) of the connected reader chip. the command allows reading 255 registers with one co mmand. if a register address is listed more than once in the data field, the content of this register will be re-read every time. rc_writeregister write the content of one or mo re register(s) of the connected reader chip. the command allows writing 127 r egisters with one command. if a register address with its related content is listed more than once in the data field, the content of this register will be re-written every time. rc_rfcontrol this command allows the radio frequency field to be turned off and on. the basic behavior is the reset functionality where the controller turns off the field for the time given in the data fi eld. if a zero value is passed, the field is totally turned off. after turning of f the field, to turn it on again, the command can be issued with any value other than zero. take into account that the passed time value also in this case will force the mifare sam av2 to wait this additional time until turning on the field again. rc_init establishes the serial connection between mi fare sam av2 and rc52x or rc663 and initializes the reader chip with the register values st ored in the selected register value set. rc_loadregister valueset stores a customer defined register value set for th e rc52x or rc663 in the non-volatile memory of the mifare sam av2. this set can then be used for initializing the reader chip with the rc_init command. the address of and the related value for the register have to be placed consecutively in the command data field of the apdu. table 15. iso14443 commands command description iso14443-3_request_wakeup issue a request or wake-up command. iso14443-3_anticollision_select perform bi t-wise anticollision and select. the anti collision and the following select are performed according to the select code in the data field. iso14443-3_activateidle carri es out one or several request - anticollision - select sequences and returns the sak and the uid of the selected card(s). the atqa is returned for every request issued, this means for every newly activated card. due to the fact that the resulting atqa is the or-function of all atqas, the value may change frequently. iso14443-3_activatewakeup the command reactivates and se lects a card that has previously been set to halt state. the command takes the ui d of the card to reactivate. iso14443-3_halta the command puts a selected card into halt state. iso14443-3_transparentexchange exchange bytes/bits transpar ently. the mifare sam av2 w ill take the user data and send it without changing, inse rting or appending any content to the contactless card. appending of a crc, time-out settings, etc. have to be configured by directly writing the rc52x or rc663 registers. take into acco unt that switching settings of the reader chip influence all subsequent mifare sam av2 commands proposing the correct reader chip settings, i. e. iso14443- 4_exchange. iso14443-4_rats_pps execute a combined rats and pps sequence to prepare a card for t=cl data exchange. the cid assigned to the card will be assigned to the current logical channel. this means, every further iso14443-4 command issued in this logical channel will be executed using this cid automatically. iso14443-4_init initialize the t = cl protocol. the intent of this comm and is to configure the protocol for data exchanges. this is necessary if a card was already activated and configured for doing data exchanges without using the iso14443-4_rats_pps command. iso14443-4_exchange exchange bytes according to iso/iec 14443-4 t = cl protocol.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 24 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.6.10 mifare classic in x-mode commands the commands in this section can both be us ed to execute a transaction with a mifare classic card and with a mifare plus card in sl2. in the second case, mf_authenticate, mf_authenticatedread or mf_aut henticatedwrite is to be used after mfp_authenticate to complete a mfp sl2 authen tication. afterwards, the other mf_xxx commands can be used for further processing. iso14443-4_presencecheck check if an ac tivated card is still in the field. iso14443-4_deselect deselect an activated card. the cid is freed by this command. if the deselect fails, the cid will not be freed and cannot be us ed for activating another card. this behavior might be overridden by setting a flag in the p1 byte. cids can also be freed using the iso14443-4_freecid command. iso14443-4_freecid free one, more, or all currently a ssigned cids. this command might be necessary if several deselect commands failed and the cids were not forced to be freed but the card is deactivated or no longer available in the field. table 15. iso14443 commands ?continued command description table 16. mifare classic in x-mode commands command description mf_authenticate performs an au thentication with a mifare card. the mifare key has to be stored in the mifare sam av2 and is referenced by a parameter in the command data field. the key can be diversified if necessary. mf_read read one or several blocks of a mifare card and return the data. if more than one block is read, the mifare sam av2 accesses the blocks in the same order as addresses list ed in the command data field. the order of the returned data is the same as the order of addresses in the data field. mf_write write one or several blocks of a mifare card. if more than one block is written, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data fiel d. the command supports writing of 16 bytes encrypted for mifare 1k and mifare 4k cards as well as writing 16 bytes or 4 bytes plain for mifare ultralight cards. the lengt h can be selected by bit 0 of parameter byte p2. if 16 bytes block write is selected, the mifare sam av2 decides whether encryption shall be used by checking the authentication state. if a mifare authentication has been co mpleted, the data is encrypted. encrypted writing of 4 byte blocks is not supported. mf_valuewrite write one or several value blocks of a mifare card. if more than one block is writt en, the mifare sam av2 accesses the blocks in the same order as add resses listed in the command data field. since a mifare card uses 12 bytes for storing a four-byte value, the address to write in the last four bytes has to be specified by the user (?address? parameter). mf_increment increment one or several value blocks on a mi fare card. every increment is confirmed automatically by sending the transfer command dire ctly afterwards. the user has to define the source address of the value block to be incremented and t he destination address of the value bl ock to store the result. if more than one block is incr emented, the mifare sam av2 accesse s the blocks in the same order as addresses listed in the command data field. mf_decrement decrement one or several value blocks on a mifare card. every de crement is confi rmed automatically by sending the transfer command directly afterwards. the user has to define the source address of the value block to be decremented and the destination addre ss of the value block to store the result. if more than one block is decre mented, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data field. mf_restore copy one or several value blocks on a mifare card. if more than one block is copied, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data field. the order of the status code is the same as the order of addresses in the data field.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 25 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 mf_authenticated read performs an authentication with s ubsequent reading of blocks on a mifare card. the command allows authenticating a nd reading several different blocks on the card within one command. several blocks can be read without re-auth enticating, but also several blocks with different aut hentications. for each block address needing a new authentication, the key to authen ticate with and whether it shall be diversified has to be specified. if a key is used for accessing different blocks bu t a new authentica tion is necessary, these blocks have to be listed consecutively in the data field and the re-use to be indicated by a flag. if more than one block is read, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data field. the order of the returned data is the same as the order of addresses in the data field. mf_authenticated write performs an authentication with subs equent writing of blocks on a mifare card. the command allows authenticating and writing several di fferent blocks on the card within one command. several blocks can be written without re-authenticating, but also seve ral blocks with different authentications. for each block address needing a new authentication, the key to authenticate with and whether it shall be diversified has to be specif ied. if a key is used for accessing diff erent blocks, these blocks have to be listed consecutively in the data field and the re-use to be indicated by a flag. if more than one block is written, the mifare sam av2 accesses the blocks in the same order as addresses listed in the command data field. mf_changekey this command is intended to change a key in a mifare card. the command offers the possibility to prepare and write an encrypted data stream to a mifare 1k or mifare 4k card containing the desired keys and the given access conditions. the first case requires an active mifare authentication for producing the stream to be sent to the card. this command is able to generate a diversified mifare standard key, based on a mifare key stored in the mifare sam av2, a tdea key stored in the mifare sam av2, the uid of the mifare standard picc and the block address on the mifare standard card. the tdea key applied for the diversification is referenced in the mifare key entry. table 16. mifare classic in x-mode commands ?continued command description
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 26 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.6.11 mifare plus in x-mode commands this chapter describes the commands for the mifare plus picc?s when the mifare sam av2 is used in mifare sam av2 mode. when a mifare plus communication is established between the sam and a mifare plus picc, the corresponding sam logical channel maintains the state (e.g. the read and write counters) required to manage the se cure messaging with the mifare plus picc. table 17. mifare plus in x-mode commands command description mfp_writeperso mfp_writeperso is a multi-block wr ite command. it performs up to 13 mfp writeperso commands. if more than 13 values are to be updated, several mfp_writeperso are to be issued. there is no command chaining for this command. mfp_authenticate mfp_authenticate pe rforms all mifare plus authen tications (e.g. sl1, sl2, sl3, originality keys...). the choice of whether a first or following authentication is to be performed is indicated in the parameters of the command. also the user has to indicate which session key derivation needs to be used afterwards: no session keys needed (sl1 card authentication, originality keys authenticatio n), key derivation to continue with mf_authenticate (sl2) or session key derivation to continue with normal mifare plus transaction (sl3). mfp_combinedread mfp_combinedread performs one mifare plus read command. mfp_combinedwrite mfp_combinedwrite performs a mifa re plus write command where a write command can be a mifare plus write, increment, decrement, transfer, restore, increment transfer or decrement transfer command. each mfp_combinedwrite command is restricted to one mifare plus write command. mfp_changekey mfp_changekey replaces one of the mifa re plus picc keys by one of the keys stored in the sam. mfp_proximitycheck mfp_proximitycheck performs the comp lete mifare plus proximity check between mifare sam av2 and the mifare plus picc. it performs the ppc, the one or more pc?s and the vpc command. as this is the x-mode command , the proximity time measurem ent is handled by a mfrc52x reader ic time-out. the reader ic will use the iso14443-3 minimal frame delay time, as a time-out value for the picc response to the mi fare plus proximity check command(s) sent. in case the proximity check is executed with an mfp authentication, the mac session key of this authentication will be used for the mifare plus verify proximity check (vpc). the command also foresees random vpc processing as recommended in some cases for privacy reasons. mfp_virtualcardsupport mfp_virtualcardsupport sends as many mifare plus vcs and vcsl commands to the mifare plus picc as s pecified in the command. mfp_virtualcardsupport accepts up to 5 command sets. mfp_virtualcardsupport returns the mifare plus picc responses to the corresponding vcsl commands. a command set is made of commands. for each command the key duo is specified (i.e. the sam key to be used for mac and the sam key to be used for enc) together with the vciid to be advertised by the sam to the mifare plus picc. given a command set, sizeof(command set)-1 vcs commands are sent wi th one concluding vcsl command. mfp_selectvirtualcard mfp_selectvirt ualcard sends a mifare plus svc command to the mifare plus picc. if no successful entry for this iid can be fou nd (from mfp_virtualcardsupport processing), the sam will still send an svc command (with random mac) to the card. on successful execution (both valid and invalid iid) , the internal vc table is invalidated. note that mifare sam av2 does not support multiple vc selection protocols to be executed in parallel. the user needs to ensure the vc se lection is completed before starting another on any of the lcs, as starting vc select ion with sam_virtualcardsupportmfp or mfp_virtualcardsupport will also invalidate the existing internal vc table (if any).
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 27 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 8.6.12 desfire and ulc in x-mode commands table 18. desfire and ulc in x-mode commands command description desfire_authenticatepicc in th is procedure both the picc as well as th e mifare sam av2 device, show in an encrypted way that they posses the same secret which especially means the same key. this procedure not only confirms that both entities are permitted to do operations on each other but also creates a session key which can be used to keep the communication path secure. as the name ?session key? implicitly indicates, each time a new authentication procedure is successfully completed a new key for further cryptographic operations is obtained. desfire_changekeypicc this command genera tes the cryptogram that has to be sent to the picc in order to change any key stored in the picc. both the current and the new key need to be stored in the kst to execute this command. this means a new pi cc key needs to be loaded into the mifare sam av2, prior to issuing this command. desfire_writex write data encrypted or maced on a desfire picc. this command shall be used to issue the changekeysettings, writedata, credit, debit, limitedcredit or writerecord command. it takes the data to be sent to the desfire and applies the encryption or macing mechanism starting from an indicated index. the user is responsible for providing the correct command frame including the command code, the parameter bytes and the plain data as specified for the desfire picc. the indication from whic h position on the crypto mechanism shall be applied will normally be the first data byte of the command frame. the mifare sam av2 will automatically adapt the amount of bytes to send to the picc after encryption of data or adding the mac, respectively. desfire_readx read encrypted or maced data from the desfire picc. this command shall be used to issue the readdata, getvalue, or readrecords command. it takes the data to be sent to the desfire and applies the decryption and mac veri fication mechanism to the received data. afterwards the mifare sam av2 returns the decry pted or verified plain data. the user is responsible for providing the correct command frame including the command code and the parameter bytes as specified for the desfire pi cc. this command frame will be sent directly to the desfire. this is also the case for commands applying application chaining. ulc_ authenticatepicc the ulc_authenticatepicc comman d is needed to authenticate to a mifare ultralight c card.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 28 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 9. limiting values [1] stresses beyond those listed may cause permanent damage to t he device. these are stress ra tings only and functional operatio n of the device at these or any other conditions beyond those indicated under ?recommended operat ing conditions? is not implied. exposur e to absolute-maximum-rated conditions for extende d periods may affect device reliability. [2] mil standard 883-d method 3015; human body model; c = 100 pf, r = 1.5 k ? ; t amb = ? 25 ? c to +85 ? c. [3] depending on appropriate thermal resistance of the package. 10. characteristics table 19. limiting values [1] in accordance with the absolute maximum rating system (iec 60134). voltages are referenced to vss (ground = 0 v). symbol parameter conditions min max unit v dd supply voltage ? 0.5 +6.0 v v i input voltage on any signal pad ? 0.5 v dd +0.5 v i i input current on pads io1, io2 or io3 - ? 15.0 ma i o output current i lu latch-up current v i <0orv i >v dd - ? 100 ma v esd electrostatic discharge volt age on pads vdd, vss, clk, rst, io1, io2, io3 [2] - ? 4.0 kv on pads la, lb [2] - ? 2.0 kv p tot (pack) total power dissipation per package [3] -1 w table 20. recommended operating conditions symbol parameter conditions min typ max unit v dd supply voltage 5 v operation 4.5 5.0 5.5 v 3 v operation 2.7 3.0 3.3 v v i input voltage on digital inputs and digital i/o pads 0 - v dd v t amb ambient temperature ? 25 - +85 ?c table 21. electrical characteri stics of ic supply voltage v dd ; v ss =0v; t amb = ? 25 ? c to +85 ? c symbol parameter conditions min typ max unit v dd supply voltage class a: 5 v range 4.5 5.0 5.5 v class b: 3 v range 2.7 3.0 3.3 v
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 29 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 11. abbreviations table 22. abbreviations acronym description 2tdea 2 key tdea 3tdea 3 key tdea aes advanced encryption standard aid application identifier apdu application protocol data unit appdata application data atqa answer to request (type a) atr answer to reset ats answer to select auth mode authentication mode authent authentication cbc cipher block chaining (a block cipher mode) cid card identifier cla class cmac ciphered-based mac cmdcode command code cmdsettings command settings crc cyclic redundancy check crc16 16 bit crc crc32 32 bit crc crt chinese remainder theorem curval current value of key usage counter cwt character waiting time des data encryption standard df_aid desfire aid df_keyno desfire key number dfkeyno desfire key number div diversification divinp diversification input dri divisor receive integer dsi divisor send integer eeprom electrically erasable pr ogrammable re ad only memory ek(x) encrypted ?x? ekno(x) encrypted number ?x? fifo first in first out fips federal information processing standard fsc frame size for card fsci frame size for card integer fsd frame size for device
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 30 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 fsdi frame size for device integer fwi frame waiting time integer ins instruction code iso international organization for standardization iv initial vector (input parameter to some block cipher modes) keycompmeth key compilation method keyno key reference number keynocek key reference number of change entry key keynockuc key reference number to change the current kuc entry keynom key reference number of mifare key keyv key version keyva key (version a) keyvb key (version b) keyvc key (version c) keyvcek key version of change entry key keyvckuc key version to change the current kuc entry keyvm key version of mifare key kst key storage table (the place where the sam stores the symmetric keys and their configuration) kst key storage table kuc key usage counter lc logical channel (the iso-7816 concept) lfi last frame indicator loadreg number of register value set to be loaded lrc longitudinal redundancy check lsb least significant byte mac message authentication code mad mifare application directory mfp mifare plus mgf mask generation function msb most significant byte numcards number of cards oaep optimal asymmetric encryption padding pcd proximity coupling device picc proximity integrated circuit card pki public key infrastructure pki_kst the asymmetric counterpart of the kst: for storage of the pki keys and their configuration. pps protocol and parameter selection promas programming mask pss probabilistic signature scheme table 22. abbreviations ?continued acronym description
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 31 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 rats request for answer to select refnokuc reference number of key usage counter regaddress register address regcontent register content reqa request command, type a rfu reserved for future use rnda random number a rnda? random number a rotated left over 1 byte rndb random number b rndb? random number b rotated left over 1 byte rsa asymmetric cryptography rsaes-oaep improved encryption/decryption sch eme; based on the optimal asymmetric encryption padding scheme rsa-oaep asymmetric cryptography based on optimal asymmetric encryption padding for key agreement rsassa-pss improved probabilistic signature scheme with appendix; based on the probabilistic signature scheme sac secure authenticated channel sak select acknowledge sam secure application module mifare sam av2 one of the sam use mode sel select code set configuration settings for kst entry sha- 256 secure hash algorithm sha-1 secure hash algorithm sha-224 secure hash algorithm sl3 mifare plus security level 3 sn serial number storereg number of register value set to be stored sw status word tdea triple data encryption algorithm trng true random number generator uid unique identifier va version of key a vb version of key b vc version of key c wupa wake-up command, type a xor exclusive or table 22. abbreviations ?continued acronym description
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 32 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 12. references [1] data sheet ? p5df081 mifare sam av2 bu-id doc. no. 1645** [2] application note ? mifare desfire; implementation hints and example, bu-id doc. no. 0945** [3] iso 14443-3 ? iso/iec14443-3:2008 [4] iso 14443-4 ? iso/iec14443-4:2008 [5] data sheet ? mf1plusx0y1 mainstream contactless smart card ic for fast and easy solution development, bl-id doc. no. 1637** 1 [6] data sheet ? mf1ics50 functional specific ation, bu-id doc. no. 0010** [7] data sheet ? mf1ics20 functional specification, bu-id doc. no. 1322** [8] data sheet ? mf1ics70 functional specification, bu-id doc. no. 0435** [9] data sheet ? mf3icd81 mifare desfire f unctional specification, bu-id doc. no. 1340** [10] data sheet ? mf0icu1 functional specificat ion, bu-id doc. no. 0286** [11] data sheet ? mf0icu2 functional specificat ion, bu-id doc. no. 1376** [12] des ? data encryption standard (des), nist fips pub 46-3, october1999, http://csrc.nist.gov/publicati ons/fips/fips46-3/fips46-3.pdf [13] user manual ? mf3icd81 guidance, delivery and operation manual, bu-id doc no. 1469** [14] wafer specification ? p5cd016/021/041 and p5cx081 family, bu-id doc no. 1561** [15] pkcs1 ? pkcs #1 v2.1: rsa cryptography standard, rsa laboratories, june 2002 [16] sha ? fips 180-2: secure hash standard (shs) ? current version of the secure hash standard (sha-1, sha-224, sha-256, sha-384, and sha-512), 1 august 2002, amended 25 february 2004, fips publication [17] iso7816-2 ? iso/iec 7816-2:2002 [18] iso7816-3 ? iso/iec 7816-3:2002 [19] iso7816-4 ? iso/iec 7816-4:2004 [20] aes ? fips197 [21] iso 10116 ? iso/iec 10116 block cipher [22] cmac ? recommendation for block cipher modes of operation: the cmac mode for authentication, nist special publication 800-38b, may 2005, http://csrc.nist.gov/ publications/nistpubs/8 00-38b/sp_800-38b.pdf [23] cmac errata ? recommendation for block cipher modes of operation: the cmac mode for authentication, nist special publication 800-38b, errata, http://csrc.nist.gov/public ations/nistpubs/800-38b/up dated_cmac_examples.pdf 1. ** ... document version number
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 33 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 [24] bc-methods ? recommendation for block cipher modes of operation - methods and techniques, nist special publication 800-38a, december 2001, http://csrc.nist.gov/ publications/nistpubs/8 00-38a/sp800-38a.pdf [25] nist special publication 800-38a ? recommendation for block cipher modes of operation: methods and techniques, 2001. [26] nist special publication 800-38b ? recommendation for block cipher modes of operation: the cmac mode for authentication [27] iso/iec standard ? iso/iec 14443 identification cards - contactless integrated circuit cards - proximity cards [28] recommendation for block cipher modes of operation: methods and techniques ? fips pub 197 advanced encryption standard [29] iso/iec standard ? iso/iec 9797-1 information technology -- security techniques - message authentication code s (macs) - part 1: mechanisms using a block cipher [30] aes ? recommendation for the triple data encryption algorithm (tdea) block cipher, nist special publication 800-67, may 2008, http://csrc.nist.gov/ publications/nistpubs/ 800-67/sp800-67.pdf 13. revision history table 23: revision history document id release date data sheet status change notice supersedes p5df081_sds v.3.2 20131217 product short data sheet - p5df081_sds v.3.1 modifications: ? figure 3 ? pin configuration hvqfn32 ? : remark added ? section 12 ? references ? : updated p5df081_sds v.3.1 20121001 product short data sheet - p5df081_sds v.3.0 modifications: ? section 7.1 ?pinning? : updated p5df081_sds v.3.0 20111018 product short data sheet - p5df081_sds v.1.0 modifications: ? section 1 ?general description? and se ction 5 ?ordering information?: updated ? ?rc522? updated with ?rc52x or rc663? ? data sheet status changed into ?product short data sheet? p5df081_sds v.1.0 20100812 objective short data sheet - -
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 34 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 14. legal information 14.1 data sheet status [1] please consult the most recently issued document before initiating or completing a design. [2] the term ?short data sheet? is explained in section ?definitions?. [3] the product status of device(s) described in this document may have changed since this document was published and may differ in case of multiple device s. the latest product status information is available on the internet at url http://www.nxp.com . 14.2 definitions draft ? the document is a draft versi on only. the content is still under internal review and subject to formal approval, which may result in modifications or additions. nxp semiconductors does not give any representations or warranties as to the accuracy or completeness of information included herein and shall hav e no liability for the consequences of use of such information. short data sheet ? a short data sheet is an extract from a full data sheet with the same product type number(s) and title. a short data sheet is intended for quick reference only and should not be relied upon to contain detailed and full information. for detailed and full information see the relevant full data sheet, which is available on request vi a the local nxp semiconductors sales office. in case of any inconsistency or conflict with the short data sheet, the full data sheet shall prevail. product specification ? the information and data provided in a product data sheet shall define the specification of the product as agreed between nxp semiconductors and its customer , unless nxp semiconductors and customer have explicitly agreed otherwis e in writing. in no event however, shall an agreement be valid in which the nxp semiconductors product is deemed to offer functions and qualities beyond those described in the product data sheet. 14.3 disclaimers limited warranty and liability ? information in this document is believed to be accurate and reliable. however, nxp semiconductors does not give any representations or warranties, expressed or implied, as to the accuracy or completeness of such information and shall have no liability for the consequences of use of such info rmation. nxp semiconductors takes no responsibility for the content in this document if provided by an information source outside of nxp semiconductors. in no event shall nxp semiconductors be liable for any indirect, incidental, punitive, special or consequential damages (including - without limitation - lost profits, lost savings, business interruption, costs related to the removal or replacement of any products or rework charges) whether or not such damages are based on tort (including negligence), warranty, breach of contract or any other legal theory. notwithstanding any damages that customer might incur for any reason whatsoever, nxp semiconductors? aggregate and cumulative liability towards customer for the products described herein shall be limited in accordance with the terms and conditions of commercial sale of nxp semiconductors. right to make changes ? nxp semiconductors reserves the right to make changes to information published in this document, including without limitation specifications and product descriptions, at any time and without notice. this document supersedes and replaces all information supplied prior to the publication hereof. suitability for use ? nxp semiconductors products are not designed, authorized or warranted to be suitable for use in life support, life-critical or safety-critical systems or equipment, nor in applications where failure or malfunction of an nxp semiconductors product can reasonably be expected to result in personal injury, death or severe property or environmental damage. nxp semiconductors and its suppliers accept no liability for inclusion and/or use of nxp semiconducto rs products in such equipment or applications and therefore such inclusion and/or use is at the customer?s own risk. applications ? applications that are described herein for any of these products are for illustrative purpos es only. nxp semiconductors makes no representation or warranty that such applications will be suitable for the specified use without further testing or modification. customers are responsible for the design and operation of their applications and products using nxp semiconductors products, and nxp semiconductors accepts no liability for any assistance with applications or customer product design. it is customer?s sole responsibility to determine whether the nxp semiconductors product is suitable and fit for the customer?s applications and products planned, as well as fo r the planned application and use of customer?s third party customer(s). customers should provide appropriate design and operating safeguards to minimize the risks associated with their applications and products. nxp semiconductors does not accept any liability related to any default, damage, costs or problem which is based on any weakness or default in the customer?s applications or products, or the application or use by customer?s third party customer(s). customer is responsible for doing all necessary testing for the customer?s applic ations and products using nxp semiconductors products in order to av oid a default of the applications and the products or of the application or use by customer?s third party customer(s). nxp does not accept any liability in this respect. limiting values ? stress above one or more limiting values (as defined in the absolute maximum ratings system of iec 60134) will cause permanent damage to the device. limiting values are stress ratings only and (proper) operation of the device at these or any other conditions above those given in the recommended operating conditions section (if present) or the characteristics sections of this document is not warranted. constant or repeated exposure to limiting values will permanently and irreversibly affect the quality and reliability of the device. terms and conditions of commercial sale ? nxp semiconductors products are sold subject to the gener al terms and conditions of commercial sale, as published at http://www.nxp.com/profile/terms , unless otherwise agreed in a valid written individual agreement. in case an individual agreement is concluded only the terms and conditions of the respective agreement shall apply. nxp semiconductors hereby expressly objects to applying the customer?s general terms and conditions with regard to the purchase of nxp semiconducto rs products by customer. no offer to sell or license ? nothing in this document may be interpreted or construed as an offer to sell products t hat is open for acceptance or the grant, conveyance or implication of any lic ense under any copyrights, patents or other industrial or intellectual property rights. document status [1] [2] product status [3] definition objective [short] data sheet development this document contains data from the objecti ve specification for product development. preliminary [short] data sheet qualification this document contains data from the preliminary specification. product [short] data sheet production this document contains the product specification.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 35 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 export control ? this document as well as the item(s) described herein may be subject to export control regu lations. export might require a prior authorization from competent authorities. quick reference data ? the quick reference data is an extract of the product data given in the limiting values and characteristics sections of this document, and as such is not comple te, exhaustive or legally binding. non-automotive qualified products ? unless this data sheet expressly states that this specific nxp semicon ductors product is automotive qualified, the product is not suitable for automotive use. it is neither qualified nor tested in accordance with automotive testing or application requirements. nxp semiconductors accepts no liabili ty for inclusion and/or use of non-automotive qualified products in automotive equipment or applications. in the event that customer uses t he product for design-in and use in automotive applications to automotive specifications and standards, customer (a) shall use the product without nxp semiconductors? warranty of the product for such automotive applicat ions, use and specifications, and (b) whenever customer uses the product for automotive applications beyond nxp semiconductors? specifications such use shall be solely at customer?s own risk, and (c) customer fully in demnifies nxp semi conductors for any liability, damages or failed product claims resulting from customer design and use of the product for automotive appl ications beyond nxp semiconductors? standard warranty and nxp semicond uctors? product specifications. 14.4 licenses 14.5 trademarks notice: all referenced brands, produc t names, service names and trademarks are the property of their respective owners. mifare ? is a trademark of nxp b.v. mifare plus ? is a trademark of nxp b.v. mifare ultralight ? is a trademark of nxp b.v. desfire ? is a trademark of nxp b.v. smartmx ? is a trademark of nxp b.v. 15. contact information for more information, please visit: http://www.nxp.com for sales office addresses, please send an email to: salesaddresses@nxp.com ics with dpa countermeasures functionality nxp ics containing functionality implementing countermeasures to differential power analysis and simple power analysis are produced and sold under applicable license from cryptography research, inc.
p5df081_sds all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product short data sheet company public rev. 3.2 ? 17 december 2013 191732 36 of 37 nxp semiconductors p5df081 mifare secure access module sam av2 16. tables table 1. quick reference data . . . . . . . . . . . . . . . . . . . . .2 table 2. ordering information . . . . . . . . . . . . . . . . . . . . .2 table 3. pin description pcm 1.1 mifare sam av2 . . .5 table 4. pin description hvqfn32 mifare sam av2 . .6 table 5. atr after cold reset . . . . . . . . . . . . . . . . . . . . . .7 table 6. atr after warm reset . . . . . . . . . . . . . . . . . . . . .8 table 7. sam security and configuration commands . .15 table 8. sam key management commands . . . . . . . . .17 table 9. data processing commands . . . . . . . . . . . . . .18 table 10. public key infrastructure (pki) commands. . . .20 table 11. mifare plus in non-x mode commands . . . . .21 table 12. mifare classic in non-x-mode commands. . .22 table 13. desfire and ulc in non-x-mode commands . 22 table 14. rc522x or rc663 configuration commands . . 23 table 15. iso14443 commands . . . . . . . . . . . . . . . . . . . 23 table 16. mifare classic in x-mode commands . . . . . 24 table 17. mifare plus in x-mode commands . . . . . . . . 26 table 18. desfire and ulc in x-mode commands . . . . 27 table 19. limiting values [1] . . . . . . . . . . . . . . . . . . . . . . . 28 table 20. recommended operating conditions . . . . . . . 28 table 21. electrical characteristics of ic supply voltage . 28 table 22. abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . 29 table 23: revision history . . . . . . . . . . . . . . . . . . . . . . . . 33 17. figures fig 1. block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . .4 fig 2. pin configuration pcm1.1 . . . . . . . . . . . . . . . . . . .5 fig 3. pin configuration hvqfn32 . . . . . . . . . . . . . . . . .5
nxp semiconductors p5df081 mifare secure access module sam av2 ? nxp b.v. 2013. all rights reserved. for more information, please visit: http://www.nxp.com for sales office addresses, please se nd an email to: salesaddresses@nxp.com date of release: 17 december 2013 191732 please be aware that important notices concerning this document and the product(s) described herein, have been included in section ?legal information?. 18. contents 1 general description . . . . . . . . . . . . . . . . . . . . . . 1 2 features and benefits . . . . . . . . . . . . . . . . . . . . 1 2.1 cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2.2 communication. . . . . . . . . . . . . . . . . . . . . . . . . 2 2.3 delivery types . . . . . . . . . . . . . . . . . . . . . . . . . . 2 3 applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 4 quick reference data . . . . . . . . . . . . . . . . . . . . . 2 5 ordering information . . . . . . . . . . . . . . . . . . . . . 2 6 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 4 7 pinning information . . . . . . . . . . . . . . . . . . . . . . 5 7.1 pinning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 7.2 pinning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 7.3 pin description . . . . . . . . . . . . . . . . . . . . . . . . . 5 8 functional specification . . . . . . . . . . . . . . . . . . 7 8.1 hardware interface . . . . . . . . . . . . . . . . . . . . . . 7 8.1.1 contact interface. . . . . . . . . . . . . . . . . . . . . . . . 7 8.1.2 external clock frequency and bit rates . . . . . . . 7 8.1.3 card operation procedures . . . . . . . . . . . . . . . . 7 8.2 transmission procedure and communication . . 7 8.2.1 protocol activation sequence . . . . . . . . . . . . . . 7 8.2.1.1 answer to reset (atr) . . . . . . . . . . . . . . . . . . 7 8.2.1.2 protocol and parameter selection (pps exchange) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 8.2.2 protocol t = 1 . . . . . . . . . . . . . . . . . . . . . . . . . . 9 8.2.3 apdu structure. . . . . . . . . . . . . . . . . . . . . . . . . 9 8.2.4 uid/serial number. . . . . . . . . . . . . . . . . . . . . . . 9 8.3 mifare sam av1 compatibility mode vs. mifare sam av2 mode . . . . . . . . . . . . . . . . . 9 8.4 cryptography and key handling . . . . . . . . . . . 10 8.4.1 cryptography . . . . . . . . . . . . . . . . . . . . . . . . . 10 8.4.1.1 symmetric key cryptography . . . . . . . . . . . . . 10 des and tdea. . . . . . . . . . . . . . . . . . . . . . . . .10 aes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10 aes macing. . . . . . . . . . . . . . . . . . . . . . . . . . .10 mifare classic . . . . . . . . . . . . . . . . . . . . . . . .10 8.4.1.2 asymmetric ke y cryptography (mifare sam av2 mode only) . . . . . . . . . . . . . . . . . . . 10 8.4.2 key diversification. . . . . . . . . . . . . . . . . . . . . . 11 8.4.3 key storage (mifare sam av1 compatibility mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 8.4.3.1 symmetric keys . . . . . . . . . . . . . . . . . . . . . . . 11 8.4.4 key storage (mifare sam av2 mode) . . . . . 12 8.4.4.1 symmetric keys . . . . . . . . . . . . . . . . . . . . . . . 12 8.4.4.2 asymmetric keys . . . . . . . . . . . . . . . . . . . . . . 12 8.4.5 key versioning . . . . . . . . . . . . . . . . . . . . . . . . 13 8.4.6 key usage counters . . . . . . . . . . . . . . . . . . . . 13 8.4.6.1 reference number . . . . . . . . . . . . . . . . . . . . . 13 8.4.6.2 limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 8.4.6.3 key reference number to change the current kuc entry . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 8.4.6.4 key version to change the current kuc entry 13 8.4.6.5 current value . . . . . . . . . . . . . . . . . . . . . . . . . 13 8.5 sam - host communication . . . . . . . . . . . . . . 13 8.5.1 general principles for sam-host protection. . 13 8.5.2 mifare sam av1 compatibility mode sam-host protection . . . . . . . . . . . . . . . . . . . 14 8.5.2.1 increased security - cmac calculation . . . . . 14 8.5.3 mifare sam av2 mode sam-host protection . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 8.6 mifare sam av2 command set. . . . . . . . . . 15 8.6.1 sam security and configuration commands. . 15 8.6.2 sam key management commands . . . . . . . . 17 8.6.3 data processing commands . . . . . . . . . . . . . 18 8.6.4 public key infrastructure (pki) commands . . 20 8.6.5 mifare plus in non-x-mode commands . . . 21 8.6.6 mifare classic in non-x-mode commands . 22 8.6.7 desfire and ulc in non-x-mode commands 22 8.6.8 rc52x or rc663 configuration commands . . 23 8.6.9 iso14443 commands . . . . . . . . . . . . . . . . . . 23 8.6.10 mifare classic in x-mode commands . . . . . 24 8.6.11 mifare plus in x-mode commands . . . . . . . 26 8.6.12 desfire and ulc in x-mode commands . . . 27 9 limiting values . . . . . . . . . . . . . . . . . . . . . . . . 28 10 characteristics . . . . . . . . . . . . . . . . . . . . . . . . 28 11 abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . 29 12 references. . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 13 revision history . . . . . . . . . . . . . . . . . . . . . . . 33 14 legal information . . . . . . . . . . . . . . . . . . . . . . 34 14.1 data sheet status . . . . . . . . . . . . . . . . . . . . . . 34 14.2 definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 14.3 disclaimers . . . . . . . . . . . . . . . . . . . . . . . . . . 34 14.4 licenses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 14.5 trademarks . . . . . . . . . . . . . . . . . . . . . . . . . . 35 15 contact information . . . . . . . . . . . . . . . . . . . . 35 16 tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 17 figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 18 contents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

▲Up To Search▲

Price & Availability of P5DF081HN

	To Download P5DF081HN Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .