After an NTag/MIFARE Ultralight is activated, the host uses this command to send commands and receive responses to and from a NTag/MIFARE Ultralight.
Applies to: All Dyna Family products
Section
Information
After an NTag/MIFARE Ultralight is activated, the host uses this command to send commands and receive responses to and from a NTag/MIFARE Ultralight.
After a MIFARE Tag is activated, the host uses this command to send commands and receive responses to and from a MIFARE tag.
After a MIFARE DESFire Light/EV1/EV2/EV3 Tag is activated, the host uses this command to send commands and receive responses to and from a MIFARE DESFire Tag.
After a MIFARE Plus EV1/EV2/SE/X Tag is activated, the Host uses this command to send commands and receive responses to and from a MIFARE Plus tag.
Need Help?
For additional support, please contact MagTek Support:
Technical Support:
📧 Email: support@magtek.com
📞 Phone: 1-562-546-6800 (US)
🕐 Hours: Monday-Friday, 5:30 AM - 5:00 PM PST
Online Resources:
🌐 Support Portal: developer.magtek.com
Documentation Feedback:
Help us improve this documentation!
After a MIFARE DESFire Light/EV1/EV2/EV3 Tag is activated, the host uses this command to send commands and receive responses to and from a MIFARE DESFire Tag.
There will be a fixed 30 second timeout for commands that require multiple command/responses.
Timeout: 30 seconds for commands that require multiple command/responses.
If the request started successfully, the Request Status in the message wrapper is: OK, Started / Running, All good / requested operation was successful.
81
var
Command to Send. See DESFire Data Sheet (MF2DLHX0). Should follow ISO 7816-4 APDU format:
C-APDU
CLA INS P1 P2 Lc Data Le
B
R
82
01
00 – No Encrypt 01 - Encrypt
83
01
00 – Expect More Commands 01 – FF (Last Command). If last command, Device will provide a single beep after receiving a successful response from tag; otherwise, device will provide a double beep.
B
R
End of any wrappers, at minimum including Request Message
1102
Pass Through Command for MIFARE DESFire, Type 4 - Command 0x1102
81
02
Tag Response (SW1 SW2). See DESFire Data Sheet (MF2DLHX0). Should follow ISO 7816-4 APDU format:
SW1 and SW2 of R-APDU
If card is not able to respond:
SW1 = 0x64, SW2 = 0x00
B
R
N/A
82
var
Tag Data:
Data of R-APDU
Encryption Control: If encrypted, see Table XXX- Payload for Encrypted NFC/MIFARE Data. If unencrypted, see Table XXX– Unencrypted NFC/MIFARE Data.
B
O
N/A
End of any wrappers, at minimum including Response Message
/DFDF50
var
Encrypted Data KSN
B
R
/DFDF51
01
Encrypted Data Encryption Type. See Encryption Type for a list of valid values.
B
R
End of Notification Message
/DF7A
var
NFC/MIFARE Data
B
O
Beginning of any wrappers, at minimum including Request Message
1102
Pass Through Command for MIFARE DESFire, Type 4 - Command 0x1102
Beginning of any wrappers, at minimum including Response Message
/DFDF59
var
Encrypted Data Primitive. Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Data KSN parameter and the Encrypted Data Encryption Type parameter to read its contents. The format of the decrypted data is shown in Table XXX.
B
FC
var
NFC/MIFARE Data Container
T
R
R
AA 00 81 04 01 13 11 02 84 0F 11 02 81 05 90 60 00 00 00 82 01 00 83 01 00AA 00 81 04 82 13 11 02 82 04 01 00 00 00 84 14 11 02 81 02 91 AF 82 0C FC 0A DF 7A 07 04 08 01
30 00 13 05After a MIFARE Tag is activated, the host uses this command to send commands and receive responses to and from a MIFARE tag.
For MIFARE Plus EV1/EV2/SE/X at SL1 (Security Level 1), the tag is discovered as MIFARE Classic, and can use the same functionality as MIFARE Classic 1K/4K commands in Table XX – MIFARE Classic/MINI® Commands. Furthermore, an additional optional AES authentication is available in this level without affecting the MIFARE Classic 1K/4K functionality. The authenticity of the card can be proven using strong cryptographic means with this additional functionality. In addition to the backwards compatibility mode, MIFARE Plus card can be switched to higher security levels. After MIFARE Plus is authenticated with AES Security Level 1 Key, the Device doesn’t auto detect an error from the MIFARE Tag has been removed to end the pass-through session. To end the pass-through session, the Host application can send the last command, the CANCEL command (0xFF), or receive an error response from the MIFARE Tag.
81
var
Command to Send. See Table XX – MIFARE Classic/MINI® Commands See Table XX – MIFARE Plus EV1/EV2/SE/X SL1 (Security Level 1) Commands
B
R
82
01
00 – No Encrypt 01 - Encrypt
83
01
00 – Expect More Commands 01 – FF (Last Command). If last command, Device will provide a single beep after receiving a successful response from tag, otherwise, device will provide a double beep.
B
R
End of any wrappers, at minimum including Request Message
MIFARE Increment
Byte 0 – 0xC1 – Increment Command Byte 1 – Source Sector Number Byte 2 – Source Block Number Byte 3 – Key Type 0 = A, 1 = B Byte 4 to 9 = 6 Byte Key Byte 10 to 13 = 4 Byte Operand
MIFARE Decrement
Byte 0 – 0xC0 – Decrement Command Byte 1 – Source Sector Number Byte 2 – Source Block Number Byte 3 – Key Type 0 = A, 1 = B Byte 4 to 9 = 6 Byte Key Byte 10 to 13 = 4 Byte Operand
MIFARE Restore
Byte 0 – 0xC2 – Restore Command Byte 1 – Source Sector Number Byte 2 – Source Block Number Byte 3 – Key Type 0 = A, 1 = B Byte 4 to 9 = 6 Byte Key
MIFARE Transfer
Byte 0 – 0xB0 – Write the value from the Transfer Buffer into destination block number Byte 1 – Destination Sector Number Byte 2 – Destination Block Number Byte 3 – Key Type 0 = A, 1 = B Byte 4 to 9 = 6 Byte Key
Y
Y
Y
Following Authenticate (part 1 and part 2)
3
Following Authenticate. Use this command for an option to put the NFC tag in Security Level 1 AES Authenticated before sending MIFARE Classic commands. Byte 0 = 0x76 Byte 1-2 = Security Level 1 Card Authentication Key. See NXP doc ds206234, table 113. Byte 3 = MIFARE Plus AES_Key# (same key numbering as First Authenticate)
Y
Y
Y
Y
READ_SIG
2
The READ_SIG command returns an IC-specific, 48-byte ECC originality check signature. Byte 0 = 0x3C Byte 1 = 0x00, RF
Y
Y
N
N
Personalize UID
2
Set anti-collision, selection and authentication behavior. The execution of this command requires an authentication to MF Classic sector 0 (use MIFARE Read command sector 0 from Table 96 – MIFARE Classic/MINI® Commands).
Once this command has been issued and accepted by the PICC, the configuration is automatically locked. A subsequently issued ‘Personalize UID Usage’ command is not executed and fails.
Byte 0 = 0x40 Byte 1 = Encoded type of UID usage: - 0x00 = UIDF0 = anti-collision and selection with the double size UID (7-byte) according to ISO/IEC14443-3 - 0x40 = UIDF1 = anti-collision and selection with the double size UID (7-byte) according to ISO/IEC14443-3 and optional usage of a selection process shortcut - 0x20 = UIDF2 = anti-collision and selection with a single size random ID (4-byte) according to ISO/IEC14443-3. After the card is configured with random ID, it won’t be able to perform any MF Classic authentication since MF Classic authentication requires UID. - 0x60 = UIDF3 = anti-collision and selection with a single size NUID (4-byte) according to ISO/IEC14443-3 where the NUID is calculated out of the 7-byte UID
Y
Y
N
N
CANCEL
1
This command is used to terminate the pass-through command session.
Byte 0 = 0xFF
Y
Y
Y
Y
1101 = Command 0x1101 – Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1), Type 2
81
var
Tag Response Code
Byte 0 = 0x00 = Success
Byte 0 = 0x01 = I/O Failed Byte 0 = 0x02 = Authentication Failed Byte 1 = 0x01 = Block that Failed (optional)
B
R
N/A
82
var
Encryption Control. If encrypted, see Table XX - Payload for Encrypted NFC/MIFARE Data. If unencrypted see Table XX – Unencrypted NFC/MIFARE Data.
B
O
N/A
End of any wrappers, at minimum including Response Message
/DFDF50
var
Encrypted Data KSN
B
R
/DFDF51
01
Encrypted Data Encryption Type. See Encryption Type for a list of valid values.
B
R
End of any wrappers, at minimum including Response Message
/DF7A
var
NFC/MIFARE Data
B
O
Beginning of any wrappers, at minimum including Request Message
1101 = Command 0x1101 – Pass Through Command for MIFARE Classic/MINI®/Plus SL1 (Security Level 1), Type 2
MIFARE Read
Byte 0 – 0x30 – Read Command Byte 1 – Sector Number to Read Byte 2 – Start Block Number Byte 3 – End Block Number Byte 4 – Key Type, 0 = A, 1 = B Byte 5 to 10 = 6 Byte Key
MIFARE Write
Byte 0 – 0xA0 – Write Command Byte 1 – Sector Number to Write Byte 2 – Start Block Number Byte 3 – End Block Number Byte 4 – Key Type 0 = A, 1 = B Byte 5 to 10 = 6 Byte Key Byte 11 to x = Variable length Byte Data (16 bytes per block)
First Authenticate (part1 and part2)
3
First Authenticate. Use this command to switch to higher security levels. This command is behaved as the last command. Device will provide a single beep after receiving a successful response from a card, otherwise, device will provide a double beep.
Byte 0 = 0x70 Byte 1-2 = Level 2 Switch Key (MIFARE Plus X only), or Level 3 Switch Key. See NXP doc ds206234, table 113. Byte 3 = MIFARE Plus AES_Key# - 0x01 = AES_Key1 = 16 bytes value stored in Property 1.2.1.1.4.5 MIFARE Plus AES_Key1. - 0x02 = AES_Key2 = 16 bytes value stored in Property 1.2.1.1.4.6 MIFARE Plus AES_Key2. - 0x03 = AES_Key3 = 16 bytes value stored in Property 1.2.1.1.4.7 MIFARE Plus AES_Key3. - 0x04 = AES_Key4 = 16 bytes values stored in Property 1.2.1.1.4.8 MIFARE Plus AES_Key4. - 0x05 = AES_Key5 = 16 bytes values stored in Property 1.2.1.1.4.9 MIFARE Plus AES_Key5. - 0x06 = AES_Key6 = 16 bytes values stored in Property 1.2.1.1.4.A MIFARE Plus AES_Key6.
Beginning of any wrappers, at minimum including Response Message
/DFDF59
var
Encrypted Data Primitive. Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Data KSN parameter and the Encrypted Data Encryption Type parameter to read its contents. The format of the decrypted data is shown in Table XXX.
B
FC
var
NFC/MIFARE Data Container
T
If the request started successfully, the Request Status in the message wrapper is: OK, Started / Running, All good / requested operation was successful.
Y
R
R
AA 00 81 04 01 19 11 01 84 15 11 01 81 0B 30 00 00 00 00 FF FF FF FF FF FF 82 01 00 83 01 00AA 00 81 04 82 19 11 01 82 04 01 00 00 00 84 1C 11 01 81 01 00 82 15 FC 13 DF 7A 10 A4 FB 0D 3E
6C 08 04 00 03 0D C0 90 EE BF BB 1D
After an NTag/MIFARE Ultralight is activated, the host uses this command to send commands and receive responses to and from a NTag/MIFARE Ultralight. Do not change the address 0x00 for read protection of Ultralight C/AES card because the device will fail to access the card if the address 0x00 is read protected.
If the request started successfully, the Request Status in the message wrapper is OK, Started / Running, All good / requested operation was successful.
Fast Read
3
The FAST_READ command requires a start page address and an end page address and returns the all n*4 bytes of the addressed pages. For example, if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x3A Byte 2 = Start Page Address Byte 3 = End Page Address
Write
6
The WRITE command requires a block address, and writes 4 bytes of data into the addressed NTAG21x page. Byte 0 = 0xA2 Byte 1 = Address to Write Byte 2 to 5 = 4 Bytes of Data to Write
Compatibility Write
18
The COMPATIBILITY_WRITE command is implemented to guarantee interoperability with the established MIFARE Classic PCD infrastructure, in case of coexistence of ticketing and NFC applications. Even though 16 bytes are transferred to NTAG21x, only the least significant 4 bytes (bytes 0 to 3) are written to the specified address. Set all the remaining bytes, 04h to 0Fh, to logic 00h. Byte 0 = 0xA0 Byte 1 = Address to Write Byte 2 to 17 = 16 Bytes of Data to Write (only least significant 4 bytes are written) Note: This command is sent in 2 steps, which the Firmware will handle
READ_CNT
2
The READ_CNT command is used to read out the current value of the NFC one-way counter of the NTAG213, NTAG215 and NTAG216. The command has a single argument specifying the counter number and returns the 24-bit counter value of the corresponding counter. If the NFC_CNT_PWD_PROT bit is set to 1b the counter is password protected and can only be read with the READ_CNT command after a previous valid password authentication Byte 0 = 0x39 Byte 1 = 0x02 (NFC Counter Address)
PWD_AUTH
5
A protected memory area can be accessed only after a successful password verification using the PWD_AUTH command. The AUTH0 configuration byte defines the protected area. It specifies the first page that the password mechanism protects. The level of protection can be configured using the PROT bit either for write protection or read/write protection. The PWD_AUTH command takes the password as parameter and, if successful, returns the password authentication acknowledge, PACK. By setting the AUTHLIM configuration bits to a value larger than 000b, the number of unsuccessful password verifications can be limited. Each unsuccessful authentication is then counted in a counter featuring anti-tearing support. After reaching the limit of unsuccessful attempts, the memory access specified in PROT, is no longer possible. Byte 0 = 0x1B Byte 1..4 = password (4 bytes)
READ_SIG
2
The READ_SIG command returns an IC specific, 32-byte ECC signature, to verify NXP Semiconductors as the silicon vendor. The signature is programmed at chip production and cannot be changed afterwards. Byte 0 = 0x3C Byte 1 = 0x00, RFU
Fast Read
3
The FAST_READ command requires a start page address and an end page address and returns the all n*4 bytes of the addressed pages. For example, if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x3A Byte 2 = Start Page Address Byte 3 = End Page Address
Write
6
The WRITE command requires a block address, and writes 4 bytes of data into the addressed MIFARE Ultralight EV1 page. Byte 0 = 0xA2 Byte 1 = Address to Write Byte 2 to 5 = 4 Bytes of Data to Write
Compatibility Write
18
The COMPATIBILITY_WRITE command is implemented to accommodate the established MIFARE Classic PCD infrastructure. Even though 16 bytes are transferred to the MF0ULx1, only the least significant 4 bytes (bytes 0 to 3) are written to the specified address. Set all the remaining bytes, 04h to 0Fh, to logic 00h Byte 0 = 0xA0 Byte 1 = Address to Write Byte 2 to 17 = 16 Bytes of Data to Write (only least significant 4 bytes are written) Note: This command is sent in 2 steps, which the Firmware will handle
READ_CNT
2
The READ_CNT command is used to read out the current value of one of the 3 one-way counters of the MF0ULx1. The command has a single argument specifying the counter number and returns the 24-bit counter value of the corresponding counter. The counters are always readable, independent on the password protection settings. Byte 0 = 0x39 Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02)
INCR_CNT
6
The INCR_CNT command is used to increment one of the 3 one-way counters of the MF0ULx1. The two arguments are the counter number and the increment value. Byte 0 = 0xA5 Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02) Byte 2 to 5 = 4 bytes increment value (only the 3 least significant bytes are relevant)
PWD_AUTH
5
A protected memory area can be accessed only after a successful password verification using the PWD_AUTH command. The AUTH0 configuration byte defines the protected area. It specifies the first page that the password mechanism protects. The level of protection can be configured using the PROT bit either for write protection or read/ write protection. The PWD_AUTH command takes the password as parameter and, if successful, returns the password authentication acknowledge, PACK. By setting the AUTHLIM configuration bits to a value larger than 000b, the number of unsuccessful password verifications can be limited. Each unsuccessful authentication is then counted in a counter featuring anti-tearing support. After reaching the limit of unsuccessful attempts, the memory access specified in PROT, is no longer possible. Byte 0 = 0x1B Byte 1..4 = password (4 bytes)
READ_SIG
2
The READ_SIG command returns an IC specific, 32-byte ECC signature, to verify NXP Semiconductors as the silicon vendor. The signature is programmed at chip production and cannot be changed afterwards. Byte 0 = 0x3C Byte 1 = 0x00, RFU
CHECK TEARING_EVENT
2
The CHECK_TEARING_EVENT command enables the application to identify if a tearing event happened on a specified counter element. It takes the counter number as single argument and returns a specified valid flag for this counter. If the returned valid flag is not equal to the predefined value, a tearing event happened. Note, although a tearing event might have happened on the counter, a valid value corresponding to the last valid counter status is still available using the READ_CNT command. Byte 0 = 0x3E Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02)
VCSL
21
The VCSL command is used to enable a unique identification and selection process across different MIFARE product-based cards and card implementations on mobile devices. The command requires a 16-byte installation identifier IID and a 4-byte PCD capability value as parameters. The parameters are present to support compatibility to other MIFARE product-based devices but are not used or checked inside the MF0ULx1. Nevertheless, the number of bytes is checked for correctness. The answer to the VCSL command is the virtual card type identifier VCTID. This identifier indicates the type of card or ticket. Using this information, the reader can decide whether the ticket belongs to the installation or not. Byte 0 = 0x4B Byte 1 to 16 = 16-byte IID (installation identifier, can be any number) Byte 17 to 20 = 4-byte PCDCAPS (PCD capabilities, can be any number)
Compatibility Write
18
The COMPATIBILITY_WRITE command was implemented to accommodate the established MIFARE PCD infrastructure. Even though 16 bytes are transferred to the MF0ICU2, only the least significant 4 bytes (bytes 0 to 3) will be written to the specified address. It is recommended to set the remaining bytes 4 to 15 to all 0.
Byte 0 = 0xA0
Byte 1 = Address to Write
Byte 2 to 17 = 16 Bytes of Data to Write (only least significant 4 bytes are written)
Note: This command is sent in 2 steps, which the Firmware will handle
AUTHENTICATE
2
The AUTHENTICATE command is used to authenticate the MF0ICU2 using 2 keys 3DES encryption in Cipher-Block Chaining (CBC) mode as described in ISO/IEC 10116.
The 16-byte of the 2keys 3DES are programmed to card memory pages from 2Ch to 2Fh. The key itself can be written during personalization or at any later stage using the WRITE or COMPATIBILITY WRITE with Byte 0 is always sent first. On example of Key1 = 0001020304050607h and Key2 = 08090A0B0C0D0E0Fh, the command sequence needed for key programming with WRITE command is:
• A2 2C 07 06 05 04
• A2 2D 03 02 01 00
• A2 2E 0F 0E 0D 0C
• A2 2F 0B 0A 09 08
Fast Read
3
The FAST_READ command requires a start page address and an end page address and returns bytes of addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h, and 07h are returned. If either start or end address is outside accessible area, then MIFARE Ultralight AES replies with a NAK.
Byte 0 = 0x3A
Byte 2 = Start Page Address
Byte 3 = End Page Address
Write
6
The WRITE command requires a block address, and writes 4 bytes of data into the addressed MIFARE Ultralight AES page.
Byte 0 = 0xA2
Byte 1 = Address to Write Byte
2 to 5 = 4 Bytes of Data to Write
READ_CNT
2
The READ_CNT command is used to read out the current value of one of the 3 one-way counters of MIFARE Ultralight AES. The command has a single argument specifying the counter number and returns the 24-bit counter value of the corresponding counter. Counters are always readable, except in case of the counter "0x02" with the optional AES authentication protection enabled. In that case, the counter 0x02 is readable only in the AUTHENTICATE state.
Byte 0 = 0x39
Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02)
INCR_CNT
6
The INCR_CNT command is used to increment one of the 3x one-way counters of the MIFARE Ultralight AES. Two arguments are the counter number and the increment value. Counters are always incrementable, except in case of the counter "0x02" with the optional AES authentication protection enabled. In that case, the counter 0x02 can be incremented only in the AUTHENTICATE state.
Byte 0 = 0xA5
Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02)
READ_SIG
2
The READ_SIG command returns an IC-specific, 48-byte ECC signature. The originality signature can be changed if it has been unlocked with the LOCK_SIG command.
Byte 0 = 0x3C
Byte 1 = 0x00, RFU
WRITE_SIG
6
The WRITE_SIG command allows the writing of a customized originality signature into the dedicated originality signature memory. The WRITE_SIG command requires an originality signature block address, and writes 4 bytes of data into the addressed originality signature block.
In the initial state of MIFARE Ultralight AES, the following originality signature blocks 00h to 0Bh are valid Addr parameters to the WRITE_SIG command. Addressing a memory block beyond the limits above results in a NAK response from MIFARE Ultralight AES.
If the originality signature is locked or permanently locked, a WRITE_SIG command results in a NAK response from the MIFARE Ultralight AES.
Byte 0 = 0xA9
LOCK_SIG
2
The LOCK_SIG command allows the user to unlock, lock or permanently lock the dedicated originality signature memory.
The originality signature can only be unlocked, if the originality signature is not permanently locked.
There is no command to unlock the originality signature, if the originality signature is permanently locked.
Byte 0 = 0xAC
Byte 1 = lock option
0x00 = unlock
VCSL
21
The VCSL command is used to enable a unique identification and selection process across different physical MIFARE product-based cards and virtual MIFARE implementations. The command requires a 16-byte installation identifier IID and a 4-byte PCD capability value as parameters. The parameters are present to support compatibility to other MIFARE product-based devices, but are not used or checked inside the MIFARE Ultralight AES. Nevertheless, the number of bytes is checked for correctness. The answer to the VCSL command is the VCTID value stored in the user configuration segment. This identifier indicates the type of card or ticket. Using this information, the contactless reader can decide whether the ticket belongs to the installation or not.
Byte 0 = 0x4B
Byte 1 to 16 = 16-byte IID (installation identifier, can be any number) Byte 17 to 20 = 4-byte PCDCAPS (PCD capabilities, can be any number)
AUTHENTICATE
2
The AUTHENTICATE command is used to authenticate with a 3-pass mutual authentication the MIFARE Ultralight AES and PCD. The cryptographic method is based on AES in Cipher-Block chaining (CBC) mode according to NIST Special Publication 800-38A. The used key is a 128-bit AES Key. Remark: To reduce the risk on card- only side channel attack to the AES keys, a failed authentication limit (AUTH_LIM) can be set.
The 16 bytes of the AES [DataProtKey] are programmed to memory pages from 30h to 33h. Keys themselves can be written during personalization or at any later stage in a secure environment, as long as the key is not locked for update in the user configuration segment. AES [UIDRetrKey] is stored in memory addresses from 34h until 37h. In case keys are not locked, MIFARE Ultralight AES allows to change AES-keys without authentication as long as AUTH0 is not set to a page address before or at page address where keys bytes are stored. Otherwise MIFARE Ultralight AES requires to be in the AUTHENTICATED state to allow to write AES keys.
The key itself can be written using the WRITE with Byte 0 is always sent first.
1100
Pass Through Command For NTag/MIFARE Ultralight, Type 2 Command For NFC Tag - Command 0x1100
81
01
Tag Response Code 0x00 = Success 0x01 = Failed
B
R
N/A
82
var
Encryption Control. If encrypted, see Table XX - Payload for Encrypted NFC/MIFARE Data. If unencrypted see Table 94 – Unencrypted NFC/MIFARE Data.
B
O
N/A
End of any wrappers, at minimum including Response Message
/DFDF50
var
Encrypted Data KSN
B
R
/DFDF51
01
Encrypted Data Encryption Type. See section 4.4 Encryption Type for a list of valid values.
B
R
End of Notification Message
/DF7A
var
NFC Data
B
O
Beginning of any wrappers, at minimum including Request Message
1100
Pass Through Command For NTag/MIFARE Ultralight, Type 2 - Command 0x1100
81
var
Command to Send.
See Table XX – NTag Commands
See Table XX – MIFARE Ultralight EV1 Commands
See Table XX – MIFARE Ultralight C Commands
See Table XX – MIFARE Ultralight AES Commands
B
R
82
01
00 – No Encrypt
01 - Encrypt
B
R
83
01
00 – Expect More Commands
01 – FF (Last Command).
If the pass-through command is the last successful command, the device will end the transaction with a single beep, indicating success.
If an error arises, the device will end the transaction but will sound two beeps to indicate the error. The user should then remove the card.
B
R
End of any wrappers, at minimum including Request Message
Get Version
1
The GET_VERSION command is used to retrieve information on the NTAG family, the product version, storage size and other product data required to identify the specific NTAG21x. Byte 0 = 0x60
Read
2-3
The READ command requires a start page address, and returns the 16 bytes of four NTAG21x pages. For example, if address is 03h then pages 03h, 04h, 05h, 06h are returned. Special conditions apply if the READ command address is near the end of the accessible memory area. The special conditions also apply if at least part of the addressed pages is within a password protected area. The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x30 Byte 1 = Start Page Address Byte 2 = (optional) End Page Address
Get Version
1
The GET_VERSION command is used to retrieve information on the MIFARE family, product version, storage size and other product data required to identify the MF0ULx1. Byte 0 = 0x60
Read
2-3
The READ command requires a start page address, and returns the 16 bytes of four MIFARE Ultralight pages. For example if address (Addr) is 03h then pages 03h, 04h, 05h, 06h are returned. A rollover mechanism is implemented if the READ command address is near the end of the accessible memory area. This rollover mechanism is also used when at least part of the addressed pages is within a password protected area. The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x30 Byte 1 = Start Page Address Byte 2 = (optional) End Page Address
Read
2-3
The READ command takes the page address as a parameter. Only addresses 00h to 2Bh are decoded. For higher addresses the MF0ICU2 returns a NAK. The MF0ICU2 responds to the READ command by sending 16 bytes starting from the page address defined in the command (e.g. if ADR is 03h, pages 03h, 04h, 05h, 06h are returned) A roll-over mechanism is implemented to continue reading from page 00h once the end of the accessible memory is reached. For example, reading from address 29h on a MF0ICU2 results in pages 29h, 2Ah, 2Bh and 00h being returned. The following conditions apply if part of the memory is protected by the 3DES authentication for read access:
if the MF0ICU2 is in the ACTIVE state – addressing a page which is equal or higher than AUTH0 results in a NAK response – addressing a page lower than AUTH0 results in data being returned with the roll-over mechanism occurring just before the AUTH0 defined page
if the MF0ICU2 is in the AUTHENTICATED state – the READ command behaves like on a MF0ICU2 without access protection. The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x30 Byte 1 = Start Page Address Byte 2 = (optional) End Page Address
The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned.
Byte 0 = 0x30
Byte 1 = Start Page Address
Byte 2 = (optional) End Page Address
Write
6
The WRITE command is used to program the lock bytes in page 02h, the OTP bytes in page 03h, data bytes in pages 04h to 27h, configuration data from page 28h to 2B and keys from page 2Ch to 2Fh. A WRITE command is performed page-wise, programming 4 bytes in a page.
Byte 0 = 0xA2
Byte 1 = Address to Write
Byte 2 to 5 = 4 Bytes of Data to Write
Get Version
1
The GET_VERSION command is used to retrieve information on the MIFARE family, product version, storage size and other product data required to identify the MIFARE Ultralight AES.
Byte 0 = 0x60
Read
2-3
The READ command requires a start page address, and returns the 16 bytes of four pages. For example, if address (Addr) is 03h then pages 03h, 04h, 05h, 06h are returned. So called roll-over mechanism (described later) applies if the READ command address is near the end of the accessible memory area. Same mechanism applies if at least part of the addressed pages is within an authentication protected area.
In the default state of MIFARE Ultralight AES, all memory pages in the range from 00h to 3Bh are allowed as Addr parameter to the READ command. Addressing a memory page above the limit results in a NAK response. A roll-over mechanism is implemented to continue reading from page 00h once the end of the accessible memory is reached if at least first addressed page is within allowed limit.
Remark: AES key values can never be directly read out of the memory. When reading from the pages holding key values, all 00h bytes are returned.
The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned.
Byte 0 = 0x30
Byte 1 = Start Page Address
Byte 2 = (optional) End Page Address
Beginning of any wrappers, at minimum including Response Message
AA 00 81 04 01 39 11 00 84 0B 11 00 81 01 60 82 01 00 83 01 00AA 00 81 04 82 39 11 00 82 04 01 00 00 00 84 14 11 00 81 01 00 82 0D FC 0B DF 7A
08 01 02 03 04 05 06 07 08/DFDF59
var
Encrypted Data Primitive.
Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Data KSN parameter and the Encrypted Data Encryption Type parameter to read its contents. The format of the decrypted data is shown in Table 94 – Unencrypted NFC/MIFARE Data.
B
FC
var
NFC Data Container
T
R
R
<CMD><Address to Write><CRCH><CRCL>
<16 Bytes of Data to Write><CRCH><CRCL>
The 16-byte of the same 2keys 3DES are programed to the Device using Property 1.2.1.1.4.1 MIFARE Ultralight C 2keys3DES
Byte 0 = 0x1A
Byte 1 = 0x00
Byte 2 to 5 = signature bytes to be written
0x01 = lock
0x02 = permanently lock
sequence needed for key programming with WRITE command is:
• A2 30 0F 0E 0D 0C
• A2 31 0B 0A 09 08
• A2 32 07 06 05 04
• A2 33 03 02 01 00
On example of AES [UIDRetrKey] = 000102030405060708090A0B0C0D0E0Fh, the command
sequence needed for key programming with WRITE command is:
• A2 34 0F 0E 0D 0C
• A2 35 0B 0A 09 08
• A2 36 07 06 05 04
• A2 37 03 02 01 00
The 16-byte of the same AES [DataProtKey] are programed to the Device using Property 1.2.1.1.4.2 MIFARE Ultralight AES DataProtKey.
The 16-byte of the same AES [UIDRetrKey] are programed to the Device using Property 1.2.1.1.4.3 MIFARE Ultralight AES UIDRetrKey.
The 16-byte of the AES [OriginalityKey] are programed to the Device using Property 1.2.1.1.4.4 MIFARE Ultralight AES OriginalityKey. This key value is only known by NXP.
Byte 0 = 0x1A
Byte 1 = Key option
0x00 = DataProtKey
0x01 = UIDRetrKey
0x02 = OriginalityKey
After a MIFARE Plus EV1/EV2/SE/X Tag is activated, the Host uses this command to send commands and receive responses to and from a MIFARE Plus tag.
For MIFARE Plus SE/X, the Device will not auto detect an error from the MIFARE Tag that has been removed to end the pass-through session. To end the pass-through session, the Host application can send the last command, CANCEL command (0xFF), or receive error response from the MIFARE Tag.
For MIFARE Plus EV1/EV2 at Security Level 3, after the first Read/Write/Value operation, the Device will not auto detect an error from the MIFARE Tag that has been removed to end the pass-through session. To end the pass-through session, the Host application can send the last command, CANCEL command (0xFF), or receive error response from the MIFARE Tag.
After the card is configured to successfully switch to Security Level 1, the card will be discovered as MIFARE Classic 1K/4K and can use the same functionality as MIFARE Classic 1K/4K commands.
For more details, please refer to NXP NDA documentation ds206234-Product data sheet MIFARE Plus Functionality of implementations on smart card controllers (3.4)
If the request started successfully, the Request Status in the message wrapper is OK, Started / Running, All good / requested operation was successful.
1103 = Pass Through Command for MIFARE Plus, Type 2 - Command 0x1103 –
81
var
Command to Send. See Table 110 - MIFARE Plus EV1/EV2/SE/X SL0 (Security Level 0) Commands. See Table 111 – MIFARE Plus EV1/EV2/SE/X SL3 (Security Level 3) Commands
B
R
82
01
00 – No Encrypt 01 - Encrypt
83
01
00 – Expect More Commands 01 – FF (Last Command) If this is the last command, the Device will provide a single beep after receiving a successful response from the tag, otherwise, the device will provide a double beep
B
R
End of any wrappers, at minimum including Request Message
Y
N
N
READ_SIG
2
The READ_SIG command returns an IC-specific, 48-byte ECC originality check signature of MIFARE Plus EV1/EV2 cards. Byte 0 = 0x3C Byte 1 = 0x00, RFU
Y
Y
N
N
WRITE_PERSO
19
The WRITE_PERSO command is used to pre-personalize AES keys and data from the initial delivery configuration to a customer specific value.
Byte 0 = 0xA8
Byte 1-2 = Number of Block or Key to be written to (MSB first). See NXP doc ds206234, table 113.
Byte 3 to 18 = 16 bytes value of the key or data which shall be written (in plain)
Y
Y
Y
Y
COMMIT_PERSO
2
The COMMIT_PERSO command is used to finalize the personalization and switch up to security level 1 or security level 3.
For MIFARE Plus EV1/EV2, the following mandatory AES keys must be written using the WRITE_PERSO command before it can be switched to security level 1 or security level 3.
Card Configuration Key
Card Master Key
Y
Y
Y
Y
CANCEL
1
This command is used to terminate the pass-through command session.
Byte 0 = 0xFF
Y
Y
Y
Y
First Authenticate (part1 and part2)
3
First Authenticate Byte 0 = 0x70 Byte 1-2 = Key Number of the key to be authenticated (MSB first). See NXP doc ds206234, table 113. Byte 3 = MIFARE Plus AES_Key#
0x01 = AES_Key1 = 16 bytes value stored in Property 1.2.1.1.4.5 MIFARE Plus AES_Key1.
0x02 = AES_Key2 = 16 bytes value stored in Property 1.2.1.1.4.6 MIFARE Plus AES_Key2.
0x03 = AES_Key3 = 16 bytes value stored in Property 1.2.1.1.4.7 MIFARE Plus AES_Key3.
Y
Y
Y
Y
Following Authenticate (part 1 and part 2)
3
Following Authenticate Byte 0 = 0x76 Byte 1-2 = Key Number of the key to be authenticated (MSB first). See NXP doc ds206234, table 113. Byte 3 = MIFARE Plus AES_Key# (same AES_Key# options as First Authenticate)
Y
Y
Y
Y
ResetAuth
1
Reset the authentication Byte 0 = 0x78
Y
Y
Y
Y
READ commands
Read
4
Reading encrypted, no MAC on response, MAC on command. This command offers the possibility to read the data from one or multiple blocks in an encrypted way. A MAC is only used on the command sent to the PICC, no MAC is attached to the response. Byte 0 = 0x30 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer.
Y
Y
Y
Y
Read MACed
4
Reading encrypted, MAC on response, MAC on Command. This command offers the possibility to read the data from one or multiple blocks in an encrypted way. A MAC is used on the command sent to the PICC and on the response received. Byte 0 = 0x31 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer.
Y
Y
Y
Y
Read Plain
4
Reading in plain, no MAC on response, MAC on command. This command offers the possibility to read the data in plain from one or multiple blocks. A MAC is used on the command and not on the response. Byte 0 = 0x32 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer.
Y
Y
Y
Y
Read Plain MACed
4
Reading in plain, MAC on response, MAC on command. This command offers the possibility to read the data in plain from one or multiple blocks. A MAC is used on the command sent to the PICC as well as on the response from the PICC Byte 0 = 0x33 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer.
Y
Y
Y
Y
Read UnMACed
4
Reading encrypted, no MAC on response, no MAC on command. This command offers the possibility to read the data from one or multiple blocks in an encrypted way. By default, Read with MAC on command is required. To Read with no MAC on command, needs to modify the card MFP Configuration Block. Byte 0 = 0x34 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer.
Y
Y
Y
Y
Read UnMACed, Response MACed
4
Reading encrypted, MAC on response, no MAC on command. This command offers the possibility to read the data from one or multiple blocks in an encrypted way. A MAC is used only on the response received. By default, Read with MAC on command is required. To Read with no MAC on command, needs to modify the card MFP Configuration Block. Byte 0 = 0x35 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer.
Y
Y
Y
Y
Read Plain UnMACed
4
Reading in plain, no MAC on response, no MAC on command. This command offers the possibility to read the data in plain from one or multiple blocks. A MAC is not used on the response and not on the command. By default, Read with MAC on command is required. To Read with no MAC on command, needs to modify the card MFP Configuration Block. Byte 0 = 0x36 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer.
Y
Y
Y
Y
Read Plain UnMACed, Response MACed
4
Reading in plain, MAC on response, no MAC on command. This command offers the possibility to read the data in plain from one or multiple blocks. A MAC is used on the response and not on the command. By default, Read with MAC on command is required. To Read with no MAC on command, needs to modify the card MFP Configuration Block. Byte 0 = 0x37 Byte 1-2 = Block number of the 1st block to be read (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01 – 0x0F = Number of blocks to be read. Sector Trailers do not count if Byte 3 > 1. Use Byte 3 = 1 for reading Sector Trailer.
Y
Y
Y
Y
WRITE commands
Y
Y
Y
Y
Write
20/36/52
Writing encrypted, no MAC on response, MAC on Command. This command offers the possibility to write the data to up to three blocks in an encrypted way. MAC is only used on the command sent to the PICC. Byte 0 = 0xA0 Byte 1-2 = Block number of the 1st to be written block (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01/0x02/0x03 = number of blocks (16 byte) of the data to be written Byte 4 – n = Data to be written, equal to number of blocks * 16.
Y
Y
Y
Y
Write MACed
20/36/52
Writing encrypted, MAC on response, MAC on command. This command offers the possibility to write the data to up to three blocks in an encrypted way. A MAC is used on the command sent to the PICC and on the response received from the PICC. Byte 0 = 0xA1 Byte 1-2 = Block number of the 1st to be written block (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01/0x02/0x03 = number of blocks (16 byte) of the data to be written Byte 4 – n = Data to be written, equal to number of blocks * 16.
Y
Y
Y
Y
Write Plain
20/36/52
Writing in plain, no MAC on response, MAC on command. This command offers the possibility to write the data to up to three blocks in plain. A MAC is only used on the command sent to the PICC. Byte 0 = 0xA2 Byte 1-2 = Block number of the 1st to be written block (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01/0x02/0x03 = number of blocks (16 byte) of the data to be written Byte 4 – n = Data to be written, equal to number of blocks * 16.
Y
Y
Y
Y
Write Plain MACed
20/36/52
Writing in plain, MAC on response, MAC on command. This command offers the possibility to write the data to up to three blocks in plain. A MAC is used on the command sent to the PICC as well as on the response from the PICC Byte 0 = 0xA3 Byte 1-2 = Block number of the 1st to be written block (MSB first). See NXP doc ds206234, table 113. Byte 3 = 0x01/0x02/0x03 = number of blocks (16 byte) of the data to be written Byte 4 – n = Data to be written, equal to number of blocks * 16.
Y
Y
Y
Y
VALUE operations
Increment
7
Increment encrypted, no MAC on response, MAC on command. This command offers the possibility to increment a value block where the command is secured by a MAC calculated, but not on the response. Byte 0 = 0xB0 Byte 1-2 = Source Block number (MSB first). Byte 3-6 = The 4 bytes value to be incremented in LSB order. Example for increment by 1: 0x01 00 00 00
Y
Y
Y
Y
Increment MACed
7
Increment encrypted, MAC on response, MAC on command. Byte 0 = 0xB1 Byte 1-2 = Source Block number (MSB first). Byte 3-6 = The 4 bytes value to be incremented in LSB order. Example for increment by 1: 0x01 00 00 00
Y
Y
Y
Y
Decrement
7
Decrement encrypted, no MAC on response, MAC on command. Byte 0 = 0xB2 Byte 1-2 = Source Block number (MSB first). Byte 3-6 = The 4 bytes value to be decremented in LSB order. Example for decrement by 1: 0x01 00 00 00
Y
Y
Y
Y
Decrement MACed
7
Decrement encrypted, MAC on response, MAC on command. Byte 0 = 0xB3 Byte 1-2 = Source Block number (MSB first). Byte 3-6 = The 4 bytes value to be decremented in LSB order. Example for decrement by 1: 0x01 00 00 00
Y
Y
Y
Y
Transfer
3
Transfer, no MAC on response, MAC on command. The Transfer command stores the content of the Transfer Buffer to the specified address. The Transfer command can be applied to any block. The Transfer command can only be executed after an Increment, Decrement, IncrementTransfer, DecrementTransfer or Restore command has been successfully executed since the latest authentication. The command is secured by a MAC on a command. No MAC is calculated on the response. Byte 0 = 0xB4 Byte 1-2 = Destination Block number (MSB first).
Y
Y
Y
Y
Transfer MACed
3
Transfer, MAC on response, MAC on command. Byte 0 = 0xB5 Byte 1-2 = Destination Block number (MSB first).
Y
Y
Y
Y
Increment Transfer
9
Increment Transfer encrypted, no MAC on response, MAC on Command. Combined increment and transfer. Byte 0 = 0xB6 Byte 1-2 = Source Block number (MSB first). Byte 3-4 = Destination Block number (MSB first). Byte 5-8 = The 4 bytes value to be incremented in LSB order. Example for increment by 1: 0x01 00 00 00
Y
Y
Y
Y
Increment Transfer MACed
9
Increment Transfer encrypted, MAC on response, MAC on command. Byte 0 = 0xB7 Byte 1-2 = Source Block number (MSB first). Byte 3-4 = Destination Block number (MSB first). Byte 5-8 = The 4 bytes value to be incremented in LSB order.
Y
Y
Y
Y
Decrement Transfer
9
Decrement Transfer encrypted, no MAC on response, MAC on command. Byte 0 = 0xB8 Byte 1-2 = Source Block number (MSB first). Byte 3-4 = Destination Block number (MSB first). Byte 5-8 = The 4 bytes value to be decremented in LSB order. Example for decrement by 1: 0x01 00 00 00
Y
Y
Y
Y
Decrement Transfer MACed
9
Decrement Transfer encrypted, MAC on response, MAC on command. Byte 0 = 0xB9 Byte 1-2 = Source Block number (MSB first). Byte 3-4 = Destination Block number (MSB first). Byte 5-8 = The 4 bytes value to be decremented in LSB order. Example for decrement by 1: 0x01 00 00 00
Y
Y
Y
Y
Restore
3
Restore encrypted, no MAC on response, MAC on command. The Restore command copies the Content found in the Value Block at the given address to the Transfer Buffer. The Restore command can only be applied to value blocks. Byte 0 = 0xC2 Byte 1-2 = Source Block number (MSB first).
Y
Y
Y
Y
Restore MACed
3
Restore encrypted, MAC on response, MAC on command. Byte 0 = 0xC3 Byte 1-2 = Source Block number (MSB first).
Y
Y
Y
Y
Others
GET_VERSION
1
The GET_VERSION command is used to retrieve manufacturing related data of the MIFARE Plus EV1/EV2 cards. This command can be sent before Read/Write/Value commands. Byte 0 = 0x60
Y
Y
N
N
READ_SIG
2
The READ_SIG command returns an IC-specific, 48-byte ECC originality check signature of MIFARE Plus EV1/EV2 cards. This command can be sent before Read/Write/Value commands. Byte 0 = 0x3C Byte 1 = 0x00, RFU
Y
Y
N
N
CANCEL
1
This command is used to terminate the pass-through command session. Byte 0 = 0xFF
Y
Y
Y
Y
1103 = Command 0x1103 – Pass Through Command for MIFARE Plus, Type 2
81
01
Tag Response Code 0x00 = Success 0x01 = Failed
B
R
N/A
82
Var
Encryption Control If encrypted, see Table 93 - Payload for Encrypted NFC/MIFARE Data. If unencrypted see Table 94 – Unencrypted NFC/MIFARE Data.
B
O
N/A
End of any wrappers, at minimum including Response Message
/DFDF50
var
Encrypted Data KSN
B
R
/DFDF51
01
Encrypted Data Encryption Type. See Encryption Type for a list of valid values.
B
R
End of Notification Message
/DF7A
var
NFC/MIFARE Data
B
O
Beginning of any wrappers, at minimum including Request Message
GET_VERSION
1
The GET_VERSION command is used to retrieve manufacturing related data of the MIFARE Plus EV1/EV2 cards Byte 0 = 0x60
MIFARE Plus Authenticate commands
Beginning of any wrappers, at minimum including Response Message
AA 00 81 04 01 DA 11 03 84 0B 11 03 81 01 60 82 01 00 83 01 00AA 00 81 04 82 DA 11 03 82 04 01 00 00 00 84 28 11 03 81 01 00 82 21 FC 1F DF
7A 1C 04 02 01 11 00 16 04 04 02 01 01 01 16 04 04 4D 59 5A 3E 18 90 CF 8D 15
61 51 21 23/DFDF59
var
Encrypted Data Primitive. Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Data KSN parameter and the Encrypted Data Encryption Type parameter to read its contents. The format of the decrypted data is shown in Table 360.
B
FC
var
NFC/MIFARE Data Container
T
Y
R
R
Level 2 Switch Key
Level 3 Switch Key
For MIFARE Plus SE, the following mandatory AES keys must be written using the WRITE_PERSO command before it can be switched to security level 1 (for L1 card) or security level 3 (for L3 card).
Card Configuration Key
Card Master Key
Level 3 Switch Key
For MIFARE Plus X, the following mandatory AES keys must be written using the WRITE_PERSO command before it can be switched to security level 1 (for L1 card) or security level 3 (for L3 card).
Card Configuration Key
Card Master Key
Level 2 Switch Key (for L1 card)
Level 3 Switch Key (for L1 card)
Byte 0 = 0xAA
Byte 1 = Security Level Option for EV1 and EV2 cards
0x01 = Security Level 1
0x03 = Security Level 3
Other values = Invalid. Device will return error.
Byte 1 = 0x00 for SE and X cards. The Device will return error for other values.
It is also highly recommended to change all sector AES keys as well as the data within this security level in a secure environment.
This command is behaved as the last command. The Device will provide a single beep after receiving a successful response from a card, otherwise, device will provide a double beep.
0x04 = AES_Key4 = 16 bytes values stored in Property 1.2.1.1.4.8 MIFARE Plus AES_Key4.
0x05 = AES_Key5 = 16 bytes values stored in Property 1.2.1.1.4.9 MIFARE Plus AES_Key5.
0x06 = AES_Key6 = 16 bytes values stored in Property 1.2.1.1.4.A MIFARE Plus AES_Key6.