P5DF081 datasheet(12/36 Pages) NXP

12 / 36 page

P5DF081_SDS

All information provided in this document is subject to legal disclaimers.

Objective short data sheet

PUBLIC

Rev. 1 — 12 August 2010

191710

12 of 36

NXP Semiconductors

P5DF081

MIFARE SAM AV2

or AES192 key. During this activation authentication, the maximal message size under

command chaining (MaxChainBlocks) is set. Once switched to MIFARE SAM AV2 mode

there is no mean to switch back.

When the MIFARE SAM AV2 mode is activated, the Key Storage Table (except the SAM

Master Key) gets reset.

8.5.2 MIFARE SAM AV1 compatibility mode SAM-Host protection

In AV1 compatibility mode, SAM access and SAM-Host communication is protected by the

increased security mode exactly like for the MIFARE SAM AV1. The protection

mechanism is explained in the following subsection.

8.5.2.1

Increased security - CMAC calculation

The MIFARE SAM AV2 offers the possibility to send each command on a higher security

level by applying a CMAC. If activated, the MIFARE SAM AV2 requires a logical channel

with an active host authentication to be defined for CMAC calculation to accept any

command.

The CMAC is calculated and padded according to the NIST Special Publication 800-38B,

which gives a recommendation for block cipher modes of operation.

The following commands of the MIFARE SAM AV2 do not apply the explained CMAC

mechanism:

• SAM_AuthenticateHost

• SAM_GetChallenge, SAM_InternalAuthenticate and SAM_ExternalAuthenticate

Commands already protected by encryption apply the explained CMAC mechanism only

for the direction which is not protected:

• SAM_ChangeKeyEntry for the command APDU

• SAM_ChangeKUCEntry for the command APDU

• SAM_DumpSessionKey for the response APDU

• SAM_ChangeKeyMIFARE for the response APDU

8.5.3 MIFARE SAM AV2 mode SAM-Host protection

Two kinds of host authentication can be distinguished. The first is used for locking and

unlocking the SAM.

The second kind is used to get the access rights to execute certain commands. It only

affects the SAM status for the LC it is executed over and can be used to set up a SAC

over this LC if preferred by the host. Once authenticated, three different protection modes

on the LC are foreseen: plain, MAC Protection and Full Protection (i.e. by MACs and

encryption). This host authentication is executed by using the SAM_AuthenticateHost

command.

Note that whether and when host authentications (be it for unlocking or for gaining access

rights) are required depends on the SAM configuration and is explained in Ref. 1.

P5DF081 Datasheet(PDF) 12 Page - NXP Semiconductors

P5DF081 Datasheet(HTML) 12 Page - NXP Semiconductors

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36

Datasheet Download

Link URL