mifare DESFire & ISO14443

Transcription

1 mifare DESFire & ISO14443 CAS - 26

2 mifare DESFire & ISO14443 Agenda mifare DESFire Type ID mifare DESFire ATQA mifare DESFire SAK mifare DESFire UID ISO14443A RATS & PPS mifare DESFire (R)ATS mifare DESFire PPS (Request) Block Exchange via T=CL Semiconductors 2

3 mifare DESFire Type ID ATQA PCD Start REQA ATQA PICC SAK UID NO Proprietary frames and protocol Bit frame ant collision supported? YES Anticollision Loop UID + SAK ISO A MIFARE Classic NO SAK bit 6 = 1? YES ISO (T=CL) Semiconductors 3

4 mifare DESFire ATQA Coding MSB ATQA LSB ATQA Bit no ISO/IEC 14443A-3 RFU 1 Proprietary coding UID size RFU 1 Bit frame anticollision 212 kbit/s kbit/s kbit/s 1 Single UID Double UID 1 Triple UID 1 RFU 1 1 Bit Frame Anticollision 1 Bit Frame Anticollision 1 Bit Frame Anticollision 1 Bit Frame Anticollision 1 Bit Frame Anticollision 1 ATQA of mifare ICs MIFARE UL (x44) 1 1 MIFARE 1K (x4) 1 MIFARE 4K (x2) 1 MIFARE DESFire (x344) MIFARE ProX X 2 X 2 X 2 X 2 X 2 X 2 X 2 1 A lrfu bits shalbe setto 2 Depends on OS Semiconductors 4

5 mifare DESFire SAK Coding SAK bit values as defined in the ISO/IEC 14443A-3 SAK Bit no Cascade bit set: UID not complete x 1 UID complete, PICC compliant with ISO/IEC UID complete, PICC not compliant with ISO/IEC SAK of mifare ICs MIFARE ultralight (x4) cascade level 1 1 MIFARE ultralight (x) cascade level 2 MIFARE 1K (x8) 1 MIFARE 4K (x18) 1 1 MIFARE DESFire (x24) cascade level MIFARE DESFire (x2) cascade level 2 1 MIFARE ProX x 1 x 1 x 1 x 1 1 Depends on OS Semiconductors 5

6 mifare DESFire UID Coding UID size Single PCD 93 PICC UID UID1 UID2 UID3 BCC ISO/IEC 14443A3 Double PCD PICC CT UID UID1 UID2 BCC UID3 UID4 UID5 UID6 BCC Triple PCD PICC CT UID UID1 UID2 BCC CT UID3 UID4 UID5 BCC UID6 UID7 UID8 UID9 BCC Double or Triple Size UIDs: ISO UID UID1 UID6 (resp. UID1 - UID9) Manufacturer ID according to the ISO/IEC /AM1 Each manufacturer is responsible for the uniqueness of the value of the other bytes of the unique number. Philips x4 x PCD DESFire PICC x88 x4 xx xx xx xx xx xx xx xx mifare DESFire Semiconductors 6

7 ISO14443A RATS & PPS PCD mifare DESFire PICC selected Request for Answer to Select (RATS) PICC Answer To Select (ATS) PPS = Protocol Parameter Select NO NO PPS supported? YES Reader PPS? YES Set parameter PPS Request PPS Response Exchange Transparent Data ISO Semiconductors 7

8 Request for Answer To Select (RATS) mifare DESFire (R)ATS FSD: Maximum frame size supported by the PCD: FSDI F FSD RFU CID: Logical number of the addressed PICC ( 14) FSDI CID b8 b7 b6 b5 b4 b3 b2 b1 ATS (next slides) PCD Command CMD 'E' ARG 'XX' C CRC C1 Note: Times units are not drawn to scale! MF3 IC D4 '6' '75' '33' '62' '2' 'XX' C C1 time Response TL T TA(1) TB(1) TC(1) T1 CRC 36µs 8µs 149 Semiconductors 8

9 ATS 1: Length Byte TL T Length Byte Format Byte TL TA(1) TB(1) TC(1) T1 Tk CRC1 CRC2 Interface Bytes Optional Historical Bytes Optional ISO/IEC specifies the content Semiconductors 9

10 ATS 2: Format Byte T TL T FSCI Format Byte TA(1) TB(1) TC(1) T1 Tk CRC1 CRC2 FSCI to FSC conversion FSC defines the maximum size of the PICC receive buffer. FSCI Frame Size for proximity Card Integer FSC Frame Size for proximity Card Semiconductors 1

11 ATS 3: Interface Byte TA(1) TL T Bit 2 DR=8 (848 kbaud) supported, if bit is set to 1 Bit 1 DR=4 (424 kbaud) supported, if bit is set to 1 Bit DR=2 (212 kbaud) supported, if bit is set to 1 TA(1) D DS DR TB(1) TC(1) T1 Bit 6 DS=8 (848 kbaud) supported, if bit is set to 1 Bit 5 DS=4 (424 kbaud) supported, if bit is set to 1 Bit 4 DS=2 (212 kbaud) supported, if bit is set to 1 Tk Bit 7.. Different D for each direction supported 1.. Only the same D for both directions supported. CRC1 CRC2 DR Divisor Receive (PCD -> PICC) DS Divisor Send (PICC -> PCD) Semiconductors 11

12 ATS 4: Interface Byte TB(1) TL T TA(1) Frame Waiting Time: Frame sent by PCD t < FWT Frame sent by PICC TB(1) FWI SFGI TC(1) T1 Tk CRC1 CRC2 FWT = (256 x 16 / fc) x 2 FWI Example: FWT MIN = : (256 x 16 / 13,56 * 1 6 ) x 1 FWI Frame Waiting Time Integer FWT Frame Waiting Time 32 μs FWT = 4: (256 x 16 / 13,56 * 1 6 ) x μs FWT = 9: (256 x 16 / 13,56 * 1 6 ) x ms FWT MAX =14: (256 x 16 / 13,56 * 1 6 ) x ms Semiconductors 12

13 ATS 5: Interface Byte TA(1) TL T TA(1) TB(1) TC(1) ATS sent by PICC FWI SFGI Start-up Frame Guard Time: t > SFG SFG = (256 x 16 / fc) x 2 SFGI Frame sent by PCD T1 Tk CRC1 CRC2 SFGI Start-up Frame Guard Time Integer SFG Start-up Frame Guard Time Semiconductors 13

14 ATS 6: Interface Byte TC(1) TL T TA(1) TB(1) TC(1) T1 Tk Bit NAD supported, if bit is set to 1 Bit 1 CID supported, if bit is set to 1 CRC1 CRC2 CID Card Identifier NAD Node Address Semiconductors 14

15 Answer To Select (ATS) mifare DESFire ATS '6' '75' '33' '62' '2' 'XX' C C1 TL T TA(1) TB(1) TC(1) T1 CRC T1: Historical character : shall be ignored by the application software. Interface byte TC(1) : CID supported, NAD not supported Interface byte TB(1) : High Nibble: Frame Waiting Time (FWT) (77.33 ms) Low Nibble: Start-up frame guard time (SFGT) (64 μs) Interface byte TA(1) : possible data rates supported by the PICC. (The DESFire supports up to 424 kbaud in both directions.) T: Format Byte High Nibble: presence of TA(1), TB(1) and TC(1) Low Nibble: FSCI (maximum accepted size of a frame) TL: Length Byte of the transmitted ATS (including itself, but excluding the two CRC bytes) Semiconductors 15

16 Protocol Parameter Selection Request mifare DESFire PPS (Request( Request) CMD CMD (PPSS) (PPSS) RFU RFU CID CID b8 b8 b7 b7 b6 b6 b5 b5 b4 b4 b3 b3 b2 b2 b1 b PPS: PPS1 follows PPS: PPS1 follows PCD Command CMD 'DX' '11' ARG '' C CRC C1 MF3 IC D4 'D' C C1 time Response PPSS CRC PPS1 PPS1 RFU RFU DSI DSI DRI DRI b8 b8 b7 b7 b6 b6 b5 b5 b4 b4 b3 b3 b2 b2 b1 b1 DSI, DRI * 1 1 Divisor Baudrate 16kBd 212kBd 424kBd * (16 kbaud in both directions) is the default if no PPS command is sent Semiconductors 16

17 Block Structure of T=CL FSD... Frame Size for PCD FSC... Frame Size for PICC Semiconductors 17

18 Protocol Control Byte 1 b8 b7 b6 b5 b4 b3 b2 b1 Information Block (I-Block) Exchange of Application Data Units (APDUs) 1 Receive Ready Block (R-Block) ACK or NACK (containing no INF Field) 1 1 Supervisor Block (S-Block) Waiting Time Extension (contains 1 INF Field) Deselect (containing no INF Field) Semiconductors 18

19 Protocol Control Byte 2 b8 b7 b6 b5 b4 b3 b2 b1 1 Bit 1 Block Number Bit 3 NAD following, if bit is set to 1 Bit 4 CID following, if bit is set to 1 Bit 4 Chaining, if bit is set to 1 PCD t < FWT t < FWT I-Block () (Command APDU) I-Block () (Response APDU) I-Block () 1 (Command APDU) I-Block () 1 (Response APDU) PICC ISO/IEC Part 4 I-Block () X I-Block (1) X I-Block with chaining bit not set and block number X I-Block with chaining bit set and block number X Semiconductors 19

20 mifare DESFire Block Exchange Example of Block Exchange Prologue Field Information Field Epilogue Field PCB [CID] [NAD] [INF] EDC no of bytes: 1 1 max. 6 2 no of bytes: 1 1 max If CID =, no CID byte is sent a 2 6a xx xx PCB EDC: CRC according to ISO14443A CID CMD: GetApplicationIDs() Semiconductors 2

21 mifare DESFire command example Example: - Write 2 Bytes of x ff ff into a - DES encrypted DataFile with - File number 1 -CID 4 Assumption: Assumption: The The DESFire DESFire PICC PICC is is selected, selected, RATS RATS is is performed performed with with CID CID = = The The according according application application (whatever (whatever number) number) ist ist selected, selected, and and the the authentication authentication with with the the according according key key is is performed. performed. a 4 3d d6 cc 98 9f b2 4b 63 b8 PCB CID File # Offset Length (3)DES deciphered data EDC (CRC) CMD: WriteData(FileNo,Offset,Length) Semiconductors 21

22