How MIFARE Uses Cookies

[nimaltd]

please see image . this is my result

---

+ 0  |  - 0

[nimaltd]

why i cant copy past my result in here

---

+ 0  |  - 0

[nimaltd]

Read Card Info : ( Desfire Detect ) (UID len : 7 ) ( SEL RES : 20) (UID : 04 6F 45 99 C9 24 80 ) ( RATS : 75 77 81 02 80 BD )

Card Selected.

Desfire >> Try To Login With KeyNo : ( 0 )

InDataExchange PN532 --->> Card : 0A 00

InDataExchange PN532 <> Read RndB : <>

Desfire >> Generate RndA : <>

InDataExchange PN532 --->> Card : AF AE EC 20 EB 19 C3 6A 6F 67 7B 15 1B 7B 5C 57 38

InDataExchange PN532 <> Reading RndA' : <>

Desfire >> RndA' After Decrype : <>

Desfire >> Session Key : <>

Desfire >> Login Sucsess

Desfire >> Try To Change Key of KeyNo : ( 0 )

Desfire >> Old key : <>

Desfire >> New key : <>

Desfire >> 24 Bytes ChangeKey Parameter : <>

Desfire >> 24 Bytes ChangeKey Parameter After Decrype : <>

InDataExchange PN532 --->> Card : C4 00 8D 65 11 96 6F BC 8B 6E D9 FD D7 6C 62 DE D4 3B AB F5 A7 9B 62 97 1B 20

InDataExchange PN532 <> Error In Changing Key

---

+ 0  |  - 0

[nimaltd]

Read Card Info : ( Desfire Detect )  (UID len : 7 ) ( SEL RES : 20) (UID :  04 6F 45 99 C9 24 80 )  ( RATS :  75 77 81 02 80 BD )



Card Selected.



Desfire >> Try To Login With KeyNo : ( 0 )



InDataExchange PN532 --->> Card   :  0A 00



InDataExchange PN532 <> Read RndB : <>



Desfire >> Generate RndA : <>



InDataExchange PN532 --->> Card   :  AF AE EC 20 EB 19 C3 6A 6F 67 7B 15 1B 7B 5C 57 38



InDataExchange PN532 <> Reading RndA' : <>



Desfire >> RndA' After Decrype : <>



Desfire >> Session Key : <>



Desfire >> Login Sucsess



Desfire >> Try To Change Key of KeyNo : ( 0 )



Desfire >> Old key : <>



Desfire >> New key : <>



Desfire >> 24 Bytes ChangeKey Parameter : <>



Desfire >> 24 Bytes ChangeKey Parameter After Decrype : <>



InDataExchange PN532 --->> Card   :  C4 00 8D 65 11 96 6F BC 8B 6E D9 FD D7 6C 62 DE D4 3B AB F5 A7 9B 62 97 1B 20



InDataExchange PN532 <> Error In Changing Key

---

+ 0  |  - 0

[nimaltd]

Read Card Info : ( Desfire Detect ) (UID len 7 ) ( SEL RES 20) (UID 04 6F 45 99 C9 24 80 ) ( RATS 75 77 81 02 80 BD )

Card Selected.

Desfire : Try To Login With KeyNo ( 0 )

InDataExchange PN532 -> Card 0A 00

InDataExchange PN532 Read RndB 72 AD 16 0B BB 02 11 72

Desfire > Generate RndA : A3 09 59 CC 31 A4 0A 59

InDataExchange PN532 -> Card AF AE EC 20 EB 19 C3 6A 6F 67 7B 15 1B 7B 5C 57 38

InDataExchange PN532 Reading RndA' 12 1B 82 A4 52 BE EC 40

Desfire > RndA' After Decrype 09 59 CC 31 A4 0A 59 A3

Desfire > Session Key A3 09 59 CC 72 AD 16 0B

Desfire > Login Sucsess

Desfire > Try To Change Key of KeyNo ( 0 )

Desfire > Old key 00 00 00 00 00 00 00 00

Desfire > New key 31 31 31 31 31 31 31 31

Desfire > 24 Bytes ChangeKey Parameter 31 31 31 31 31 31 31 31 00 00 00 00 00 00 00 00 15 07 00 00 00 00 00 00

Desfire > 24 Bytes ChangeKey Parameter After Decrype 8D 65 11 96 6F BC 8B 6E D9 FD D7 6C 62 DE D4 3B AB F5 A7 9B 62 97 1B 20

InDataExchange PN532 -> Card C4 00 8D 65 11 96 6F BC 8B 6E D9 FD D7 6C 62 DE D4 3B AB F5 A7 9B 62 97 1B 20

InDataExchange PN532 <- card 1E Error In Changing Key

---

+ 0  |  - 0

[nimaltd]

Read Card Info : ( Desfire Detect ) (UID len : 7 ) ( SEL RES : 20) (UID : 04 6F 45 99 C9 24 80 ) ( RATS : 75 77 81 02 80 BD )

Card Selected.

Desfire : Try To Login With KeyNo : ( 0 )

InDataExchange PN532 -> Card : 0A 00

InDataExchange PN532 Read RndB :

Desfire > Generate RndA :

InDataExchange PN532 -> Card : AF AE EC 20 EB 19 C3 6A 6F 67 7B 15 1B 7B 5C 57 38

InDataExchange PN532 Reading RndA' : >

Desfire > RndA' After Decrype :

Desfire > Session Key :

Desfire > Login Sucsess

Desfire > Try To Change Key of KeyNo : ( 0 )

Desfire > Old key :

Desfire > New key :

Desfire > 24 Bytes ChangeKey Parameter :

Desfire > 24 Bytes ChangeKey Parameter After Decrype :

InDataExchange PN532 -> Card : C4 00 8D 65 11 96 6F BC 8B 6E D9 FD D7 6C 62 DE D4 3B AB F5 A7 9B 62 97 1B 20

InDataExchange PN532 Error In Changing Key

---

+ 0  |  - 0

[nimaltd]

// this function calculates a CRC16 over a unsigned char Array with, LSB first
// @Param1 (DataBuf): An Array, which contains the Data for Calculation
// @Param2 (SizeOfDataBuf): length of the Data Buffer (DataBuf)
// @Param3 (Polynom): Value of the Generatorpolynom, 0x8408 is recommended
// @Param4 (Initial_Value): load value for CRC16, 0xFFFF is recommended for
// host to reader communication
// return: calculated CRC16
uint16_t GetCrc( uint8_t *DataBuf,uint8_t SizeOfDataBuf,uint16_t Polynom,uint16_t Initial_Value)
{

uint16_t Crc16;
uint8_t Byte_Counter, Bit_Counter;
Crc16 = Initial_Value;
for (Byte_Counter=0; Byte_Counter < SizeOfDataBuf; Byte_Counter++)
{
Crc16^=DataBuf[Byte_Counter];
for (Bit_Counter=0; Bit_Counter>=1;
else
Crc16=(Crc16>>1)^Polynom;
}
}
return (Crc16);
}

---

+ 0  |  - 0

[nimaltd]

bool MifareDesfire_ChangeMasterKey(uint8_t *OldKey,uint8_t *NewKey)
{
uint8_t NewKeyBuffer[24];
uint8_t SessionKey[8];
uint16_t crc;
MifareDesFire_Authenicate(0,DesfireAppID000,OldKey,SessionKey);

pn532_packetbuffer[0] = PN532_COMMAND_INDATAEXCHANGE;
pn532_packetbuffer[1] = 1; // max 1 cards at once (we can set this to 2 later)
pn532_packetbuffer[2] = MIFARE_DESFIRE_CMD_CHANGEKEY;
pn532_packetbuffer[3] = 0;

for(uint8_t i=0; i<8 ; i++)
NewKeyBuffer = OldKey ^ NewKey;
for(uint8_t i=8; i> 8;

crc = GetCrc(NewKey,8,0xCC69,0xffff);

NewKeyBuffer[18] = crc&0x00ff;
NewKeyBuffer[19] = (crc&0xff00) >> 8;

for(uint8_t i=20; i<24 ; i++)
NewKeyBuffer = 0;

desInit(&myDes,OldKey,8);
desDecryptBlock(&myDes,&NewKeyBuffer[0],&NewKeyBuffer[0]);
desDecryptBlock(&myDes,&NewKeyBuffer[8],&NewKeyBuffer[8]);
desDecryptBlock(&myDes,&NewKeyBuffer[16],&NewKeyBuffer[16]);

for(uint8_t i=0; i<24; i++)
pn532_packetbuffer = NewKeyBuffer;
if (!PN532_sendCommandCheckAck(pn532_packetbuffer, 28, 500))
{
#ifdef MIFARE_DEBUGMODE
printf("PICC Can Not Change Pin\n\r");
#endif
return false;

}

if (!PN532_waitready(500))
{
#ifdef MIFARE_DEBUGMODE
printf("PICC Can Not Change Pin\n\r");
#endif
return false;
}
PN532_readdata(pn532_packetbuffer, 0);
if(pn532_packetbuffer[7] != 0)
{
#ifdef MIFARE_DEBUGMODE
printf("PICC Can Not Change Pin\n\r");
#endif
return false;
}
if(pn532_packetbuffer[8] != 0)
{
#ifdef MIFARE_DEBUGMODE
printf("PICC Can Not Change Pin\n\r");
#endif
return false;
}


#ifdef MIFARE_DEBUGMODE
printf("PICC Pin Changed\n\r");
#endif

return true;
}

---

+ 0  |  - 0

[nimaltd]

I have a problem. Please help me
I select app 000000 with no error.
I use DES and auth... with no error.
I have problem with making 24 byte data for change master key.
I dont use mifaresdk.
My old key is 00 00 00 00 00 00 00 00
8 byte for des .
How to create 24 byte data. I read datasheet but i dont undrestand .
Use crc , how can i make crc . I need c code. Please tell me completly.

---

+ 0  |  - 0

[nimaltd]

Please answer me, i am waiting

---

+ 0  |  - 0

[nimaltd]

Please tell me how to create session key . my problem may be session key.
I can't underestand when I must get RandA and RandB to create session key.
after create session key , i must create CMAC. if is true , how to make cmac ?
thanks a lot




void Create_session_key(const uint8_t rnda[], const uint8_t rndb[])
{
memcpy (session_key, rnda, 4);
memcpy (session_key+4, rndb, 4);
memcpy (session_key+8, rnda+4, 4);
memcpy (session_key+12, rndb+4, 4);

}


bool DesFire_Authenticate(uint8_t KeyNo,const uint8_t *key)
{
uint8_t randA[8],randB[8];
desInit(&des,key,8);

send_buffer[0] = 0x0A; // cmd
send_buffer[1] = KeyNo; // key number
if(PN532_transfer(send_buffer,2,get_buffer,&get_len)== true)
{
}
else
{
return false;
}
if(get_buffer[0] != 0xAF)
return false;

/////////////////////////////////////////////////////////////////////////////

// get encrypted(randB) from the response
uint8_t b0[8] ;
for(int i = 0; i < 8; i++)
{
b0 = get_buffer;
//randB = b0;
}

// decrypt encoded(randB)
uint8_t r0[8];
desDecryptBlock(&des,b0, r0);
for(int i = 0; i < 8; i++)
{
randB = r0;
}

// generate randA (integer 0-7 for trying, should randomize for real-life use)
uint8_t nr[8];
for(int i = 0; i < 8; i++)
{
nr = rand()/0x808080;
randA = nr;
}

Create_session_key(randA,randB);

// decrypt randA, should XOR with IV, but IV is all 0's, not necessary
uint8_t b1[8];
desDecryptBlock(&des,nr,b1);

// shift randB one byte left and get randB'
uint8_t r1[8];
for(int i = 0; i < 7; i++) {
r1 = r0;
}
r1[7]=r0[0];

// xor randB' with randA and decrypt
uint8_t b2[8];
for(int i = 0; i < 8; i++) {
b2 = (uint8_t) (b1 ^ r1);
}
desDecryptBlock(&des,b2,b2);

// concat (randA + randB')
uint8_t b1b2[16];

for (int i = 0; i < sizeof(b1b2); i++) {
if(i <= 7) {
b1b2 = b1;
} else {
b1b2=b2;
}
}
/////////////////////////////////////////////////////////////////////////////
send_buffer[0] = 0xAF;
for(int i=1 ; i<17 ; i++)
send_buffer = b1b2;

if(PN532_transfer(send_buffer,17,get_buffer,&get_len)== true)
{
if(get_buffer[0] == 0)
{
return true;
}
else
{
return false;
}
}
else
{
return false;
}

return false;
}

---

+ 0  |  - 0

[nimaltd]

Thanks for your answer.
but I work with 64 bit key for DES or 192 bit for Des3 , and AUTHENTICATION is ok with key 00 00 00 00 00 00 00 00 or 00 .... [16 byte]
.
and now i have another problem.
I cant change password . always return AUTHENTICATION_ERROR 0xAE . maybe for 64 bit key ?

---

+ 0  |  - 0

[nimaltd]

My c function is like this,
But return 0x0e
Please send me your crc methode
I search in google and find alot of algorithm
I dont no wich methode is true,
Please send me step by step what do i do
For create file and change password

Thanks a lot

---

+ 0  |  - 0

[nimaltd]

I'm using 3Des .
i try it to des.
your answer for my first question or 2nd ?
my crc is correct ?

and my next problem . why cant create file .
always return 0x0E.

1 :AUTHENTICATION
2: I create App
3 : Select APP
4: create STD file but return 0x0e

---

+ 0  |  - 0

[nimaltd]

hi again
Sorry for my English.

My current key is uint8_t key = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
when i change uint8_t key = {0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0};
AUTHENTICATION worked with no error.
when uint8_t key = {0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0};
AUTHENTICATION not worked


I have one other question .
How can I change key :-)

1 : first AUTHENTICATION with old key
2 : xor Old key and new key. [16 byte with 16 byte]
3 : calc crc16 . [ 2 byte ]
4 : set to zero next 6 byte buffer.
5 : Decrypt 24 byte with old key.
6 : add 0xc4 and 0x00 to first of block and send data

but not work.


my crc16 function is


uint16_t crc16(uint8_t * data_p, uint8_t length)
{
uint8_t x;
uint16_t crc = 0xFFFF;

while (length--){
x = crc >> 8 ^ *data_p++;
x ^= x>>4;
crc = (crc << 8) ^ ((unsigned short)(x << 12)) ^ ((unsigned short)(x <<5)) ^ ((unsigned short)x);
}
return crc;
}


thanks for your answer

---

+ 0  |  - 0

[Author]

Posts