Command 0x1100 – Pass Through Command For NTag/MIFARE Ultralight, Type 2
After an NTag/MIFARE Ultralight is activated, the host uses this command to send commands and receive responses to and from a NTag/MIFARE Ultralight. Do not change the address 0x00 for read protection of Ultralight C/AES card because the device will fail to access the card if the address 0x00 is read protected.
Table - Request Data for Command 0x1100 – Pass Through Command For NTag/MIFARE Ultralight, Type 2
Beginning of any wrappers, at minimum including Request Message
1100
Command 0x1100 – Pass Through Command For NTag/MIFARE Ultralight, Type 2
81
var
Command to Send.
See Table 86 – NTag Commands
See Table 87 – MIFARE Ultralight EV1 Commands
See Table 88 – MIFARE Ultralight C Commands
See Table 89 – MIFARE Ultralight AES Commands
B
R
82
01
00 – No Encrypt
01 - Encrypt
B
R
83
01
00 – Expect More Commands
01 – FF (Last Command).
If the pass-through command is the last successful command, the device will end the transaction with a single beep, indicating success.
If an error arises, the device will end the transaction but will sound two beeps to indicate the error. The user should then remove the card.
B
R
End of any wrappers, at minimum including Request Message
Table – NTag Commands
Get Version
1
The GET_VERSION command is used to retrieve information on the NTAG family, the product version, storage size and other product data required to identify the specific NTAG21x. Byte 0 = 0x60
Read
2-3
The READ command requires a start page address, and returns the 16 bytes of four NTAG21x pages. For example, if address is 03h then pages 03h, 04h, 05h, 06h are returned. Special conditions apply if the READ command address is near the end of the accessible memory area. The special conditions also apply if at least part of the addressed pages is within a password protected area. The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x30 Byte 1 = Start Page Address Byte 2 = (optional) End Page Address
Fast Read
3
The FAST_READ command requires a start page address and an end page address and returns the all n*4 bytes of the addressed pages. For example, if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x3A Byte 2 = Start Page Address Byte 3 = End Page Address
Write
6
The WRITE command requires a block address, and writes 4 bytes of data into the addressed NTAG21x page. Byte 0 = 0xA2 Byte 1 = Address to Write Byte 2 to 5 = 4 Bytes of Data to Write
Compatibility Write
18
The COMPATIBILITY_WRITE command is implemented to guarantee interoperability with the established MIFARE Classic PCD infrastructure, in case of coexistence of ticketing and NFC applications. Even though 16 bytes are transferred to NTAG21x, only the least significant 4 bytes (bytes 0 to 3) are written to the specified address. Set all the remaining bytes, 04h to 0Fh, to logic 00h. Byte 0 = 0xA0 Byte 1 = Address to Write Byte 2 to 17 = 16 Bytes of Data to Write (only least significant 4 bytes are written) Note: This command is sent in 2 steps, which the Firmware will handle
READ_CNT
2
The READ_CNT command is used to read out the current value of the NFC one-way counter of the NTAG213, NTAG215 and NTAG216. The command has a single argument specifying the counter number and returns the 24-bit counter value of the corresponding counter. If the NFC_CNT_PWD_PROT bit is set to 1b the counter is password protected and can only be read with the READ_CNT command after a previous valid password authentication Byte 0 = 0x39 Byte 1 = 0x02 (NFC Counter Address)
PWD_AUTH
5
A protected memory area can be accessed only after a successful password verification using the PWD_AUTH command. The AUTH0 configuration byte defines the protected area. It specifies the first page that the password mechanism protects. The level of protection can be configured using the PROT bit either for write protection or read/write protection. The PWD_AUTH command takes the password as parameter and, if successful, returns the password authentication acknowledge, PACK. By setting the AUTHLIM configuration bits to a value larger than 000b, the number of unsuccessful password verifications can be limited. Each unsuccessful authentication is then counted in a counter featuring anti-tearing support. After reaching the limit of unsuccessful attempts, the memory access specified in PROT, is no longer possible. Byte 0 = 0x1B Byte 1..4 = password (4 bytes)
READ_SIG
2
The READ_SIG command returns an IC specific, 32-byte ECC signature, to verify NXP Semiconductors as the silicon vendor. The signature is programmed at chip production and cannot be changed afterwards. Byte 0 = 0x3C Byte 1 = 0x00, RFU
Table – MIFARE Ultralight EV1 Commands
Get Version
1
The GET_VERSION command is used to retrieve information on the MIFARE family, product version, storage size and other product data required to identify the MF0ULx1. Byte 0 = 0x60
Read
2-3
The READ command requires a start page address, and returns the 16 bytes of four MIFARE Ultralight pages. For example if address (Addr) is 03h then pages 03h, 04h, 05h, 06h are returned. A rollover mechanism is implemented if the READ command address is near the end of the accessible memory area. This rollover mechanism is also used when at least part of the addressed pages is within a password protected area. The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x30 Byte 1 = Start Page Address Byte 2 = (optional) End Page Address
Fast Read
3
The FAST_READ command requires a start page address and an end page address and returns the all n*4 bytes of the addressed pages. For example, if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x3A Byte 2 = Start Page Address Byte 3 = End Page Address
Write
6
The WRITE command requires a block address, and writes 4 bytes of data into the addressed MIFARE Ultralight EV1 page. Byte 0 = 0xA2 Byte 1 = Address to Write Byte 2 to 5 = 4 Bytes of Data to Write
Compatibility Write
18
The COMPATIBILITY_WRITE command is implemented to accommodate the established MIFARE Classic PCD infrastructure. Even though 16 bytes are transferred to the MF0ULx1, only the least significant 4 bytes (bytes 0 to 3) are written to the specified address. Set all the remaining bytes, 04h to 0Fh, to logic 00h Byte 0 = 0xA0 Byte 1 = Address to Write Byte 2 to 17 = 16 Bytes of Data to Write (only least significant 4 bytes are written) Note: This command is sent in 2 steps, which the Firmware will handle
READ_CNT
2
The READ_CNT command is used to read out the current value of one of the 3 one-way counters of the MF0ULx1. The command has a single argument specifying the counter number and returns the 24-bit counter value of the corresponding counter. The counters are always readable, independent on the password protection settings. Byte 0 = 0x39 Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02)
INCR_CNT
6
The INCR_CNT command is used to increment one of the 3 one-way counters of the MF0ULx1. The two arguments are the counter number and the increment value. Byte 0 = 0xA5 Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02) Byte 2 to 5 = 4 bytes increment value (only the 3 least significant bytes are relevant)
PWD_AUTH
5
A protected memory area can be accessed only after a successful password verification using the PWD_AUTH command. The AUTH0 configuration byte defines the protected area. It specifies the first page that the password mechanism protects. The level of protection can be configured using the PROT bit either for write protection or read/ write protection. The PWD_AUTH command takes the password as parameter and, if successful, returns the password authentication acknowledge, PACK. By setting the AUTHLIM configuration bits to a value larger than 000b, the number of unsuccessful password verifications can be limited. Each unsuccessful authentication is then counted in a counter featuring anti-tearing support. After reaching the limit of unsuccessful attempts, the memory access specified in PROT, is no longer possible. Byte 0 = 0x1B Byte 1..4 = password (4 bytes)
READ_SIG
2
The READ_SIG command returns an IC specific, 32-byte ECC signature, to verify NXP Semiconductors as the silicon vendor. The signature is programmed at chip production and cannot be changed afterwards. Byte 0 = 0x3C Byte 1 = 0x00, RFU
CHECK TEARING_EVENT
2
The CHECK_TEARING_EVENT command enables the application to identify if a tearing event happened on a specified counter element. It takes the counter number as single argument and returns a specified valid flag for this counter. If the returned valid flag is not equal to the predefined value, a tearing event happened. Note, although a tearing event might have happened on the counter, a valid value corresponding to the last valid counter status is still available using the READ_CNT command. Byte 0 = 0x3E Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02)
VCSL
21
The VCSL command is used to enable a unique identification and selection process across different MIFARE product-based cards and card implementations on mobile devices. The command requires a 16-byte installation identifier IID and a 4-byte PCD capability value as parameters. The parameters are present to support compatibility to other MIFARE product-based devices but are not used or checked inside the MF0ULx1. Nevertheless, the number of bytes is checked for correctness. The answer to the VCSL command is the virtual card type identifier VCTID. This identifier indicates the type of card or ticket. Using this information, the reader can decide whether the ticket belongs to the installation or not. Byte 0 = 0x4B Byte 1 to 16 = 16-byte IID (installation identifier, can be any number) Byte 17 to 20 = 4-byte PCDCAPS (PCD capabilities, can be any number)
Table – MIFARE Ultralight C Commands
Read
2-3
The READ command takes the page address as a parameter. Only addresses 00h to 2Bh are decoded. For higher addresses the MF0ICU2 returns a NAK. The MF0ICU2 responds to the READ command by sending 16 bytes starting from the page address defined in the command (e.g. if ADR is 03h, pages 03h, 04h, 05h, 06h are returned) A roll-over mechanism is implemented to continue reading from page 00h once the end of the accessible memory is reached. For example, reading from address 29h on a MF0ICU2 results in pages 29h, 2Ah, 2Bh and 00h being returned. The following conditions apply if part of the memory is protected by the 3DES authentication for read access:
if the MF0ICU2 is in the ACTIVE state – addressing a page which is equal or higher than AUTH0 results in a NAK response – addressing a page lower than AUTH0 results in data being returned with the roll-over mechanism occurring just before the AUTH0 defined page
if the MF0ICU2 is in the AUTHENTICATED state – the READ command behaves like on a MF0ICU2 without access protection. The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. Byte 0 = 0x30 Byte 1 = Start Page Address Byte 2 = (optional) End Page Address
The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned.
Byte 0 = 0x30
Byte 1 = Start Page Address
Byte 2 = (optional) End Page Address
Write
6
The WRITE command is used to program the lock bytes in page 02h, the OTP bytes in page 03h, data bytes in pages 04h to 27h, configuration data from page 28h to 2B and keys from page 2Ch to 2Fh. A WRITE command is performed page-wise, programming 4 bytes in a page.
Byte 0 = 0xA2
Byte 1 = Address to Write
Byte 2 to 5 = 4 Bytes of Data to Write
Compatibility Write
18
The COMPATIBILITY_WRITE command was implemented to accommodate the established MIFARE PCD infrastructure. Even though 16 bytes are transferred to the MF0ICU2, only the least significant 4 bytes (bytes 0 to 3) will be written to the specified address. It is recommended to set the remaining bytes 4 to 15 to all 0.
Byte 0 = 0xA0
Byte 1 = Address to Write
Byte 2 to 17 = 16 Bytes of Data to Write (only least significant 4 bytes are written)
Note: This command is sent in 2 steps, which the Firmware will handle
<CMD><Address to Write><CRCH><CRCL>
<16 Bytes of Data to Write><CRCH><CRCL>
AUTHENTICATE
2
The AUTHENTICATE command is used to authenticate the MF0ICU2 using 2 keys 3DES encryption in Cipher-Block Chaining (CBC) mode as described in ISO/IEC 10116.
The 16-byte of the 2keys 3DES are programmed to card memory pages from 2Ch to 2Fh. The key itself can be written during personalization or at any later stage using the WRITE or COMPATIBILITY WRITE with Byte 0 is always sent first. On example of Key1 = 0001020304050607h and Key2 = 08090A0B0C0D0E0Fh, the command sequence needed for key programming with WRITE command is:
• A2 2C 07 06 05 04
• A2 2D 03 02 01 00
• A2 2E 0F 0E 0D 0C
• A2 2F 0B 0A 09 08
The 16-byte of the same 2keys 3DES are programed to the Device using Property 1.2.1.1.4.1 MIFARE Ultralight C 2keys3DES
Byte 0 = 0x1A
Byte 1 = 0x00
Table – MIFARE Ultralight AES Commands
Get Version
1
The GET_VERSION command is used to retrieve information on the MIFARE family, product version, storage size and other product data required to identify the MIFARE Ultralight AES.
Byte 0 = 0x60
Read
2-3
The READ command requires a start page address, and returns the 16 bytes of four pages. For example, if address (Addr) is 03h then pages 03h, 04h, 05h, 06h are returned. So called roll-over mechanism (described later) applies if the READ command address is near the end of the accessible memory area. Same mechanism applies if at least part of the addressed pages is within an authentication protected area.
In the default state of MIFARE Ultralight AES, all memory pages in the range from 00h to 3Bh are allowed as Addr parameter to the READ command. Addressing a memory page above the limit results in a NAK response. A roll-over mechanism is implemented to continue reading from page 00h once the end of the accessible memory is reached if at least first addressed page is within allowed limit.
Remark: AES key values can never be directly read out of the memory. When reading from the pages holding key values, all 00h bytes are returned.
The READ command with an option of end page address returns the all n*4 bytes of the addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned.
Byte 0 = 0x30
Byte 1 = Start Page Address
Byte 2 = (optional) End Page Address
Fast Read
3
The FAST_READ command requires a start page address and an end page address and returns bytes of addressed pages. For example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h, and 07h are returned. If either start or end address is outside accessible area, then MIFARE Ultralight AES replies with a NAK.
Byte 0 = 0x3A
Byte 2 = Start Page Address
Byte 3 = End Page Address
Write
6
The WRITE command requires a block address, and writes 4 bytes of data into the addressed MIFARE Ultralight AES page.
Byte 0 = 0xA2
Byte 1 = Address to Write Byte
2 to 5 = 4 Bytes of Data to Write
READ_CNT
2
The READ_CNT command is used to read out the current value of one of the 3 one-way counters of MIFARE Ultralight AES. The command has a single argument specifying the counter number and returns the 24-bit counter value of the corresponding counter. Counters are always readable, except in case of the counter "0x02" with the optional AES authentication protection enabled. In that case, the counter 0x02 is readable only in the AUTHENTICATE state.
Byte 0 = 0x39
Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02)
INCR_CNT
6
The INCR_CNT command is used to increment one of the 3x one-way counters of the MIFARE Ultralight AES. Two arguments are the counter number and the increment value. Counters are always incrementable, except in case of the counter "0x02" with the optional AES authentication protection enabled. In that case, the counter 0x02 can be incremented only in the AUTHENTICATE state.
Byte 0 = 0xA5
Byte 1 = 0x00..0x02 (counter number from 0x00 to 0x02)
READ_SIG
2
The READ_SIG command returns an IC-specific, 48-byte ECC signature. The originality signature can be changed if it has been unlocked with the LOCK_SIG command.
Byte 0 = 0x3C
Byte 1 = 0x00, RFU
WRITE_SIG
6
The WRITE_SIG command allows the writing of a customized originality signature into the dedicated originality signature memory. The WRITE_SIG command requires an originality signature block address, and writes 4 bytes of data into the addressed originality signature block.
In the initial state of MIFARE Ultralight AES, the following originality signature blocks 00h to 0Bh are valid Addr parameters to the WRITE_SIG command. Addressing a memory block beyond the limits above results in a NAK response from MIFARE Ultralight AES.
If the originality signature is locked or permanently locked, a WRITE_SIG command results in a NAK response from the MIFARE Ultralight AES.
Byte 0 = 0xA9
Byte 1 = signature block address
Byte 2 to 5 = signature bytes to be written
LOCK_SIG
2
The LOCK_SIG command allows the user to unlock, lock or permanently lock the dedicated originality signature memory.
The originality signature can only be unlocked, if the originality signature is not permanently locked.
There is no command to unlock the originality signature, if the originality signature is permanently locked.
Byte 0 = 0xAC
Byte 1 = lock option
0x00 = unlock
0x01 = lock
0x02 = permanently lock
VCSL
21
The VCSL command is used to enable a unique identification and selection process across different physical MIFARE product-based cards and virtual MIFARE implementations. The command requires a 16-byte installation identifier IID and a 4-byte PCD capability value as parameters. The parameters are present to support compatibility to other MIFARE product-based devices, but are not used or checked inside the MIFARE Ultralight AES. Nevertheless, the number of bytes is checked for correctness. The answer to the VCSL command is the VCTID value stored in the user configuration segment. This identifier indicates the type of card or ticket. Using this information, the contactless reader can decide whether the ticket belongs to the installation or not.
Byte 0 = 0x4B
Byte 1 to 16 = 16-byte IID (installation identifier, can be any number) Byte 17 to 20 = 4-byte PCDCAPS (PCD capabilities, can be any number)
AUTHENTICATE
2
The AUTHENTICATE command is used to authenticate with a 3-pass mutual authentication the MIFARE Ultralight AES and PCD. The cryptographic method is based on AES in Cipher-Block chaining (CBC) mode according to NIST Special Publication 800-38A. The used key is a 128-bit AES Key. Remark: To reduce the risk on card- only side channel attack to the AES keys, a failed authentication limit (AUTH_LIM) can be set.
The 16 bytes of the AES [DataProtKey] are programmed to memory pages from 30h to 33h. Keys themselves can be written during personalization or at any later stage in a secure environment, as long as the key is not locked for update in the user configuration segment. AES [UIDRetrKey] is stored in memory addresses from 34h until 37h. In case keys are not locked, MIFARE Ultralight AES allows to change AES-keys without authentication as long as AUTH0 is not set to a page address before or at page address where keys bytes are stored. Otherwise MIFARE Ultralight AES requires to be in the AUTHENTICATED state to allow to write AES keys.
The key itself can be written using the WRITE with Byte 0 is always sent first.
On example of AES [DataProtKey] = 000102030405060708090A0B0C0D0E0Fh, the command
sequence needed for key programming with WRITE command is:
• A2 30 0F 0E 0D 0C
• A2 31 0B 0A 09 08
• A2 32 07 06 05 04
• A2 33 03 02 01 00
On example of AES [UIDRetrKey] = 000102030405060708090A0B0C0D0E0Fh, the command
sequence needed for key programming with WRITE command is:
• A2 34 0F 0E 0D 0C
• A2 35 0B 0A 09 08
• A2 36 07 06 05 04
• A2 37 03 02 01 00
The 16-byte of the same AES [DataProtKey] are programed to the Device using Property 1.2.1.1.4.2 MIFARE Ultralight AES DataProtKey.
The 16-byte of the same AES [UIDRetrKey] are programed to the Device using Property 1.2.1.1.4.3 MIFARE Ultralight AES UIDRetrKey.
The 16-byte of the AES [OriginalityKey] are programed to the Device using Property 1.2.1.1.4.4 MIFARE Ultralight AES OriginalityKey. This key value is only known by NXP.
Byte 0 = 0x1A
Byte 1 = Key option
0x00 = DataProtKey
0x01 = UIDRetrKey
0x02 = OriginalityKey
Table - Response Data for Command 0x1100 – Pass Through Command For NTag/MIFARE Ultralight, Type 2
Beginning of any wrappers, at minimum including Response Message
1100
Command 0x1100 – Pass Through Command For NTag/MIFARE Ultralight, Type 2 Command For NFC Tag
81
01
Tag Response Code 0x00 = Success 0x01 = Failed
B
R
N/A
82
var
Encryption Control. If encrypted, see Table 93 - Payload for Encrypted NFC/MIFARE Data. If unencrypted see Table 94 – Unencrypted NFC/MIFARE Data.
B
O
N/A
End of any wrappers, at minimum including Response Message
If the request started successfully, the Request Status in the message wrapper is OK, Started / Running, All good / requested operation was successful.
Table - Request Example (Get Version)
Table - Response Example (Get Version)
Encrypted Data Format
Table - Payload for Encrypted NFC/MIFARE Data
/DFDF59
var
Encrypted Data Primitive.
Decrypt the value of this TLV data object using the algorithm and variant specified in the Encrypted Data KSN parameter and the Encrypted Data Encryption Type parameter to read its contents. The format of the decrypted data is shown in Table 94 – Unencrypted NFC/MIFARE Data.
B
R
/DFDF50
var
Encrypted Data KSN
B
R
/DFDF51
01
Encrypted Data Encryption Type. See section 4.4 Encryption Type for a list of valid values.
B
R
End of Notification Message
Table – Unencrypted NFC/MIFARE Data
FC
var
NFC Data Container
T
R
/DF7A
var
NFC Data
B
O
Last updated