How MIFARE Uses Cookies

[Tithi Patel]

Hello, I'm facing the same issue in PICC Change key settings, when PICC master key is of AES type.
My cryptogram logic works fine in Change PICC/Application keys.

Can you guide me, where I'm doing wrong?

A preceding AES authentication got success with PICC Master Key.

AESEncryption AES = new AESEncryption();
IV = "00000000000000000000000000000000";

string CRC32_For_Data = Crc32.Compute("540B"); //CRC calculation for data
CRC32_For_Data = CRC32_For_Data .Substring(6,2) + CRC32_For_Data .Substring(4,2) + CRC32_For_Data .Substring(2,2) + CRC32_For_Data .Substring(0,2); //To send LSB first
string DataWithCRC = PaddingDesFire(CRC32_For_Data, 32, "00"); //to make data of 16 bytes
string EncipheredData = AES.AESEncipher(DataWithCRC, LastSessionKeyAES, IV);

APDUCommand = “54” + EncipheredData; // ChangeKeyCommand + EncipheredData, which contains New KeySettings (0x0B)
CardResponse = Transmit(ReaderName, APDUCommand, “T1”); // it gives 0x1E response, either I send MSB or LSB first

Thank you in advance

---

+ 0  |  - 0

[Tithi Patel]

I am doing the same, but the authentication fails. Should I use 14443-3 or 14443-4?

---

+ 0  |  - 0

[Tithi Patel]

Hi Kevin,

After going through your post again, I think I too am stuck at the same place. It works perfectly fine till Commit Perso. After that when I try to switch to SL3, SCardTransmit gives Card Removed error.

I think I am not activating Layer 4 properly. I am using HID Omnikey 6321. Will you be able to help out please?

Thank you!

---

+ 0  |  - 0

[Tithi Patel]

Hi,

I am using Mifare Plus X cards and encoding them in SL0. After encoding I am trying to switch to SL3. If I manually remove the card from reader after encoding, I can switch the card to SL3, but not in the same session as I do encoding (after Commit Perso).

I understand that layer 4 communication is to be allowed. I am using WinScard.dll and HID Omnikey 6321. How do I achieve this?

Can you please detail out the steps after Commit Perso? I am following below:

1. Commit Perso
2. Power Down Mifare Plus
3. Connect Mifare Plus (winscard gives error that card is removed)

Thank you.

---

+ 0  |  - 0

[Tithi Patel]

Hello, We have tried without Authentication and following above mentioned process but receiving 6985.

We really need help as soon as possible. may i kindly request you to assist us with remote session please?

---

+ 0  |  - 0

[Tithi Patel]

Hi,

Thank you for your reply.

The process we follow is:

We pass Key Number and Key Version to the SAM_DumpSecretKey function with Diversification Input as UID. P1=02 and P2=00. This returns me 6985.

If SAM_DumpSecretKey is not allowed, how to personalize the MF Plus? Customer is already using this SAM for personalization of MF Plus cards since last couple of years.

Thank you!

---

+ 0  |  - 0

[Tithi Patel]

Dear NXP Team,

We have scenario in which we have customer's SAM so we only know Host Key which was used to lock SAM card and using same SAM we need to personalize MiFare Plus card in that case do we need to "Authenticate Host" or "Unlock" card? Or we could directly start personalizing card without authenticating SAM?

Because while trying to unlock SAM via NXP RFIDDiscover tool with key provided by customer we receive 6985 error but customer is sure that key and position is correct.

Could you please guide us to unlock SAM please?

Regards,
Tithi Patel

---

+ 0  |  - 0

[Tithi Patel]

I understand that you're operating MIFARE SAM AV2 in non-X-mode. Is that correct?

[Tithi] Yes

Then, you authenticate to key 9003 with command 70039000.

[Tithi] Yes

If the card that you're addressing is a MIFARE Plus S, SE or X, the command is correct. If the card is a MIFARE Plus EV1, then is wrong.

[Tithi] It is MIFARE Plus X

FFA00005270100F3000064 I do not understand. What is this?

[Tithi] We are using HID Omnikey 6321 which requires Generic APDU wrapper to be used for non-ISO apdus

Finally, what is the issue you're reporting? That the answer from the card to command AuthenticateContinue is just 9000h and does not include the extra bytes payload with TI, RndA', PDcap2 and PCDcap2 or that the execution of the second part of the SAM_AuthenticateMFP (80A30000...) answers with 9000?

[Tithi] The issue is, the answer from the card to command AuthenticateContinue is just 9000h and does not include the extra bytes payload with TI, RndA', PDcap2 and PCDcap2

Hope the above helps!

---

+ 0  |  - 0

[Tithi Patel]

Hello TapLinx Team,

Thank you so much for your reply.

But, our specific requirement is to use SL3 Mode only with MAD in sectors 10h to 1Fh.

Is there any other way to verify SL3 MAD sectors in android application or RDIDDiscover tool?

---

+ 0  |  - 0

[Author]

Posts