MF1PLUSX0Y1_SDS All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product short data sheet
PUBLIC
Rev. 3.2 — 21 February 2011
163532 7 of 20
NXP Semiconductors
MF1PLUSx0y1
Mainstream contactless smart card IC
Value blocks are special counters where the stored value can be manipulated with
specific commands such as MF Increment, MF Decrement and MF Transfer.
These value blocks have a fixed data format enabling error detection and correction with
backup management to be performed.
The MIFARE Plus X provides two further commands which can be used to optimize
performance when using value blocks. These are:
MF Increment Decrement
MF Decrement Transfer
A successful mutual authentication is required to allow any data operation.
8.1.2.1 Access conditions
The access conditions for every data block and the sector trailer itself are stored in the
sector trailer of the corresponding sector.
The access bits control the rights of memory operations using the secret keys A and B.
The access conditions may be altered after authentication with the relevant key and the
current access condition allows this operation.
Furthermore, value blocks are configured using the access bits.
8.1.3 AES keys
AES keys are not shown in the memory map. The keys are stored on top of the other data
and can be updated and used by referencing the Key Number. In security level 3,
anti-tearing is supported for the update of AES keys as well as for the update of the sector
trailer. In security level 2, anti-tearing is supported only for the update of AES keys. This
anti-tearing mechanism is done by the PICC itself. The EEPROM stays in a defined
status, even if the PICC is removed from the electromagnetic field during the write
operation.
8.1.4 Proximity check
The security level 3 offers a feature to verify that the PICC is in close proximity to the
PCD. This functionality can be used to effectively prevent relay attacks.
The proximity check is based on a precise time measurement of challenge-response pairs
in combination with cryptographic methods.
8.1.5 Multi-sector authentication
A new feature has been provided in security level 2 and 3 for data which is spread over
multiple sectors to improve transaction performance.
Providing that such sectors are secured with identical keys (key value and key type) only
one authentication is required to read and/or write data from these sectors. There is no
need to re-authenticate when accessing any data within these sectors. Therefore it is
possible to configure a card in such a way that operating with only one authentication is
needed in security level 3 to access all sectors. The same applies also for security level 2
authentications (one is AES-based the other one is CRYPTO1-based)
MF1PLUSX0Y1_SDS All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product short data sheet
PUBLIC
Rev. 3.2 — 21 February 2011
163532 8 of 20
NXP Semiconductors
MF1PLUSx0y1
Mainstream contactless smart card IC
8.1.6 Originality function
The originality function is implemented by an AES authentication with the originality key.
The authentication is performed in ISO/IEC 14443-4 protocol layer.
8.2 Card activation and communication protocol
The ISO/IEC 14443-3 anticollision mechanism allows for simultaneous handling of
multiple PICCs in the field. The anticollision algorithm selects each PICC individually and
ensures that execution of a transaction with a selected PICC is performed correctly
without data corruption from other PICCs in the field.
There are three different versions of the PICC. The UID is programmed into a locked part
of the NV-memory reserved for the manufacturer:
unique 7-byte serial number
unique 4-byte serial number
non-unique 4-byte serial number
Due to security and system requirements, these bytes are write-protected after being
programmed by the PICC manufacturer at production.
Remark: The programmed 4-byte NUID serial number is not globally unique which has to
be considered in the contactless system design. See Ref. 11
for further information
regarding handling of UIDs.
The customer must decide which UID length to use when ordering the product, see
Table 2
for ordering information.
During personalization, the PICC can be configured to support Random ID in security
level 3. The user can configure whether Random ID or fixed UID shall be used. According
to ISO/IEC 14443-3 the first anticollision loop (see Ref. 5
) returns the Random Number
Tag 08h, the 3-byte Random Number and the BCC, if Random ID is used. The retrieval of
the UID in this case can be done using the Virtual Card Support Last command, see
Ref. 3
or by reading out block 0.
8.2.1 Backwards compatibility protocol
The backwards compatibility of this product, as used in security level 1 and security
level 2, runs on the same protocol layer as MIFARE Classic 1K and MIFARE Classic 4K.
The protocol is formed out of the following components:
Frame definition: according to ISO/IEC 14443-3
Bit encoding: according to ISO/IEC 14443-2
Error code handling: handling is proprietary as error codes are formatted in half bytes.
Command specification: commands are proprietary. Please use the specification as in
Ref. 1
and Ref. 2 and the additional commands which are only implemented in
MIFARE Plus as described in this document and in Ref. 3
.
The following security levels can run on this protocol:
Security Level 0
Security Level 1
MF1PLUSX0Y1_SDS All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product short data sheet
PUBLIC
Rev. 3.2 — 21 February 2011
163532 9 of 20
NXP Semiconductors
MF1PLUSx0y1
Mainstream contactless smart card IC
Security Level 2
8.2.2 ISO/IEC 14443-4 Protocol
The ISO/IEC 14443-4 Protocol (also known as T=CL) is used in many processor cards.
This protocol is used for the MIFARE Plus with the following security levels:
Security Level 0: all commands
Security Level 1: only the security level switch and originality function
Security Level 2: updating AES keys and configuration blocks as well as the security
level switch and originality function
Security Level 3: all commands
8.3 Security level switching
The MIFARE Plus X offers a unique feature to support migration from CRYPTO1 based
systems to AES based operation. The migration on the card-side is done using different
security levels supporting different cryptographic algorithms and protocols. There are four
security levels:
Security level 0: initial delivery configuration, used for card personalization
Security level 1: backwards functional compatibility mode (with MIFARE Classic 1K
and MIFARE Classic 4K) with optional AES authentication
Security level 2: 3-Pass authentication based on AES followed by MIFARE CRYPTO1
authentication, communication secured by MIFARE CRYPTO1
The MIFARE CRYPTO1 uses session keys derived from the AES and MIFARE
CRYPTO1 authentication.
Security level 3: 3-Pass authentication based on AES, data manipulation commands
secured by AES encryption and an AES based MACing method
If the card is a L3 card the Commit Perso command will switch the card directly from
security level 0 to security level 3 instead of security level 1.
The security level switching (i.e. from security level 1 to security level 3) is performed
using the dedicated AES authentication switching keys.
The security level can only be switched from a lower to a higher level, never in the
opposite direction.
8.4 Security level 0
Security level 0 is the initial delivery configuration of the PICC. The card can be operated
either using the backwards compatibility protocol or the ISO/IEC 14443-4 protocol.
In this level, the card can be personalized including the programming of user data as well
as CRYPTO1 and/or AES keys. In addition, the originality function can be used.
The following mandatory AES keys must be written, using the Write Perso command
before the PICC can be switched to security level 1 or security level 3 (for L3 card).

MF1SPLUS6031DA4/03

Mfr. #:
Manufacturer:
NXP Semiconductors
Description:
RFID Transponders CONTACTLESS SMART CARD IC
Lifecycle:
New from this manufacturer.
Delivery:
DHL FedEx Ups TNT EMS
Payment:
T/T Paypal Visa MoneyGram Western Union