MIFARE product and handling of UIDs

1 AN10927 MIFARE product and handling of uids Rev. 5 July 2018 190741 Application note COMPANY PUBLIC Document information Info Content Keywords Single Size UID, Double Size UID, 4-byte UID, 7-byte UID, 10-byte UID, SNR, NUID, FNUID, ONUID Abstract This document shows the use of uids in contactless smartcard systems. It indicates recommendations about the Random ID, mixed use of 4-byte and 7-byte uids in the same system, and it describes the options how to upgrade 4-byte UID systems to accept 7-byte UID smart cards. NXP Semiconductors AN10927 MIFARE product and handling of uids AN10927 All information provided in this document is subject to legal disclaimers. NXP 2018. All rights reserved. Application note COMPANY PUBLIC Rev. 5 July 2018 190741 2 of 19 Contact information For more information, please visit: Revision history Rev Date Description 20180705 Editorial update 20170208 MIFARE Plus EV1 contactless IC, MIFARE DESFire EV2 contactless IC and MIFARE Ultralight Nano contactless IC added; Reader list updated 20131002 Typos corrected in Cascade Level 3 (Section 2) MIFARE Ultralight EV1 and MIFARE4 Mobile added in Table 3.

2 UID with shortcut for MIFARE from mobile added (Section ) CLRC663, CRC630, CLRC631, PR601, PRH601 added in Annex A Annex B (Source code to derive NUID out of a Double Size UID) added 20110804 MIFARE Classic next generation contactless IC added. 20100901 Bit order corrected (Section ), 7 byte MF1 ICS x0 added in Table 4 (Section ), Table 3 updated (Section ) 20100519 Initial version NXP Semiconductors AN10927 MIFARE product and handling of uids AN10927 All information provided in this document is subject to legal disclaimers. NXP 2018 All rights reserved. Application note COMPANY PUBLIC Rev. 5 July 2018 190741 3 of 19 1. Introduction This document shows the use of uids in contactless smartcard systems. It indicates recommendations about the use of Random ID, the mixed use of 4-byte (single size) and 7-byte (double size) uids in the same system, and it describes the options how to upgrade 4 byte UID systems to use 7 byte UID smart cards.

3 Note: A UID is not a serial number , but a unique identifier. There is no recommendation how to turn the array of bytes into an integer. Note: UID is a common expression, defined in the ISO/IEC 14443-3. In some case the UID is even not unique like RID, NUID (FNUID and ONUID) see below. Note: The 4-byte UID is called Single Size UID , too. The 7-byte UID is called Double Size UID , too. The 10-byte UID is called Triple Size UID , too. In this document, the term MIFARE Classic card refers to a MIFARE Classic IC-based contactless card, the term MIFARE Plus card refers to a MIFARE Plus IC-based contactless card. 2. MIFARE products and ISO/IEC 14443 uids In this section the use of uids according to the ISO/IEC 14443 is described. Fig 1 shows the three different UID sizes defined in ISO/IEC 14443-3 as they are used during the anti-collision and selection procedure. UID0 UID1 UID2 UID3 UID0 UID1 UID2 UID3 CTUID4 UID5 UID6 UID3 UID4 UID5 UID6 CTUID7 UID8 UID94 byte UID7 byte UID10 byte UIDC ascade Level 1 Cascade Level 2 Cascade Level 3 BCCBCCBCCUID0 UID1 UID2 CTBCCBCCBCC (1) BCC = Block Check Character, it is calculated as exclusive-or over the 4 previous bytes.

4 (2) CT = Cascade Tag, to indicate a following cascade level. Fig 1. uids according to ISO/IEC 14443 Fig 2 shows the anti -collision sequence, which is a mandatory part of the card activation sequence. It automatically selects a single PICC with 4-byte UID (= Single Size UID), 7 -byte UID (= Double Size UID) or 10-byte UID (= Triple Size UID). Cascade Level 1 In the Cascade Level 1 the PCD sends the anti -collision command CL1 (0x93) and the PICC returns either the 4-byte UID ( ) and one-byte BCC, NXP Semiconductors AN10927 MIFARE product and handling of uids AN10927 All information provided in this document is subject to legal disclaimers. NXP 2018 All rights reserved. Application note COMPANY PUBLIC Rev. 5 July 2018 190741 4 of 19 or a Cascade Tag (CT) followed by the first 3 byte of the UID ( ) and one-byte BCC.

5 The CT (0x88) indicates that the UID is not yet complete, and another Cascade Level has to follow. (1) CT = Cascade Tag (2) CL = Cascade Level Fig 2. Anti-collision sequence Note: The UID0 byte of a 4-byte UID must not be 0x88. The CL1 then must be selected, using the Select command CL1 (0x93). The PICC returns its SAK CL1, which indicates whether the UID is complete or not, and (if so), the type of card (for details refer to [1] and [2]), and whether the card supports T=CL. Cascade Level 2 If the UID is not yet complete, the PCD continues with an anti-collision CL2 command (0x95), and the PICC returns either the last 4 bytes of the Double Size UID ( ) and one-byte BCC, or a Cascade Tag (CT) followed by the next 3 bytes of the Triple Size UID ( ) and one-byte BCC. The CT (0x88) indicates that the UID is not yet complete, and another Cascade Level has to follow. Note: The UID3 byte of a 7 byte or 10-byte UID must not be 0x88.

6 NXP Semiconductors AN10927 MIFARE product and handling of uids AN10927 All information provided in this document is subject to legal disclaimers. NXP 2018 All rights reserved. Application note COMPANY PUBLIC Rev. 5 July 2018 190741 5 of 19 The CL2 then must be selected, using the Select command CL2 (0x95). The PICC returns its SAK CL2, which indicates whether the UID is complete or not, and (if so), the type of card (refer to [1] and [2]), and whether the card supports T=CL. Cascade Level 3 If the UID is not yet complete, the PCD continues with an anti -collision CL3 command (0x97), and the PICC returns the last 4 bytes of the Triple Size UID ( ) and one-byte BCC. The CL3 then must be selected, using the Select command CL3 (0x97). The PICC returns its SAK CL3, which indicates the type of card (refer to [1] and [2] ), and whether the card supports T=CL.

7 Single size UID The single size UID contains 4 bytes. As shown in Table 1, the value of the UID0 byte defines how those 4 bytes shall be interpreted. Table 1. Assignment of Single Size uids POR = Power on reset UID0 [hex] Definition Range 08 RID: UID1, UID2 and UID3 are dynamically generated during or after each Power-On-Reset (POR) appr. 16 million x7 Proprietary use ( used for MIFARE products) appr. billion , Proprietary use ( used for MIFARE products) appr. 218 million Proprietary use ( used for MIFARE products) appr. billion xF Fixed number, non-unique appr. 268 million 88 Cascade Tag - F8 RFU - Note: Single Size uids do not have a manufacturer code . Note: The Single Size uids (unique ones) ended, since the number of usable IDs is limited to approximately billion pieces only. To guarantee uniqueness it is recommended to migrate existing reader infrastructures to Double Size uids , 7-byte UID.

8 New infrastructures should be based directly on 7 BUID. Random ID (RID) A single size UID with UID0 = 0x08 indicates a Random Identifier. The Random ID (RID) is dynamically generated, when the PICC powers up. Deselecting a PICC does not reset the RID, but a field reset does. Note: RID is always limited to 4 bytes. Note: Depending on the PICC implementation, a UID ( Double Size UID) may be retrieved from the card by proprietary means after the PICC is selected with its RID. NXP Semiconductors AN10927 MIFARE product and handling of uids AN10927 All information provided in this document is subject to legal disclaimers. NXP 2018 All rights reserved. Application note COMPANY PUBLIC Rev. 5 July 2018 190741 6 of 19 Fixed but non-unique ID (FNUID) The 4-byte uids with UID0 = xFh are fixed identifiers (like unique ones), but the same UID might be used for several PICCs, so that contactless systems cannot rely on the uniqueness of such a PICC identifier.

9 These uids are called FNUID in the following. The probability to have 2 PICCs on one PCD at the same time with the same FNUID is still extremely low. However, it might create conflicts, if the contactless system uses the UID not only for the card activation but also as a logical reference to the PICC. There is a proposal how to handle this in chapter Re-used UID (ONUID) The very old Single Size uids will be re-used, which means the same UID might be used for several PICCs, so that contactless systems cannot rely on the uniqueness of such a PICC identifier. These ID are called ONUID in the following. The probability to have 2 PICCs on one PCD at the same time with the same ONUID is still extremely low. However, it might create conflicts, if the contactless system uses the UID not only for the card activation but also as a logical reference to the PICC. There is a proposal how to handle this in chapter Double size UID Double Size uids always contain a manufacturer code in the UID0.

10 With the double size uids each manufacturer can theoretically use up to * 1014 uids . Manufacturer code In double and triple size uids the UID0 contains the manufacturer code which indicates the manufacturer of the PICC as shown in Table 2. Table 2. Manufacturer code UID0 [hex] Definition 81 .. FE Not allowed 04 NXP Semiconductors Unique ID ranges for Double size uids Double Size uids always contain a manufacturer code in the UID0. Note: Due to the content of Double Size uids of MIFARE products the best diversification can typically be found in the UID1 and UID2. Triple size UID Triple Size uids always contain a manufacturer code in the UID0. Currently there is no PICC using a triple size UID. However, according to ISO/IEC 14443 it is mandatory that every PCD supports Triple size uids . NXP Semiconductors AN10927 MIFARE product and handling of uids AN10927 All information provided in this document is subject to legal disclaimers.