P5DF081_SDS

All information provided in this document is subject to legal disclaimers.

© NXP B.V. 2010. All rights reserved.

Objective short data sheet

PUBLIC

Rev. 1 — 12 August 2010

191710

20 of 36

NXP Semiconductors

P5DF081

MIFARE SAM AV2

8.6.6 MIFARE Classic in non-X-mode commands

The commands in this section can both be used to execute a transaction with a MIFARE

Classic card and with a MIFARE Plus card in SL2. In the second case,

SAM_AuthenticateMIFARE is to be used after SAM_AuthenticateMFP to complete a MFP

SL2 authentication.

In both cases, after the authentication, the other SAM_xxxMIFARE commands and the

data processing commands SAM_Decipher_Data and SAM_Encipher_Data can be used

for further processing.

8.6.7 DESFire and ULC in non-X-mode commands

Table 11.

MIFARE Classic in non-X-mode commands

Command

Description

SAM_Authenticate

MIFARE

n this procedure, both the MIFARE card as well as the MIFARE SAM AV2 device show in an

encrypted way that they posses the same secret which especially means the same key.

SAM_ChangeKey

MIFARE

AV1 compatibility mode

This command is intended to change a key in a MIFARE card. The command offers the possibility to

prepare an encrypted stream to be written to a MIFARE 1k or MIFARE 4k card containing the desired

keys and the given access conditions on the one hand and reading out a single MIFARE key to be

used for any kind of MIFARE transaction in a host system directly on the other hand. In the latter case,

the key can be retrieved encrypted from the MIFARE SAM AV2 using the current available session key

of the channel (host authentication required). The first case requires an active MIFARE authentication

for producing the stream to be sent to the card.AV2 mode (used for key retrieval)

In MIFARE SAM AV2 mode, the existing command, SAM_ChangeKeyMIFARE (used for key retrieval),

can still be used to retrieve a PICC Key of key type 010, i.e. a MIFARE Classic key.

The use of this command to change keys on MIFARE Classic cards is the same as the one described

for the AV1 compatibility mode.

The only difference with AV1 is that whether the secret key is retrieved in plain or encrypted

depends on the SAM-Host protection mode of the logical channel.

Table 12.

DESFire and ULC in non-X-mode commands

Command

Description

SAM_AuthenticatePICC

In this procedure both the PICC as well as the MIFARE SAM AV2 device show in an

encrypted way that they posses the same secret which especially means the same

key. This procedure not only confirms that both entities are permitted to do operations

on each other but also creates a session key which can be used to keep the further

communication path secure. As the name ‘session key’ implicitly indicates, each time

a new authentication procedure is successfully completed a new key for further

cryptographic operations is obtained.

SAM_IsoAuthenticatePICC

The ISO authentication procedure is intended to authenticate with a card using the

standard ISO commands GetChallenge, ExternalAuthenticate and

InternalAuthenticate. This authentication procedure can be used to authenticate a

DESFire PICC but also another MIFARE SAM AV2. However, the MIFARE SAM AV2

will treat the authentication procedure as a PICC authentication, which means that

commands requiring a host authentication will not be available.

SAM_ChangeKeyPICC

This command generates the cryptogram that has to be sent to the PICC in order to change

any key stored in the PICC. Both the current and the new key need to be stored in the KST to

execute this command. This means a new PICC key needs to be loaded into the MIFARE SAM

AV2, prior to issuing this command.