MF2DL1000DA4SLASH02 datasheet(22/132 Pages) NXP

22 / 132 page

NXP Semiconductors

MF2DL(H)x0

MIFARE DESFire Light contactless application IC

MF2DL_H_x0

All information provided in this document is subject to legal disclaimers.

Product data sheet

Rev. 3.3 — 5 April 2019

COMPANY PUBLIC

430733

22 / 132

9 Secure Messaging

Prior to data transmission a mutual three-pass authentication can be done between PICC

and PCD which results in the generation of session keys used in the secure messaging.

There are two secure messaging types available in the MF2DL(H)x0. One is using

AES-128 and is referred to as AES mode in this data sheet. The other one is using

AES-128 with a Leakage Resilient Primitive (LRP) wrapper, also referred to as LRP

mode. The LRP mode can be permanently enabled using the SetConfiguration

command. After this switch, it is not possible to revert back to AES mode.

Compared to AES mode, the LRP mode has the advantage that it provides strong

resistance against side-channel and fault attacks. It serves as a replacement for

AES as it only uses standard cryptographic constructions based on AES without any

proprietary cryptography. Thus, LRP can be seen as an alternative for AES which is

itself based on AES, and is provably as secure as AES, but comes with better properties

w.r.t. implementation security, see also [10]. The PCD requires the same LRP mode

implementation.

To improve the resistance against side-channel attacks and especially card only

attacks for the AES mode, MF2DL(H)x0 provides a limit for unsuccessful authentication

attempts. Every unsuccessful authentication is counted in the TotFailCtr. The parameters

TotFailCtrLimit TotFailCtrDecr can be configured as described in Section 11.5.1 using the

"Failed authentication counter configuration".

Each unsuccessful authentication is counted internally in the total failed authentication

counter TotFailCtr. After reaching the TotFailCtrLimit, see Section 11.5.1, the related key

cannot be used for authentication anymore.

In addition, after reaching a limit of consecutive unsuccessful authentication

attempts, the MF2DL(H)x0 starts to slow down the authentication processing in

order to hamper attacks. This is done by rejecting any authentication command

with a AUTHENTICATION_DELAY response. The response time of a single

AUTHENTICATION_DELAY response is depending on the FWT, see Section 8.1.1, and

is about 65% of the maximum response time specified by FWT. The error response is

sent until the total authentication delay time is reached which is equal to the sum of the

frame delay times. The total authentication delay time increases with each unsuccessful

authentication attempt up to a maximum value, only a successful authentication restores

the full operational speed.

Changing a blocked AES key by authenticating with the AppMasterKey and using the

ChangeKey command makes the referenced key accessible again. If the AppMasterKey

itself is blocked, no recovery is possible.

Each successful AES authentication decrements the TotFailCtr by a value of

TotFailCtrDecr.

The AES and LRP authentications are initiated by commands sharing the same

command code (First Authentication and Non-First Authentication variants). These

authentication protocols are both AES-based, but differ with regards to the actual

protocol applied and the subsequent secure messaging mode they initiate. An overview

of the different modes is given in Figure 6.

MF2DL1000DA4/02 Datasheet(PDF) 22 Page - NXP Semiconductors

MF2DL1000DA4/02 Datasheet(HTML) 22 Page - NXP Semiconductors

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

Datasheet Download

Link URL