How MIFARE Uses Cookies

[AdnanM]

Hi,

I have the possibility to use both I believe, contactless and contact reader interface. As I have written, this is possible with MIFAREdiscover.

603C is the command to use for Auth. with Key A, Block 3C. But how should I build this in CLA INS P1 P2 Lc Data Le? Sending ISO14443_4_TDX commands.

My target system is to authenticate with this Mifare Classic card using the SAM. And you cannot send simply 603C because no reader will understand it. Even Pegoda. You need to write correctly the commands using CLA INS P1 P2 Lc Data Le.

I'm able to do the DESFire - SAM authentication using all the APDU commands, But with the Classic I'm stuck at the first step, as I cannot get the 32 bit Random to proceed.

Kind regards,
Adnan

---

+ 0  |  - 0

[AdnanM]

Hi,

Thank you for the support. I understand what you say. But the 0x6000 command does not work. I need to add CLA, INS, P1, P2, Lc, "Data", and Le (if any Le). For example to read the MF Classic UID the APDU is: FFCA000000
+------+------+------+------+------+
| CLA | INS | P1 | P2 | Lc |
+------+------+------+------+------+
| 0xFF | 0xCA | 0x00 | 0x00 | 0x00 |
+------+------+------+------+------+

Now to authenticate what would the APDU cmd be?
+------+------+------+------+------+--------------------------+----+
| CLA | INS | P1 | P2 | Lc | Data | Le |
+------+------+------+------+------+--------------------------+----+
| 0xFF | 0x86 | 0x00 | 0x00 | 0x05 | 0x01 0x00 0x00 0x60 0x00 | -- |
+------+------+------+------+------+--------------------------+----+

Now this does not work using my Pegoda reader and TestWinscard.exe (using APDU commands)! And its true, because the last byte (0x00) in Data, indicates the key positioning in the reader! - but I did not load any key in the reader memory, because I want to use the SAM.

If I use the "MIFAREdiscover" thats Ok, I have a solution, but that does not solve my problem. I need to work with APDU cmds.

Example Logs:
[10.04.2018 12:05:30] Info: phalMfc_Authenticate --------ENTRY-------- bBlockNo=3C, bKeyType=0A, wKeyNumber=003C, wKeyVersion=0000, pUid=xxxxxxxx
[10.04.2018 12:05:30] Info: Send To Card = 603C [How should I build this in CLA INS P1 P2 Lc Data Le]
[10.04.2018 12:05:30] Info: Recv From Card = 0A7D1949 , SUCCESS [to get this Rn 32 bits]
[10.04.2018 12:05:30] Info: SentFrmHost = 80...
[10.04.2018 12:05:30] Info: Send To SAM = 80...
[10.04.2018 12:05:30] Info: Recv From SAM = ...90AF, SUCCESS
...
...
[10.04.2018 12:05:30] Info: Recv From SAM = 9000, SUCCESS
[10.04.2018 12:05:30] Info: GivenToHost = 9000
[10.04.2018 12:05:30] Info: phalMfc_Authenticate --------LEAVE-------- [STATUS = SUCCESS]

Kind regards,
Adnan

---

+ 0  |  - 0

[AdnanM]

Hi Samuel,

0x911E stands for INTEGRITY_ERROR (CRC or MAC does not match data. Paddinng bytes not valid).
With what did you authenticate? 3DES? If you want now to change the Key [ChangeKey] you should use:
0x90[CLA] 0xC4[INS] 0x00[KeyNo] and Ciphered_Key_Data [24 to 40 bytes] ... (you should have a look at the document that I wrote earlier p.43-45, you can find it at docstore.nxp.com).

Are you in an application level, or transponder level (PICC)? According to the documentation, once you are in the application level you cannnot change the key type (after application creation).

As you use a CRC32, I guess you Authenticate with AuthenticateISO 0x1A. Is it right? After this you have these choices to change the key: (CASE I) KeyNo use for authentication is different from the KeyNo to be changed, and (CASE II) KeyNo used for authentication is the same as the KeyNo to be changed (the procedure is diffrent). There is also (CASE III) when the Key is set to 0x0F (all keys except the Master Key are frozen).

It depends on the method how you pass the "Ciphered_Key_Data" to get it right.

Good luck.
Adnan

---

+ 0  |  - 0

[AdnanM]

Sorry,

Might write the message in ASCII like: 48656C6C6F204465736B746F7021

Kind regards,
Adnan

---

+ 0  |  - 0

[AdnanM]

Hi Andrew,

Yes its possible. Here is a very good example https://github.com/grundid/host-card-emulation-sample which will write to you "Hello Desktop!" The App emulates a MIFARE card with this AID 0xF0, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06 You should make your self familiar with the HCE code.

In the other side you should have an NFC reader (in your case MIFARE NFC) which will be looking for the same AID as in the HCE App. Normally you should send this cmd to the Android phone from your reader after you have brought the two devices close enough 0x00 [CLA], 0xA4 [INS], 0x04, 0x00, 0x07 [Lc], 0xF0, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x00 [Le]

Kind regards,
Adnan

---

+ 1  |  - 0

[AdnanM]

Hi,

Can you please be a bit more specific? What card do you have?

In my experience you can switch from DES to AES in this way (speaking for a DESFire EV1 card here):
1- Authenticate with the DES key (supposing you already know the key), (APDU: 0x90 [CLA], 0x0A or 0x1A [INS], 0x00 [P1], 0x00 [P2], 0x01 [Lc], 0x00 [KeyNo], 0x00 [Le]).
2- Change the key Settings to AES mode, (for this check MF3ICD81 MIFARE DESFire EV1 Product Data Sheet p.43 - is Company Confidential under NDA). The command INS or cmd should be 0xC4 and for AES you should write 0x10 I guess.
3- then you should be able to authenticate using the 0xAA command.

Kind regards,
Adnan

---

+ 0  |  - 0

[AdnanM]

Hi,

Did you managed to do something? Because its more than 10 days and I see no reply.

My suggestions are:

1- You should register yourself at the NXP docstore (https://www.docstore.nxp.com/flex/DocStoreApp.html#/l) and from there you should download the SAM documentations upon their approval. Actually as the first step you should order a development kit called Pegoda Reader (http://www.nxp.com/demoboard/MFEV710.html) and you may even think on taking a Training offered by NXP, MobileKnowledge, or UL. Its Module 4 you need.

With the Pegoda reader and the MIFAREDiscover software you will be able to write/read and communicate with the SAM.

2- Yes, use the reader, and the software. I used to write the keys in the Key Store Table KST. I'm not sure how it is with injecting the keys into the SAM (but you have the possibilities to write the keys to the Table and Save them in .key file, or Load them back to the MIFAREDisover). However, keep in mind that once you write a key to the SAM you cannot eye-read it from SAM even with the MIFAREDiscover program. However you have a KeyStoreTable in the Software so you can write your keys so you dont lose track (and save them as a .key file).

3- Your hardware module should have some function to read contact cards (or the SAM). You should use these functions to send APDU commands to SAM. SAM will send you a response (answer APDU-R). You may need to use it, to sent another command to the SAM or it may be the SUCCES answer (which is some data and the Status Word. If SUCCES it is something like DATA9000)

SAM and the APDU command are not an easy topic.

Good luck.

---

+ 1  |  - 0

[Author]

Posts