P5DF081HN/T1AD2060 NXP Semiconductors, P5DF081HN/T1AD2060 Datasheet
P5DF081HN/T1AD2060
Specifications of P5DF081HN/T1AD2060
Related parts for P5DF081HN/T1AD2060
P5DF081HN/T1AD2060 Summary of contents
Page 1
P5DF081 MIFARE SAM AV2 Rev. 1 — 12 August 2010 191710 1. General description The NXP MIFARE SAM TM AV2 hardware solution is the ideal add-on for reader devices offering additional security services. Supporting TDEA, AES and RSA capabilities, it ...
Page 2
... Loyalty programs Micro payment 4. Quick reference data Table Symbol Ordering information Table 2. Type number P5DF081X0/T1AD2060 P5DF081HN/T1AD2060 P5DF081_SDS Objective short data sheet PUBLIC Quick reference data = +85 C amb Parameter Conditions supply voltage Class range Class range Ordering information ...
Page 3
Block diagram IO1 PROGRAMMABLE UART IO2 IO1, IO2, IO3 ISO 7816 IO3 CLOCK CLOCK CLK FILTER GENERATION SECURITY SENSORS RST_N RESET GENERATION VOLTAGE REGULATOR VDD VSS Fig 1. Block diagram ROM EEPROM RAM 80 kB DATA AND 264 kB ...
Page 4
... NXP Semiconductors 7. Pinning information 7.1 Pinning Fig 2. Pin configuration 7.2 Pin description Table 3. ISO/IEC 7816 Pad Symbol C1 VCC C2 RST C3 CLK C4 reserved C5 GND C6 VPP C7 IO1 C8 reserved 8. Functional specification 8.1 Hardware interface 8.1.1 Contact interface The pad assignment and the electrical characteristics are fully compliant with ISO/IEC 7816 (part 2 and part 3) ...
Page 5
... NXP Semiconductors The maximum specified bit rate in any case is 1.5 Mbit/s. 8.1.3 Card operation procedures All card operation procedures (activation, cold reset, warm reset and deactivation) are fully compliant with 8.2 Transmission procedure and communication 8.2.1 Protocol activation sequence All subsequently described operations are compliant with ISO/IEC 7816-3. ...
Page 6
... NXP Semiconductors Table 5. Character TS T0 TA(1) TC(1) TD(1) TA(2) TD(2) TA(3) TB(3) TC(3) TD(3) TA(after T = 15) TB(after T = 15) Historical bytes TCK After every future warm reset, the mode of operation and therefore also the ATR is toggled with the ATR after cold reset. ...
Page 7
... NXP Semiconductors 8.2.4 UID/serial number The MIFARE SAM AV2 IC features a 7 byte unique serial number that is programmed into a locked part of the non-volatile memory that is reserved for the manufacturer. This UID is fixed and cannot be changed. 8.3 MIFARE SAM AV1 compatibility mode vs. MIFARE SAM AV2 mode Unless stated explicitly otherwise, all information in this document refer to both the MIFARE SAM AV1 compatibility mode and to the pure MIFARE SAM AV2 mode ...
Page 8
... NXP Semiconductors 8.4 Cryptography and key handling 8.4.1 Cryptography AV1 compatibility mode supports symmetric key cryptographic algorithms while MIFARE SAM AV2 mode supports both symmetric and asymmetric cryptography. 8.4.1.1 Symmetric key cryptography MIFARE SAM AV2 offers support in several commands for various symmetric key cryptographic algorithms ...
Page 9
... NXP Semiconductors RSA signature generation and verification: AV2 support RSA signature handling used by the PKI_GenerateSignature, PKI_VerifySignatures and PKI_UpdateKeyEntries commands. The supported algorithm is RSASSA-PSS (see commands expect the already hashed message mHash as input. The initial hash operation (Step 1 and 2 of EMSA-PSS-Encode and EMSA-PSS-Verify, calculated by this function ...
Page 10
... NXP Semiconductors 8.4.4 Key Storage (MIFARE SAM AV2 mode) MIFARE SAM AV2 in MIFARE SAM AV2 mode can store both symmetric and asymmetric keys. 8.4.4.1 Symmetric keys MIFARE SAM AV2 can store up to 128 symmetric keys versions (only 2 versions possible for 3TDEA keys and AES-192 keys) There only difference in the content of a key entry compared to AV1 compatibility mode is the addition of an ExtSET byte with extended configuration settings, as can be seen in Table 14 ...
Page 11
... NXP Semiconductors 8.4.5 Key versioning The MIFARE SAM AV2 reserves three bytes in a key entry to store the version of the three available keys in the entry. This version byte contains the key version for all kinds of keys (DES, TDEA, AES and MIFARE). The version information must be included separately in every key entry of type AES or MIFARE when it is updated by the ChangeKeyEntry command ...
Page 12
... NXP Semiconductors or AES192 key. During this activation authentication, the maximal message size under command chaining (MaxChainBlocks) is set. Once switched to MIFARE SAM AV2 mode there is no mean to switch back. When the MIFARE SAM AV2 mode is activated, the Key Storage Table (except the SAM Master Key) gets reset ...
Page 13
... NXP Semiconductors 8.6 MIFARE SAM AV2 command set For better readability of the following command descriptions, the logical channel number of the CLA byte is set to default 00b. 8.6.1 SAM security and configuration commands Table 6. SAM security and configuration commands Command Description SAM_DisableCrypto This command allows the permanent and irreversible disabling of the cryptographic functionality of the MIFARE SAM AV2 ...
Page 14
... NXP Semiconductors Table 6. SAM security and configuration commands Command Description SAM_IsoGetChallenge/ AV1 compatibility mode SAM_GetRandom In AV1 compatibility mode, this is the first part of an ISO compliant authentication sequence returning a random number. The command can obviously also be used for simply generating a random number but it has to be taken into account that the MIFARE SAM AV2 internally is set into a state indicating that an authentication procedure is ongoing, if the requested random number length is 8 byte or 16 byte ...
Page 15
... NXP Semiconductors 8.6.2 SAM key management commands Table 7. SAM key management commands Command Description AV1 compatibility mode SAM_ChangeKeyEntry This command updates any key entry of the KST. The complete data set of the full key entry must always be sent, and it will be programmed to the non-volatile memory of the MIFARE SAM AV2 as defined in the non-volatile ProMas ...
Page 16
... NXP Semiconductors Table 7. SAM key management commands Command Description SAM_DumpSessionKey The command SAM_DumpSessionKey can only be used to retrieve the session key of an established authentication with a DESFire or MIFARE Plus PICC active PICC authentication (for these card types) is required. The session key can be retrieved in plain or encrypted, depending on the SAM-Host protection mode of the logical channel. In Plain and MAC Protection mode, the dump is done in plain ...
Page 17
... NXP Semiconductors Table 8. Data processing commands Command Description SAM_Verify_MAC The SAM_Verify_MAC command verifies the MAC which was sent by the DESFire PICC or any other system based on the given MACed plain text data and the currently valid cryptographic key. The valid key has been activated using a valid PICC authentication (SAM_AuthenticatePICC, SAM_ISOAuthenticatePICC) in case of a PICC Key or using a valid key activation (SAM_ActivateOfflineKey) in case of an OfflineCrypto Key ...
Page 18
... NXP Semiconductors 8.6.4 Public Key Infrastructure (PKI) commands PKI commands are available to generate public key pairs, to import public keys or key pairs, to export public keys or key pairs, to generate and to validate signatures, to compute hashes suitable for signature operations and to manage the symmetric Key Storage Table ...
Page 19
... NXP Semiconductors 8.6.5 MIFARE Plus in non-X-mode commands This section describes the SAM commands that can be used to prepare MIFARE Plus commands. The SAM maintains the MIFARE Plus state (e.g. the read and write counters). Table 10. MIFARE Plus in non-X mode commands Command Description SAM_AuthenticateMFP SAM_AuthenticateMFP can be used for all MIFARE Plus authentications (e ...
Page 20
... NXP Semiconductors 8.6.6 MIFARE Classic in non-X-mode commands The commands in this section can both be used to execute a transaction with a MIFARE Classic card and with a MIFARE Plus card in SL2. In the second case, SAM_AuthenticateMIFARE used after SAM_AuthenticateMFP to complete a MFP SL2 authentication. In both cases, after the authentication, the other SAM_xxxMIFARE commands and the data processing commands SAM_Decipher_Data and SAM_Encipher_Data can be used for further processing ...
Page 21
... NXP Semiconductors 8.6.8 RC522 configuration commands Table 13. RC522 configuration commands Command Description RC_ReadRegister Read the content of one or more register(s) of the connected reader chip. The command allows reading 255 registers with one command register address is listed more than once in the data field, the content of this register will be re-read every time. ...
Page 22
... NXP Semiconductors Table 14. ISO14443 commands Command ISO14443-4_Init ISO14443-4_Exchange ISO14443-4_PresenceCheck ISO14443-4_Deselect ISO14443-4_FreeCID 8.6.10 MIFARE Classic in X-mode commands The commands in this section can both be used to execute a transaction with a MIFARE Classic card and with a MIFARE Plus card in SL2. In the second case, MF_Authenticate, MF_AuthenticatedRead or MF_AuthenticatedWrite used after MFP_Authenticate to complete a MFP SL2 authentication ...
Page 23
... NXP Semiconductors Table 15. MIFARE Classic in X-mode commands Command Description Decrement one or several value blocks on a MIFARE card. Every decrement is confirmed MF_Decrement automatically by sending the Transfer command directly afterwards. The user has to define the source address of the value block to be decremented and the destination address of the value block to store the result ...
Page 24
... NXP Semiconductors 8.6.11 MIFARE Plus in X-mode commands This chapter describes the commands for the MIFARE Plus PICC’s when the MIFARE SAM AV2 is used in MIFARE SAM AV2 mode. When a MIFARE Plus communication is established between the SAM and a MIFARE Plus PICC, the corresponding SAM logical channel maintains the state (e.g. the read and write counters) required to manage the secure messaging with the MIFARE Plus PICC ...
Page 25
... NXP Semiconductors Table 16. MIFARE Plus in X-mode commands Command Description MFP_ProximityCheck MFP_ProximityCheck performs the complete MIFARE Plus proximity check between MIFARE SAM AV2 and the MIFARE Plus PICC. It performs the PPC, the one or more PC’s and the VPC command. As this is the X-mode command, the proximity time measurement is handled by a MFRC52X reader IC time-out ...
Page 26
... NXP Semiconductors 8.6.12 DESFire and ULC in X-mode commands Table 17. DESFire and ULC in X-mode commands Command Description In this procedure both the PICC as well as the MIFARE SAM AV2 device, show in DESFire_AuthenticatePICC an encrypted way that they posses the same secret which especially means the same key ...
Page 27
... NXP Semiconductors 9. Limiting values [1] Table 18. Limiting values In accordance with the Absolute Maximum Rating System (IEC 60134). Voltages are referenced to VSS (ground = 0 V). Symbol Parameter V supply voltage DD V input voltage I I input current I I output current O I latch-up current lu V electrostatic discharge voltage ...
Page 28
... NXP Semiconductors 11. Abbreviations Table 21. Acronym 2TDEA 3TDEA AES AID APDU AppData ATQA ATR ATS Auth mode Authent CBC CID CLA CMAC CmdCode CmdSettings CRC CRC16 CRC32 CRT CurVal CWT DES DF_AID DF_KeyNo DFKeyNo Div DivInp DRI DSI EEPROM ek(x) ekNo(x) FIFO ...
Page 29
... NXP Semiconductors Table 21. Acronym FSDI FWI INS ISO IV KeyCompMeth KeyNo KeyNoCEK KeyNoCKUC KeyNoM KeyV KeyVa KeyVb KeyVc KeyVCEK KeyVCKUC KeyVM KST KST KUC LC LFI LoadReg LRC LSB MAC MAD MFP MGF MSB NumCards OAEP PCD PICC PKI PKI_KST PPS ProMas PSS ...
Page 30
... NXP Semiconductors Table 21. Acronym RATS RefNoKUC RegAddress RegContent REQA RFU RndA RndA’ RndB RndB’ RSA RSAES-OAEP RSA-OAEP RSASSA-PSS SAC SAK SAM MIFARE SAM AV2 SEL SET SHA- 256 SHA-1 SHA-224 SL3 SN StoreReg SW TDEA TRNG UID WUPA XOR P5DF081_SDS Objective short data sheet ...
Page 31
... NXP Semiconductors 12. References [1] Data sheet — P5DF081 MIFARE SAM AV2 BU-ID Doc. No. 1645** [2] Reader Software Library — DESFire & DESFire SAM; Programmer's Reference Manual, BU-ID Doc. No. 0893** [3] Application Note — MIFARE DESFire; Implementation hints and example, BU-ID Doc. No. 0945** [4] ISO 14443-3 — ISO/IEC14443-3:2008 [5] ISO 14443-4 — ...
Page 32
... NXP Semiconductors [24] CMAC Errata — Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication, NIST Special Publication 800-38B, Errata, http://csrc.nist.gov/publications/nistpubs/800-38B/Updated_CMAC_Examples.pdf [25] BC-Methods — Recommendation for Block Cipher Modes of Operation - Methods and Techniques, NIST Special Publication 800-38A, December 2001, http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf [26] NIST Special Publication 800-38A — ...
Page 33
... In no event shall NXP Semiconductors be liable for any indirect, incidental, punitive, special or consequential damages (including - without limitation - lost profits, lost savings, business interruption, costs related to the removal or ...
Page 34
... P5DF081_SDS Objective short data sheet PUBLIC own risk, and (c) customer fully indemnifies NXP Semiconductors for any liability, damages or failed product claims resulting from customer design and use of the product for automotive applications beyond NXP Semiconductors’ standard warranty and NXP Semiconductors’ product specifications. ...
Page 35
... NXP Semiconductors 16. Tables Table 1. Quick reference data . . . . . . . . . . . . . . . . . . . . .2 Table 2. Ordering information . . . . . . . . . . . . . . . . . . . . .2 Table 3. Pin description ISO/IEC 7816/MIFARE SAM AV2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4 Table 4. ATR after cold reset . . . . . . . . . . . . . . . . . . . . . .5 Table 5. ATR after warm reset . . . . . . . . . . . . . . . . . . . . .6 Table 6. SAM security and configuration commands . .13 Table 7. SAM key management commands . . . . . . . . .15 Table 8. Data processing commands . . . . . . . . . . . . . .16 Table 9 ...
Page 36
... NXP Semiconductors 18. Contents 1 General description . . . . . . . . . . . . . . . . . . . . . . 1 2 Features and benefits . . . . . . . . . . . . . . . . . . . . 1 2.1 Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2.2 Communication 2.3 Delivery types . . . . . . . . . . . . . . . . . . . . . . . . . . 2 3 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 4 Quick reference data . . . . . . . . . . . . . . . . . . . . . 2 5 Ordering information . . . . . . . . . . . . . . . . . . . . . 2 6 Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 3 7 Pinning information . . . . . . . . . . . . . . . . . . . . . . 4 7.1 Pinning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 7.2 Pin description . . . . . . . . . . . . . . . . . . . . . . . . . 4 8 Functional specification . . . . . . . . . . . . . . . . . . 4 8.1 Hardware interface . . . . . . . . . . . . . . . . . . . . . . 4 8 ...