P5DF081UASLASHT1AR1070 datasheet(21/40 Pages) NXP

21 / 40 page

NXP Semiconductors

P5DF081_SDS

MIFARE secure access module SAM AV2

8.6.4 Public Key Infrastructure (PKI) commands

PKI commands are available to generate public key pairs, to import public keys or key pairs, to export public

keys or key pairs, to generate and to validate signatures, to compute hashes suitable for signature operations

and to manage the symmetric Key Storage Table.

PKI commands are only available in AV2 mode.

Command

Description

PKI_GenerateKeyPair

The PKI command PKI_GenerateKeyPair creates a pair of a public and a private key. MIFARE

SAM AV2 only supports the CRT format. A successful host authentication in the LC using

SAM_AuthenticateHost with a Host Key is required to execute the PKI_GenerateKeyPair

command.

PKI_ImportKey

The PKI command PKI_ImportKey imports an RSA key. This can be either a public key or a full

key pair (including a private key). When a change key (see [1]) is specified, a successful host

authentication in the LC using SAM_AuthenticateHost with a Host Key is required to execute

the PKI_ImportKey command.

PKI_ExportPrivateKey

The PKI command PKI_ExportPrivateKey exports a full RSA key entry (i.e including the private

key if present). The key pair is exported in CRT format.

This command is intended for private key backup after having it created with MIFARE SAM

AV2. For this reason, this command will only be accepted if the key entry includes a private

key and private key export is allowed by the PKI SET configuration of the addressed key. The

command is part of the restricted command set and requires protection with a Host Key change

key.

PKI_ExportPublicKey

The PKI command PKI_ExportPublicKey exports the public key part of a RSA key pair.

The command is part of the general command set, so its protection depends on the general

SAM-Host communication protection.

PKI_UpdateKeyEntries

The PKI_UpdateKeyEntries command can be used to change key entries of the symmetric

key storage (KST). Executing this command does not require any protection coming from the

change key of the key entries (e.g. a Host Authentication in case of a Host Key). Instead the

command's execution is protected by asymmetric techniques using the PKI support of the

SAM.

The command is protected by encrypting the key entries using the RSA encryption. On top a

digital signature is added using the RSA signature algorithm. This allows offline preparation of

the cryptogram. The same hashing algorithm is to be used for both MGFs and for the digital

signature handling (as indicated by the P1 byte).

PKI_GenerateHash

The PKI command PKI_GererateHash computes the hash on a data string. The algorithm to be

used to compute the hash is selected through P1.

PKI_GenerateSignature

The PKI command PKI_GenerateSignature generates a signature on a hash given as input

using one of the two private keys stored in the PKI Key Storage Table.

PKI_SendSignature

The PKI command PKI_SendSignature returns a pre-computed signature. The returned

signature is protected according to the SAM-Host protection in place on the corresponding

logical channel.

PKI_VerifySignature

The PKI command PKI_VerifySignature verifies the correctness of a signature.

Table 10. Public Key Infrastructure (PKI) commands

8.6.5 MIFARE Plus in non-X-mode commands

This section describes the SAM commands that can be used to prepare MIFARE Plus commands. The SAM

maintains the MIFARE Plus state (e.g. the read and write counters).

P5DF081_SDS

All information provided in this document is subject to legal disclaimers.

Product short data sheet

Rev. 3.3 — 13 September 2023

21 / 40

P5DF081UA/T1AR1070 Datasheet(PDF) 21 Page - NXP Semiconductors

P5DF081UA/T1AR1070 Datasheet(HTML) 21 Page - NXP Semiconductors

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

Datasheet Download

Link URL