NXP MIFARE DESFire EV3 2K

Specifications

MIFARE DESFire has evolved over time, enhancing its security properties to protect against current and future security threats, and adding new features to better suit into new user requirements.

MIFARE DESFire EV3 is the fourth generation of the MIFARE DESFire products family succeeding MIFARE DESFire EV2. It is functionally backward compatible with all previous MIFARE DESFire generations, namely MIFARE DESFire EV2, MIFARE DESFire EV1 and MIFARE DESFire D40 (MF3ICD40).

The relationship between the latest three generations of MIFARE DESFire products. The latest generation encompasses the features from the older generation(s). Therefore, allowing existing users of the older products to adopt the latest product with minimum or no changes to their infrastructures.

MIFARE DESFire EV3 can be used as a MIFARE DESFire EV2 or a MIFARE DESFire EV1 in its default delivery configuration. Every new feature would require an activation and/or the use of new commands which is described in their respective sections in this document.

Features

Key Benefits

• Services running on MIFARE DESFire EV3 can be deployed to NFC mobile phones using MIFARE 2GO

• Preloaded keys for delegated application management allow to add new services to already deployed cards

• Functional backward compatibility to MIFARE DESFire EV2, MIFARE DESFire EV1 and D40 (MF3ICD40) offers a seamless upgrade path

• Improved operating range and higher transaction speeds compared to its predecessors enhance both user experience and security

• Optional high input capacitance (70 pF) for small form factor designs (MF3DHx3)

Key Features

• Common Criteria EAL5+ certified for IC hardware and software

• NFC Forum Tag Type 4 certified

• SUN (Secure Unique NFC) message authentication for advanced data protection within standard NDEF read operation

• Flexible file structure for true multi-application operation

• Non-volatile memory

• 2 kB

• Data retention of 25 years

• Write endurance typical 1 000 000 cycles

• Fast programming cycles

• Inter-application file sharing enables multiple applications with a common purse

• Wide choice of open DES/2K3DES/3K3DES/AES crypto algorithms

• Optional “RANDOM” ID for enhanced security and privacy

• Mutual three-pass authentication

• Flexible key management: 1 card leader key and up to 14 keys per application

• Multiple key assignment for each file access rights (up to 8)

• Multiple key sets per application for post-issuance rolling application keys

• MF3ICD40 compatible mode: 4 byte MAC, CRC 16

• NV-memory organization and multi-application support

• Flexible file system: user can freely define application structures on PICC

• As many applications as memory size supports

• Up to 32 files in each application (6 file types available: Standard Data file, Back-up

• Data file, Value file, Linear Record file, Cyclic Record file and Transaction MAC file)

• File size is determined during creation (not for Transaction MAC file)

• MlsmartApp (Delegated Application Management)

• Memory reuse in DAM applications (Format Application)

• Factory loaded NXP’s DAM keys for AppXplorer service support

• Accessing files from any two applications during a single transaction

• Proof of transaction with card generated MAC

• Transaction Timer defends against man-in-the-middle attacks

• Virtual Card Architecture for enhanced card/application selection on multi-VC devices with privacy protection

• Proximity check to detect relay attacks

• Originality Check for proof of genuine NXP’s product

• Configurable ATS information for card personalization

• RF interface: ISO/IEC 14443 Type A

• Contactless interface compliant with ISO/IEC 14443-2/3 A

• Low Hmin enabling operating distance up to 100 mm (depending on power provided by the PCD and antenna geometry)

• Fast data transfer: 106 kbit/s, 212 kbit/s, 424 kbit/s, 848 kbit/s

• 7 bytes unique identifier (option for Random ID)

• Uses ISO/IEC 14443-4 transmission protocol

• Configurable FSCI to support up to 256 bytes frame size

• ISO/IEC 7816-4 compliant

• Supports ISO/IEC 7816-4 file structure (selection by File ID or DF name)

• Supports ISO/IEC 7816-4 APDU message structure

• Supports ISO/IEC 7816-4 APDU wrapper for MIFARE DESFire native commands

• Supports ISO/IEC 7816-4 INS code ‘A4’ for SELECT FILE

• Supports ISO/IEC 7816-4 INS code ‘BO’ for READ BINARY

• Supports ISO/IEC 7816-4 INS code ‘D6’ for UPDATE BINARY

• Supports ISO/IEC 7816-4 INS code ’62’ for READ RECORDS

• Supports ISO/IEC 7816-4 INS code ‘E2’ for APPEND RECORD

• Supports ISO/IEC 7816-4 INS code ’88’ for INTERNAL AUTHENTICATE

• Supports ISO/IEC 7816-4 INS code ’82’ for EXTERNAL AUTHENTICATE