MF1PH2131DA4/01J Datasheet MF1P4131DUD/01V, MF1P2131DUF/01V, MF1PH2101DUF/01V | P10-P12

NXP Semiconductors

MF1P(H)x1y1

MIFARE Plus EV1

Product short data sheet Rev. 3.0 — 23 July 2018

COMPANY PUBLIC 366930 10 / 27

• unique 7-byte serial number

• non-unique 4-byte serial number

Due to security and system requirements, these bytes are write-protected after being

programmed by the PICC manufacturer at production time.

Remark: The programmed 4-byte NUID serial number is not globally unique which has

to be considered in the contactless system design. See Ref. 14 for further information

regarding handling of UIDs.

The customer must decide which UID length to use when ordering the product, see Table

2 for ordering information.

A MF1P(H)x1y1 with 7-byte UID supports the additional UID configuration options as

defined in Ref. 3 using the MF_PersonalizeUIDUsage command after ISO/IEC 14443-3

activation. Note that the MF_PersonalizeUIDUsage command can only be sent once.

During personalization, the PICC can be configured to support Random ID. The user can

configure whether Random ID or fixed UID shall be used. According to ISO/IEC 14443-3

the first anticollision loop (see Ref. 7) returns the Random Number Tag 08h, the 3-byte

Random Number and the BCC, if Random ID is used. In case Random ID is configured,

the real UID can be retrieved using the ISOSelect and ISOExternalAuthenticate

commands or by reading out block 0 of sector 0.

8.6.1 Backwards compatibility protocol

The backwards compatibility of this product, as used in security level 1, runs on the same

protocol layer as MIFARE Classic EV1 1K and MIFARE Classic EV1 4K. The protocol

consists of the following components:

• Frame definition: according to ISO/IEC 14443-3

• Bit encoding: according to ISO/IEC 14443-2

• Error code handling: handling is proprietary as error codes are formatted in half bytes.

• Command specification: commands are proprietary. Please use the specification as in

Ref. 3 and Ref. 4 and the additional commands which are only implemented in MIFARE

Plus EV1 as described in this document and in Ref. 1.

The following security levels can run on this protocol:

• Security Level 0

• Security Level 1

8.6.2 ISO/IEC 14443-4 Protocol

The ISO/IEC 14443-4 Protocol (also known as T=CL) is used in many processor cards.

This protocol is used for the MIFARE Plus EV1 with the following security levels:

• Security Level 0: all commands

• Security Level 1: for the sector or card level SL switch, the AES originality function,

AES Key update, configuration data update, GetVersion and Read_Sig

• Security Level 3: all commands

Remark: The ISO/IEC 14443-4 protocol is also used to operate any sector that has

been switched to SL3 or when operating a sector using SL3 commands which has been

switched to SL1SL3Mix mode.

NXP Semiconductors

MF1P(H)x1y1

MIFARE Plus EV1

Product short data sheet Rev. 3.0 — 23 July 2018

COMPANY PUBLIC 366930 11 / 27

8.6.3 ISO/IEC 7816-4 Protocol

MIFARE Plus EV1 supports the APDU message structure according to ISO/IEC 7816-4

for

• an optional wrapping of the native APDU format

for the additionally implemented standard ISO/IEC 7816-4 commands for Virtual Card

selection

8.7 Security level switching

The MIFARE Plus EV1 offers a unique feature to support migration from CRYPTO1

based systems to AES based operation. The migration on the card-side is done using

different security levels supporting different cryptographic algorithms and protocols.

There are three security levels:

• Security level 0: initial delivery configuration, used for card personalization

• Security level 1: 3-Pass CRYPTO1 Authentication (backwards compatibility mode

with MIFARE Classic EV1 1K and MIFARE Classic EV1 4K) with optional AES

authentication, optional 3-Pass AES Authentication and secure messaging.

• Security level 3: 3-Pass authentication based on AES, new data manipulation

commands secured by AES encryption and an AES based MACing method

The security level switching (i.e. from security level 1 to security level 3) is performed

using the dedicated AES authentication switching keys.

Security level switching can be done for the whole card (CardSecurityLevel) or for

dedicated sectors only (SectorSecurityLevel). In case of dedicated sectors, these can

also be switched to a mixed mode SL1SL3Mix, where both security level 1 and security

level 3 operations are accepted. Security level switching, both at card or at sector level, is

only possible to a higher security level and not to a lower security level.

8.7.1 Switching CardSecurityLevel

CardSecurityLevel switching of MF1P(H)x1y1 means that the whole PICC is switching its

security level at once. This is also the method available in MIFARE Plus EV0 and is done

by an AES authentication with the L3SwitchKey.

The product is delivered in SL0. It is possible to upgrade the PICC to security level 3

either passing through the security level 1 or directly from security level 0.

8.7.2 Switching SectorSecurityLevel

Switching the Security Level of dedicated MIFARE Sectors is done by a multiple key

AES authentication, called AuthenticateSectorSwitch, addressing the L3SectorSwitchKey

or L1L3MixSectorSwitchKey, and the AESSectorKeyB of the targeted sectors. This

command is only available after ISO/IEC 14443-4 activation in security level 1.

8.8 Security level 0

Security level 0 is the initial delivery configuration of the PICC. The card can be operated

either using the backwards compatibility protocol or the ISO/IEC 14443-4 protocol.

NXP Semiconductors

MF1P(H)x1y1

MIFARE Plus EV1

Product short data sheet Rev. 3.0 — 23 July 2018

COMPANY PUBLIC 366930 12 / 27

In this level, the card can be personalized including the programming of user data as well

as CRYPTO1 and/or AES keys. In addition, the originality function can be used.

The following mandatory AES keys must be written, using the WritePerso command

before the PICC can be switched to security level 1 or security level 3.

Security level switching is performed using the CommitPerso command:

• CardConfigurationKey

• CardMasterKey

• L3SwitchKey

When the pre-personalization of the PICC is finished it is possible to upgrade the

PICC from security level 0 either to security level 1 or directly to security level 3 with

CommitPerso command.

Using the originality function, it is possible to verify that the chip is a genuine NXP

Semiconductors MIFARE Plus.

8.9 Security level 1

Security level 1 offers the same functionality as a MIFARE Classic EV1 1K and

MIFARE Classic EV1 4K using the backwards compatibility protocol, see Ref. 3 and Ref.

Furthermore, an optional AES authentication is available in this level without affecting

the MIFARE Classic EV1 1K and MIFARE Classic EV1 4K functionality. The authenticity

of the card can be proven using strong cryptographic means with this additional

functionality.

Response timings may differ from the MIFARE Classic EV1 1K/4K products.

In addition to the backwards compatibility mode, after a successful ISO/IEC 14443-4

activation the originality function can be executed or the CardSecurityLevel or

SectorSecurityLevel switched to higher security levels. In addition to those features

already available in MIFARE Plus EV0, MIFARE Plus EV1 offers the possibility to update

AESSectorKeys and VCSystemData.

MIFARE Plus EV1 can be operated like MIFARE Plus EV0 in SL1 which means that all

memory operations on each sector are requiring legacy MIFARE Classic EV1 commands

using CRYPTO1 enciphering. Beyond that, MIFARE Plus EV1 offers the flexibility

to either switch distinct sectors to SL3 and operate them in AES secure messaging

or enable SL1SL3MixMode on distinct sectors. Sectors in SL1SL3MixMode can be

operated either using the backwards compatible MIFARE Classic EV1 commands when

activated to ISO/IEC 14443-3 or using AES secure messaging when activated to ISO/

IEC 14443-4. In example, this enables end-to-end communication to a MIFARE Plus EV1

using a secure AES channel while leaving the operation in the application on MIFARE

Classic EV1 commands for a migration period.

Also, the Transaction MAC feature is available in security level 1 after ISO/IEC14443-3

activation. The Transaction MAC processing in security level 1 of the Authentication,

Read, Write, Increment, Decrement, Transfer and Restore commands is the same as

their security level 3 equivalents with a few differences, as described later and in Ref. 1.

The CommitReaderID command is not supported.

Using the originality function it is possible to verify if the chip is a genuine NXP

Semiconductors MIFARE Plus EV1.

P1-P3 P4-P6 P7-P9 P10-P12 P13-P15 P16-P18 P19-P21 P22-P24 P25-P27

MF1PH2131DA4/01J

Mfr. #:

Buy MF1PH2131DA4/01J

Manufacturer:

NXP Semiconductors

Description:

RFID Transponders MIFARE Plus EV1

Lifecycle:

New from this manufacturer.

Delivery:

DHL FedEx Ups TNT EMS

Payment:

T/T Paypal Visa MoneyGram Western Union

MF1PH2131DA4/01J

MF1PH2131DA4/01J

Products related to this Datasheet