8

AT88RF020

2010C–RFID–2/06

field is ignored for obvious reasons, since it would normally point to memory Page 0,

which contains the embedded PUPI (serial number) and the actual LockBits field.

A command to lock Page 0 with password access will result in an ACK command being

issued with no other effects, since Page 0 can never be locked. Attempting to lock Page

0 is not viewed as an error, so the command will be executed in the normal manner.

CHECK PASSWORD

Command

The 64-bit value embedded within the CHECK PASSWORD command is compared to

the password stored within Page 3 of the memory (See Memory Map, Table 1 on page

2). If the input password matches the stored password, then the chip will reply with an

ACK command, and the device will be open to access. If the input password does not

match the internally stored password, then the chip will reply with a NACK command.

This command must be executed (and the proper password sent) before most device

accesses are allowed (some accesses are permitted without password validation). The

chip will remain accessible until power is removed or an incorrect password is sent to

the chip. If a subsequent password check fails, the chip will become inaccessible until a

valid password check is again executed.

Once the password has been properly acknowledged and device access opened, the

current password can be changed using the WRITE command. The device will remain

ACTIVE after the new password has been written until power is removed or until a sub-

sequent invalid password check occurs.

The only password that is not allowed is the “all ones” password. If the CHECK PASS-

WORD command is attempted for an “all ones” password, the device will respond with a

NACK command. If the “all ones” password is validly programmed into this device using

the WRITE command, the device will forever be locked out of future password validated

accesses.

It is strongly suggested that the “all zeroes” password be avoided since this password is

considered too simplistic and could represent a security risk. The device is delivered

with all zeros in the password page.

DESELECT Command

If the DESELECT command is properly received and the PICC is in the ACTIVE state,

the PICC will issue an ACK command and enter the HALT state. Its functionality is iden-

tical to HLTB as described in the anticollision section. A NACK response is never issued

following this command (see ISO 14443-3, section 7.4.7).

COUNT Command

The COUNT command is used to write Page 2. The first six bytes sent by the PCD

(referred to as the Signature) are written to the first six bytes of Page 2 unmodified. The

last two bytes of data sent by the PCD in the COUNT command are only placeholders

and will be ignored.

The 16-bit value stored in the counter field of Page 2 is incremented by one each time

COUNT is executed. Once the value of the counter reaches 0x8000, no further count

operations will be executed, and Page 2 will be effectively locked against further modifi-

cation. Password validation must occur before the COUNT command is permitted.

The chip will compute the new incremented count that will be written into the last two

bytes of Page 2 immediately following the incoming 6-byte data field. It is expected that

at least part of the 6-byte value will be the result of an externally computed crypto-

graphic operation on the new Counter value, thus permitting some degree of transaction

validation.