How MIFARE Uses Cookies

[Warren Ashman]

Hi,

I am communicating directly with the card via Scard api for Windows, no framework used. I need to know the specification for the ChangeKey command and the CRC algorithm used.
I have the specification for MF31C40, but actually have a MF3ICD81 EV1. How do I get hold of the following specification: MF3ICD81 MIFARE DESFire EV1_3.6?

Regards,

Warren

---

+ 0  |  - 0

[Warren Ashman]

This is a code example:

public void ChangeKey(byte keyNo, byte[] sessionKey, byte[] key)
{
if (key == null)
{
throw new ArgumentNullException("key");
}

if (key.Length != 16)
{
throw new ArgumentException("Invalid key length.");
}

byte[] encryptionKey;

switch (sessionKey.Length)
{
case 8:
encryptionKey = new byte[16];
Array.Copy(sessionKey, 0, encryptionKey, 0, 8);
Array.Copy(sessionKey, 0, encryptionKey, 8, 8);
break;
case 16:
case 24:
encryptionKey = sessionKey;
break;
default:
throw new ArgumentException("Invalid session key length. Must be single, double or triple DES.");
}

byte[] versionedKey = Common.Utils.VersionKey(0, key);

//ushort crc1 = Common.CheckSum.CalculateCRC16(versionedKey);
byte[] crc = Common.CheckSum.DESFireCRC(versionedKey);

byte[] data = new byte[24];
Array.Copy(versionedKey, 0, data, 0, 16);
data[16] = crc[0]; // (byte)crc;
data[17] = crc[1]; // (byte)(crc >> 8);
data[18] = 0x00;
data[19] = 0x00;
data[21] = 0x00;
data[22] = 0x00;
data[23] = 0x00;

byte[] iv = new byte[] { 0, 0, 0, 0, 0, 0, 0, 0 };
byte[] cmd = new byte[26];
cmd[0] = 0xC4;
cmd[1] = keyNo;

using (TripleDESCryptoServiceProvider provider = new TripleDESCryptoServiceProvider())
{
provider.Mode = CipherMode.CBC;
provider.BlockSize = 64;
provider.KeySize = encryptionKey.Length * 8;
provider.Padding = PaddingMode.None;

using (ICryptoTransform transform = Common.TripleDESCryptoServiceProviderHelper.CreateWeakDecryptor(provider, encryptionKey, iv))
{
byte[] encryptedData = transform.TransformFinalBlock(data, 0, data.Length);
Array.Copy(encryptedData, 0, cmd, 2, 24);
}
}

byte[] response = _reader.Transmit(cmd);

if ((response.Length != 1) || (response[0] != 0))
{
throw new Common.CardException("A6118", String.Format("Failed to change key number 0x{0:X2}. Status 0x{1:X2}.", keyNo, response[0]));
}
}

---

+ 0  |  - 0

[Warren Ashman]

I'm not sure I follow. There is a Card Master Key (CMK) and a Application Master Key (AMK) which have default valuers of all zeros. I want to change these using ChangeKey command. According to the documentation I have this is done by decrypting with the session key:

In case the KeyNo used for authentication is the SAME as the KeyNo to be changed or if ChangeKey
Key is set to 0xE, the PCD needs to generate the data frame “deciphered key data” in the following way:
A CRC (2 bytes) is calculated over the new key data (16 bytes) and appended at the end. After this padding
of zeros (6 bytes) is applied to reach an adequate frame size of multiples of 8 (24 byte overall). Finally a
DES/3DES deciphering operation (using the current session key) is performed on the whole key data field.
The three cryptogram blocks are chained using the CBC send mode.

The problem is I can't get it to work, I get the error response 1E.

Regards,

Warren

---

+ 0  |  - 0

[Author]

Posts