MF2DL1000DA4SLASH02 datasheet(32/132 Pages) NXP

32 / 132 page

NXP Semiconductors

MF2DL(H)x0

MIFARE DESFire Light contactless application IC

MF2DL_H_x0

All information provided in this document is subject to legal disclaimers.

Product data sheet

Rev. 3.3 — 5 April 2019

COMPANY PUBLIC

430733

32 / 132

9.2.2 Command counter

The Command counter (CmdCtr) is treated exactly in the same way by LRP secure

messaging as defined for AES secure messaging, see Section 9.1.2.

9.2.3 MAC calculation

MACs are computed by using a CMAC construction on top of the LRP primitive. This is

specified in [10]. This document uses the following notation where the right hand refers to

the notation of [10].

MACLRP(key,message) = CMAC_LRP(4,key, Len(message),message)

Note that in the LRP context a key is not purely a single value, but rather consists of

the associated set of plain texts, an updated key and in context of CMAC also the

subkeys K1 and K2. Therefore K1 and K2 are not shown (contrary to [10]) as they can be

calculated inside.

MACtLRP(key, message) denotes the CMAC after truncation to 8 bytes which is identical

to the truncation of the AES secure messaging i.e. the even-numbered bytes are retained

in most-to-least-significant order, see Section 9.1.3.

The initialization vector used for the CMAC computation is the zero byte IV as prescribed

[10].

9.2.4 Encryption

Encryption and decryption are calculated using a Leakage Resilient Indexed CodeBook

(LRICB) construction on top of the LRP primitive: LRICBof [10].

For this purpose an Encryption Counter is maintained: EncCtr is a 32-bit unsigned

integer as Input Vector (IV) for encryption/decryption. The EncCtr is reset to 000000000h

at PCD and PICC when starting an authentication with AuthenticateLRPFirst or

AuthenticateLRPNonFirst targeting LRP. The counter is incremented during each

encryption/decryption of each 16-byte block. i.e. for 64-byte encryption/decryption

the EncCtr is increased by 5 due to 4 blocks of 16-byte of data plus one block of

padding. Note that for AuthenticateLRPFirst the value 00000000h is already used for

the response of part 2, so the actual secure messaging starts from 00000001h. For

AuthenticateLRPNonFirst, secure messaging starts from 00000000h as the counter is not

used during the authentication. EncCtr is further maintained as long as the PICC remains

in LRP authenticated state. Note that for the key stream calculation [10], the counter is

represented MSB first.

Padding is applied according to Padding Method 2 of ISO/IEC 9797-1 [7], i.e. by adding

always 80h followed, if required, by zero bytes until a string with a length of a multiple

of 16 bytes is obtained. Note that if the plain data is a multiple of 16 bytes already, an

additional padding block is added. The only exception is during the authentication itself

(AuthenticateLRPFirst and AuthenticateLRPNonFirst), where no padding is applied at all.

The notation ELRP(key, plaintext) is used to denote the encryption, i.e. LRICBEnc of [10]

and DLRP(key, ciphertext) for the complementary decryption operation. Note that in the

LRP context a key is not purely a single value, but rather consists of the associated set

of plain texts and updated key. Also, as specified in [10], the EncCtr is updated as part of

the operation.

Note that the EncCtr cannot overflow. Due to the supported file sizes, the CmdCtr will

always expire before.

MF2DL1000DA4/02 Datasheet(PDF) 32 Page - NXP Semiconductors

MF2DL1000DA4/02 Datasheet(HTML) 32 Page - NXP Semiconductors

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

Datasheet Download

Link URL