# Mifare

AID of PICC is `00 00 00`. And then `key#0` is the **masterkey**. There is a *masterkey* for PICC and another *masterkey* for an application.

In Wikipedia, the DES keying options are termed as:

* keying option 1 or **3TDEA** when `k1 != k2 != k3` this is the strongest
* keying option 2 or **2TDEA** when `k1 != k2` but `k3 = k1`
* keying option 3 where `k1 = k2 = k3` 

In Mifare, wither **DES** or **3DES**, these keys is 16 bytes in length. The difference is that in **DES** the first half is mirror copy of 2nd half. These are *Keying options* in DES terminology.

![](https://4095256017-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M98M7KpH7vBLhacf2Yj%2F-MC6JbgDqTpoXpG4Gp81%2F-MC6Kn4zaNHyYtFYwXcI%2Fimage.png?alt=media\&token=c47569a4-5d9f-4f3d-b736-0d79d5cd1895)

## **DESFire Commands**

**Security Related Commands:**

* Authenticate
* Change KeySettings
* Get KeySettings
* Change Key
* Get KeyVersion

**PICC Level Commands:**

* Create Application
* Delete Application
* Get Applications
* Select Application
* FormatPICC
* Get Version

**Application Level Commands:**

* Get FileIDs
* Get FileSettings
* Change FileSettings
* Create StdDataFile
* Create BackupDataFile
* Create ValueFile
* Create LinearRecordFile
* Create CyclicRecordFile
* Delete File

**Data Manipulation Commands:**

* Read Data
* Write Data
* Get Value
* Credit
* Debit
* Limited Credit
* Write Record
* Read Records
* Clear RecordFile
* Commit Transaction
* Abort Transaction

\---------------------------------------------------------------------------------------------------------------

Access to data is granted at an application level.

**Access Rights:**

* Read Access
* Write Access
* Read\&Write Access
* ChangeAccessRights

![The 4 bits index into the KEY table!](https://4095256017-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M98M7KpH7vBLhacf2Yj%2F-MC6QJY_aNqQig_o5LiN%2F-MC6RFlhTT--DJHiN5f3%2Fimage.png?alt=media\&token=d8cc463d-260f-4545-9f4b-e14a86efcd1e)

**File Types: (***data, value, record***)**

* Standard **Data** Files
* Backup **Data** Files
* **Value** Files With Backup
* Linear **Record** Files With Backup
* Cyclic Record Files With Backup

**Cryptographic Keys Places:**

* PICC master key
* Application master key per application
* 1-14 keys per application

![11 bytes + 2 bytes CRC is 13 must %8 becomes 16 bytes then encrypted](https://4095256017-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M98M7KpH7vBLhacf2Yj%2F-MC6Huxu6Fffqoltor0N%2F-MC6IMQUX4MT1fZ8Ivwd%2Fimage.png?alt=media\&token=589a42ad-c332-441e-8185-da23eeed920a)

\---------------------------------------------------------------------------------------------------------------

NV-memory is allocated in blocks of 32 bytes. Record File with 2 Records and a size of 10 Bytes/Record internally always uses 64 bytes 

![The 3rd byte in each command](https://4095256017-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M98M7KpH7vBLhacf2Yj%2F-MC6J347jYWHBuhaPhwc%2F-MC6JS7ukdG1kk4sw3of%2Fimage.png?alt=media\&token=802e0e43-0b74-4184-844d-43c9c8695713)

Take note of the FileID range *0x00 \~ 0x07* range can be backed up.

![FileID = 0x00 \~ 0x0F](https://4095256017-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M98M7KpH7vBLhacf2Yj%2F-MC6AirG5UiQQo-GccRj%2F-MC6ELSTqeiLOoyK_DH-%2Fimage.png?alt=media\&token=e374fd85-a298-4ff0-9adf-499d60b1c85b)

![FileID = 0x00 \~ 0x07](https://4095256017-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M98M7KpH7vBLhacf2Yj%2F-MC6AirG5UiQQo-GccRj%2F-MC6F6C-6jM40zwYddyH%2Fimage.png?alt=media\&token=ad354a66-4476-4cb1-816f-09ce8a40b472)

![FileID = 0x00 \~ 0x07](https://4095256017-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M98M7KpH7vBLhacf2Yj%2F-MC6AirG5UiQQo-GccRj%2F-MC6FUukIrAVxkIQi3W0%2Fimage.png?alt=media\&token=3e5c5ec5-e66b-4d47-948c-bbef250b8b37)

![FileID = 0x00 \~ 0x07](https://4095256017-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M98M7KpH7vBLhacf2Yj%2F-MC6AirG5UiQQo-GccRj%2F-MC6FxGfLM8njRXnPY5G%2Fimage.png?alt=media\&token=3db7295c-453b-48eb-97f6-88920dff0122)