PCF7936AS/3851/C,1-CT NXP Semiconductors, PCF7936AS/3851/C,1-CT Datasheet - Page 8

• Manufacturer Part Number: PCF7936AS/3851/C,1-CT
• Description: pcf7936as series 32-bit 125 khz read / write security...
• Manufacturer: NXP Semiconductors

NXP Semiconductors
Security Transponder (HITAG2)
Note
1. Locations marked ‘X’ are for device internal use. They
Pages 0 to 3 of the EEPROM memory are reserved for
transponder
Page 4 to 7 are reserved for user data storage, USER.
According to the selected authorization method, page 1 and
2 do hold a Password, PSW
Secret Key, SK, (Cipher mode).
7.1.1 Identifier, IDE
The Identifier, IDE, is a factory programmed quasi unique
32 bit pattern that serves the function of a device serial
number (SN) and product type identification (PI). The
Identifier is located in page 0 and supports read access
only, thus cannot be altered.
The product type identification is located in the bits 4 to 7
and factory programmed for all
1
2010 May 04
H
Figure 4. Transponder Memory Map
, as shown in Figure 5.
are partly initialized and locked against overwriting
during device manufacturing and are not available for
data storage. Any read operation yields an undefined bit
value.
Password Mode
Cipher Mode
bit 31
b
MSB
bit 31
b
MSB
31
31
TMCF
TMCF
X
X
configuration
b
b
23
23
(ENC = 1)
(ENC = 0)
SK (low)
USER 0
USER 1
USER 2
USER 3
USER 0
USER 1
USER 2
USER 3
PSW
IDE
IDE
b
47
PSW
PSW
B
and
B
SK (high)
, (Password mode) or the
not used
T
T
PCF7936AS
personalization,
bit 0
LSB
bit 0
LSB
b
b
b
b
b
32
0
0
0
0
Page 0
Page 1
Page 2
Page 3
Page 4
Page 5
Page 6
Page 7
Page 0
Page 1
Page 2
Page 3
Page 4
Page 5
Page 6
Page 7
devices to
while
8
The Identifier, IDE, is transmitted in plain and incorporated
in the process of device authentication, thus used by the
on-chip Calculation Unit as well as by the interrogating
system.
7.1.2 Password Basestation, PSW
The Password Basestation, PSW
Password
Basestation is a 32 bit pattern, which typically is initialized
and subsequently locked by the customer during device
personalization. The Password Basestation is located in
page 1, see Figure 4.
During the process to identify the basestation towards the
transponder,
received by the basestation with the password stored in
PSW
successful identification of the basestation and the
authentication sequence is continued, otherwise it is
terminated.
START_AUTH command.
The Password Basestation may be assigned any value that
is considered useful by the application. The PSW
protected against reading and writing by setting the lock bit
SKL, see section 7.1.4
NXP initializes the Password Basestation with a common
Transport Key value as specified (see section 8), in order
to enable initial device access. Since the corresponding
lock bit is not set, the PSW
device configuration can be read and modified at any time
as desired.
Figure 5. Identifier Organization, IDE
B
. If both match each other, the transponder assumes
bit 31
bit 7
MSB
0
SN 3
mode
6
the
For
0
5
0
transponder verifies the password
only
details
4
SN 2
1
IDE
PI
(ENC = 0).
B
SN 1
refer
Transport Key value and
Product Specification
8 7
B
B
, is applicable in
PCF7936AS
to
PI
The
CONFIDENTIAL
4 3
SN 0
section 7.3.1,
LSB
0
Password
B
can be