MF3ICDX21_41_81_SDS

All information provided in this document is subject to legal disclaimers.

© NXP Semiconductors N.V. 2015. All rights reserved.

Product short data sheet

COMPANY PUBLIC

Rev. 3.2 — 9 December 2015

145632

8 of 18

NXP Semiconductors

MF3ICDx21_41_81

MIFARE DESFire EV1 contactless multi-application IC

If this rollback is necessary, it is done without user interaction before carrying out further

commands. To ensure data integrity on application level, a transaction-oriented backup is

implemented for all file types with backup. It is possible to mix file types with and without

backup within one application.

As the commands are the same for MF3ICD(H)81, MF3ICD(H)41 and MF3ICD(H)21, the

command details are available in Ref. 1. Only the memory size and input capacitance are

different between the devices.

8.5 Available file types

The files within an application can be any of the following types:

8.6 Security

The 7 byte UID is fixed, programmed into each device during production. It cannot be

altered and ensures the uniqueness of each device.

The UID may be used to derive diversified keys for each ticket. Diversified MIFARE

DESFire EV1 keys contribute to gain an effective anti-cloning mechanism and increase

the security of the original key; see Ref. 7.

Prior to data transmission a mutual three-pass authentication can be done between

MIFARE DESFire EV1 and PCD depending on the configuration employing either 56-bit

DES (single DES, DES), 112-bit 3DES (triple DES, 2K3DES), 168-bit 3DES (3 key triple

DES, 3K3DES) or AES. During the authentication the level of security of all further

commands during the session is set. In addition, the communication settings of the

file/application result in the following options of secure communication between MIFARE

DESFire EV1 and PCD:

MF3ICD40)

backwards-compatible mode to MF3ICD40: 4 byte MAC, all other authentications

based on DES/3DES/AES: 8 byte CMAC

backwards-compatible mode to MF3ICD40: A 16-bit CRC is calculated over the

stream and attached. The resulting stream is encrypted using the chosen

cryptographic method. All other authentications-based DES/3DES/AES: A 32-bit CRC

is calculated over the stream and attached. The resulting stream is encrypted using

the chosen cryptographic method.

Find more information on the security concept of the product in Ref. 1. Be aware not all

levels of security are recommended. The recommended secure handling of the product

can be seen in Ref. 2 and in Ref. 11.