Fact-checked by Grok 2 weeks ago

MIFARE

MIFARE is a family of contactless smart card integrated circuits (ICs) developed by NXP Semiconductors, operating at a high frequency of 13.56 MHz and compliant with ISO/IEC 14443 Type A standards for proximity cards.^[1] Introduced in 1994 by Philips Semiconductors (now NXP), MIFARE revolutionized the contactless smart card industry by enabling secure, wireless data exchange for applications such as access control, public transportation ticketing, and micropayments.^[2]^[3] The MIFARE portfolio includes several variants tailored to different security and functionality needs, such as MIFARE Classic for basic legacy systems, MIFARE Plus for enhanced security in existing infrastructures, and MIFARE DESFire for advanced, multi-application environments with features like AES encryption and flexible file structures.^[4] These ICs support EEPROM memory capacities ranging from 1 KB to 8 KB, with data retention up to 10 years and write cycles exceeding 500,000, ensuring reliability in high-volume deployments.^[1] MIFARE solutions are also backward compatible across generations, facilitating seamless upgrades in large-scale systems.^[1] Since its inception, MIFARE has evolved from a simple electronic purse technology into a comprehensive ecosystem powering secure NFC-enabled solutions in smart cards, tickets, mobiles, and wearables.^[5] By 1996, it enabled the world's first large-scale contactless transport ticketing in Seoul, Korea, marking the start of widespread adoption.^[2] Today, over 12 billion MIFARE ICs have been shipped, supporting daily transactions for 1.2 billion people across more than 750 cities in public transport, hospitality, loyalty programs, and closed-loop payments.^[4] The technology's interoperability with global standards like NFC Forum Type 4 tags further extends its use to emerging areas such as smart access and identity management.^[1]

Overview

Definition and Purpose

MIFARE is a brand name owned by NXP Semiconductors for a family of integrated circuit chips used in contactless smart cards and proximity cards. These chips operate at a high frequency of 13.56 MHz, leveraging RFID and NFC principles to facilitate wireless communication between the card and a reader device.^[4]^[6] MIFARE technology complies with the ISO/IEC 14443 Type A standard for proximity cards, which defines the physical characteristics, radio frequency power, and signal interface for contactless integrated circuit cards. This compliance enables reliable non-contact data exchange over short distances, typically up to 10 cm, making it suitable for quick and convenient interactions without physical insertion.^[6]^[7] The primary purposes of MIFARE are to provide secure data storage and efficient transaction processing in various applications, including public transportation ticketing, building access control, and personal identification systems. By supporting rewritable memory and basic cryptographic features, MIFARE distinguishes itself from simpler RFID technologies, which are often limited to passive tagging without advanced processing or security capabilities.^[3]^[4]

Development and Ownership

MIFARE technology originated in 1994 when Mikron, an Austrian semiconductor company based in Gratkorn, developed the world's first contactless smart card integrated circuit (IC) under the name MIFARE, standing for MIKron FARE collection system, primarily aimed at fare collection applications.^[8] This innovation marked a significant advancement in contactless identification, building on Mikron's expertise in radio frequency (RF) transmission technologies.^[9] In 1995, Philips Semiconductors acquired Mikron, integrating its contactless IC portfolio, including MIFARE, which accelerated commercialization and global adoption through Philips' established manufacturing and distribution networks.^[9] The acquisition provided Philips with advanced RF anti-collision and high-data-rate capabilities, enabling broader deployment in smart card ecosystems. In 2006, Philips Semiconductors was spun off as an independent entity named NXP Semiconductors, which assumed full ownership of the MIFARE trademark and continued research and development efforts.^[10] Under NXP's stewardship, MIFARE has achieved substantial market penetration, with over 12 billion contactless and dual-interface ICs sold worldwide as of 2022.^[11] NXP maintains control through a licensing model that allows third-party manufacturers to produce compatible cards and readers, fostering an ecosystem of interoperable products while ensuring security standards.^[12] This approach has supported MIFARE's integration into diverse applications, from public transport to access control, without compromising proprietary advancements.

Technical Specifications

Contactless Interface

MIFARE cards operate in the high-frequency band at 13.56 MHz, utilizing inductive coupling between the reader's antenna and the card's coil to enable both power supply to the passive card and bidirectional data transfer without physical contact.^[13] This electromagnetic induction generates an alternating magnetic field that induces a voltage in the card's antenna, powering the integrated circuit and facilitating communication over typical distances of up to 10 cm.^[7] The contactless interface adheres to the ISO/IEC 14443 standard for proximity cards, specifically Type A, with compliance to Part 1 defining physical characteristics such as card dimensions and RF field limits, and Part 2 specifying the RF power and signal interface including modulation depth and field strength requirements.^[7] Part 3 covers initialization and anticollision procedures to select and activate a single card from multiple in the reader's field.^[7] Advanced MIFARE variants, such as DESFire, further comply with Part 4, which outlines a half-duplex block transmission protocol for structured data exchange, including error detection and protocol negotiation like the Request for Answer to Select (RATS) command.^[14] Communication employs distinct modulation schemes for each direction: from reader to card, 100% amplitude shift keying (ASK) with Miller coding at subcarrier frequencies derived from the 13.56 MHz carrier, ensuring robust signal detection.^[13] Conversely, card-to-reader transmission uses load modulation on a subcarrier (typically 847 kHz), encoded with Manchester coding at 106 kbit/s or binary phase-shift keying (BPSK) at higher data rates for self-clocking and reliable bit synchronization.^[13] Data rates start at 106 kbit/s in both directions for basic operations but can reach up to 848 kbit/s in compliant implementations, supporting faster transactions in high-throughput scenarios.^[14] To manage multiple cards in the field, the anticollision mechanism follows a binary tree search algorithm as defined in ISO/IEC 14443-3 Type A, where the reader iteratively queries unique identifiers (UIDs) bit by bit, detecting collisions and branching to isolate individual cards through cascaded levels for 4-, 7-, or 10-byte UIDs.^[15] This deterministic process ensures efficient selection without requiring time-slotted responses, minimizing identification time even with several cards present.^[16]

Memory Organization and Byte Layout

MIFARE chips employ electrically erasable programmable read-only memory (EEPROM) for non-volatile, rewritable data storage, enabling repeated updates while retaining information without power.^[17] EEPROM capacities range from approximately 48 bytes in MIFARE Ultralight variants to 8 KB in MIFARE DESFire, with data retention up to 10 years and write endurance typically from 100,000 to 500,000 cycles depending on the variant.^[1]^[17] Memory organization and byte layout vary across MIFARE families. In the MIFARE Classic family, the memory is divided into logical sectors, each comprising multiple blocks of 16 bytes, providing a structured format for data management.^[18] The first block in sector 0 serves as the manufacturer block, containing the unique identifier (UID), which is 4 or 7 bytes and uniquely identifies the chip.^[18] Subsequent blocks within a sector function as data blocks for user information, while the final trailer block stores access control elements.^[18] In contrast, MIFARE DESFire uses a flexible file system supporting multiple applications and files, while MIFARE Ultralight employs linear addressing without sectors.^[19] Access modes for reading and writing are governed by configurations in the trailer block (in Classic), which define permissions for individual sectors and protect against unauthorized modifications.^[18] Authentication occurs via a challenge-response mechanism tied to keys housed in the trailer (in Classic), allowing secure operations on protected data.^[18] Byte layout in Classic follows a fixed pattern: the UID occupies the initial bytes of the manufacturer block, followed by manufacturer data; data blocks hold 16 bytes of arbitrary user content; and the trailer dedicates bytes to keys (typically 6 bytes each for two keys) and 4 bytes for access bits.^[18] Data integrity during transmission is maintained through a 16-bit cyclic redundancy check (CRC) appended to each block's content, verifying the accuracy of read or write operations.^[18]

Variants

MIFARE Classic Family

The MIFARE Classic family represents the original series of contactless smart card integrated circuits developed by NXP Semiconductors, designed for applications such as access control, public transportation, and micropayments. It includes three primary models: MIFARE Classic Mini, MIFARE Classic 1K, and MIFARE Classic 4K, each differing in memory capacity while sharing a common architecture for interoperability. The Mini variant provides 384 bytes of total memory with 224 bytes usable for user data, suitable for low-capacity needs. The 1K model offers 1,024 bytes total and 752 bytes usable, while the 4K model provides 4,096 bytes total and 3,440 bytes usable, enabling more complex data storage.^[17]^[18]^[20] Memory in the MIFARE Classic family is organized into sectors and blocks for efficient access and security management. The Mini has 5 sectors, the 1K has 16 sectors, and the 4K has 40 sectors (with the first 32 sectors containing 4 blocks each and the remaining 8 containing 16 blocks each). Each sector consists of 4 blocks of 16 bytes (64 bytes total per sector in standard configurations), where the first three blocks hold data and the fourth is the sector trailer. The trailer stores two secret keys—Key A (mandatory, 6 bytes) and Key B (optional, 6 bytes)—along with access condition bits that define read/write permissions for the sector's data blocks. Sector 0, block 0 serves as a manufacturer block, containing the unique identifier (UID) and is read-only.^[17]^[18]^[20] Authentication and data protection in the MIFARE Classic family rely on the proprietary Crypto-1 stream cipher, which uses 48-bit keys for mutual three-pass authentication compliant with ISO/IEC DIS 9798-2. This process secures communication between the card and reader, encrypting data transfers to prevent unauthorized access. All models support the same command set, including read, write, increment, decrement, restore, and transfer operations, ensuring backward compatibility across variants for seamless integration in existing systems.^[17]^[18]^[20] Although the MIFARE Classic family remains in production for legacy applications, NXP recommends against its use in new high-security deployments due to evolving standards, favoring successors like MIFARE Plus or DESFire for enhanced protection. It continues to be widely deployed in established infrastructures worldwide, supporting ISO/IEC 14443 Type A compliance for reliable 13.56 MHz contactless operation.^[3]^[21]

MIFARE Plus Family

The MIFARE Plus family represents an evolutionary upgrade to the MIFARE Classic series, designed to enhance security while maintaining compatibility with existing contactless infrastructures. Developed by NXP Semiconductors, it supports a phased security upgrade path, allowing cards to operate in legacy environments initially and transition to advanced cryptography as needed. This family is particularly suited for applications requiring secure data storage and transmission, such as access control and public transportation, where backward compatibility minimizes deployment costs.^[22]^[23] MIFARE Plus operates across three security levels (SL) to facilitate migration: SL1 provides full backward compatibility with MIFARE Classic using 3-pass Crypto-1 authentication, enabling seamless integration with legacy readers without immediate changes. SL2 introduces mandatory AES-128 authentication while retaining Crypto-1 keys for data confidentiality, offering an intermediate step for enhanced protection against certain attacks. SL3 employs native AES-128 for authentication, communication confidentiality, integrity via MACing, and secure messaging, providing the highest level of security with optional proximity checks.^[22]^[23] Memory in MIFARE Plus is available in 2 kB or 4 kB EEPROM variants, organized into sectors for structured data access. The 2 kB version features 32 sectors, each comprising 4 blocks of 16 bytes (64 bytes per sector total). The 4 kB version extends this with 32 sectors of 4 blocks plus 8 additional sectors of 16 blocks (256 bytes per extended sector), supporting up to 200,000 write cycles and 10-year data retention. This layout mirrors MIFARE Classic for ease of adaptation but includes reserved areas for security keys and transaction data.^[22]^[23] Backward compatibility is a core feature, with MIFARE Plus cards emulating MIFARE Classic behavior in SL1 mode, allowing detection and operation by unmodified ISO/IEC 14443 Type A readers. This enables pre-issuance of high-security cards that function in Classic ecosystems until infrastructure upgrades occur, reducing risks during transitions.^[22]^[23] Additional capabilities include transaction messaging via Transaction MAC (TMAC) for verifying multi-step operations, mutual three-pass authentication in higher security levels, and support for elevated data rates up to 848 kbit/s for faster interactions. These features enhance reliability in dynamic environments like fare collection systems.^[23] Specific models within the family include MIFARE Plus EV1, available in 2 kB and 4 kB configurations as the foundational version with standard security migration. MIFARE Plus EV2 builds on EV1 with enhancements such as improved key diversification using symmetric AES and ECC-based originality checks, along with stricter SL1 update controls for better protection during the upgrade process.^[23]

MIFARE Ultralight Family

The MIFARE Ultralight family consists of low-cost contactless ICs designed primarily for limited-use applications such as single-trip tickets and simple data storage, offering a balance of affordability and basic functionality without the complexity of multi-sector memory or advanced multi-application support. These ICs operate at 13.56 MHz in compliance with ISO/IEC 14443 Type A and support anticollision protocols for reliable reading in high-density environments.^[24]^[25] Key models in the family include the original MIFARE Ultralight (MF0ICU1), which provides 16 pages of 4 bytes each for a total EEPROM of 64 bytes, with 48 bytes dedicated to user memory across pages 04h to 0Fh.^[24] The MIFARE Ultralight EV1 extends this with variants MF0UL11 (20 pages total, 48 bytes user memory) and MF0UL21 (41 pages total, 128 bytes user memory), maintaining backward compatibility with the original for the first 512 bits.^[25] The MIFARE Ultralight C (MF0ICU2) offers 48 pages for 192 bytes total EEPROM, including 144 bytes of user memory from pages 04h to 27h, along with a 16-bit one-way counter for usage tracking.^[26] MIFARE Ultralight AES variants provide user memory options of 48 bytes, 128 bytes, or 144 bytes, with the 144-byte model organized across 36 user pages in a 60-page total structure.^[27] The memory structure in the Ultralight family uses a linear organization of fixed 4-byte pages without sectors, enabling straightforward sequential access suitable for simple read/write operations.^[24]^[25] Lockable areas allow permanent protection of data through one-time programmable (OTP) bits, with granularity ranging from individual pages in the original model (pages 03h to 0Eh) to 2-page blocks in larger EV1 variants, preventing further writes once set.^[24]^[26]^[25] The base MIFARE Ultralight and EV1 models lack built-in cryptographic engines, relying instead on basic mechanisms like password protection (32 bits in EV1) and OTP areas for limited data integrity.^[24]^[25] Later variants introduce enhanced protection: Ultralight C adds 3DES authentication for secure access to protected areas, while Ultralight AES incorporates AES-128 for 3-pass mutual authentication and CMAC-based secure messaging to safeguard against unauthorized reads and modifications.^[26]^[27] These ICs are optimized for high-volume production in disposable formats, supporting applications like public transport tickets where rapid issuance and reading are essential, with transaction times under 35 ms and read distances up to 100 mm.^[24]^[25] They enable URL storage compliant with NFC Forum Type 2 Tag specifications, facilitating links to digital content such as event details or loyalty programs.^[25] The family also includes three independent 24-bit one-way counters in EV1, C, and AES models to prevent ticket reuse by incrementing on validation.^[26]^[25] MIFARE 2GO serves as a flexible cloud-based solution integrating the Ultralight core for embedding in paper tickets, enabling seamless digitization and management of single-use credentials in transit and event scenarios through NFC-enabled devices.^[28]^[29]

MIFARE DESFire Family

The MIFARE DESFire family comprises a series of contactless smart card integrated circuits (ICs) developed by NXP Semiconductors, designed for secure multi-application environments such as access control, public transportation, and loyalty programs. These ICs feature a microcontroller-based architecture with robust cryptographic capabilities, enabling flexible data storage and processing in complex systems. Unlike sector-based predecessors, DESFire employs a file-based structure that supports multiple independent applications on a single card, facilitating virtual card architectures where diverse services can coexist without interference.^[30]^[19] The family evolved through several models to enhance performance and security. The original MIFARE DESFire (MF3ICD40), introduced around 2002, was available in 2K, 4K, and 8K EEPROM variants and relied on DES and 3DES cryptography with 56/112/168-bit keys for authentication and secure messaging. It was succeeded by MIFARE DESFire EV1 (MF3ICD41) in 2008, which introduced enhanced native commands for improved interoperability, while maintaining 2K, 4K, and 8K memory options and adding AES-128 support alongside legacy DES/3DES. Subsequent iterations include MIFARE DESFire EV2 (MF3DX2/MF3DHX2) from 2016, emphasizing faster transaction speeds through optimized protocols and unlimited applications per card, available in 2K to 32K EEPROM sizes with AES-128 as the primary algorithm and compatibility for DES/3DES. The latest MIFARE DESFire EV3 (MF3DHX3), released in 2020, offers up to 16 kB EEPROM and incorporates advanced features like the D40 backward-compatibility mode for 3DES, alongside AES-128/256, while supporting unlimited applications and enhanced proximity checks. Additionally, the MIFARE DESFire EV3C variant extends EV3 functionality with emulation capabilities, allowing it to mimic legacy card types such as MIFARE Classic for seamless system migrations.^[31]^[19]^[32]^[33] At its core, the DESFire structure utilizes a hierarchical file system with up to 32 files per application—such as standard data, value, linear record, cyclic record, and transaction MAC files—enabling granular access control via diversified keys and secure messaging with message authentication codes (MAC). This design supports up to 32 applications in early models like EV1, expanding to unlimited in EV2 and later, promoting a virtual card approach for segmented data isolation. All models comply fully with ISO/IEC 14443-4 for contactless communication at 13.56 MHz, including advanced protocol features like APDU support per ISO/IEC 7816-4, ensuring broad interoperability.^[31]^[19]^[32] Key features include an on-chip backup management system for atomic operations and data integrity via anti-tear mechanisms, preventing incomplete transactions during power loss. Transaction history logging is facilitated through cyclic record files, which maintain audit trails for compliance in multi-application scenarios. These elements, combined with Common Criteria EAL5+ certification across recent models, position DESFire as a high-capacity, secure alternative to single-application systems, emphasizing cryptographic strength over minimalistic designs.^[19]^[32]

Specialized Variants

The MIFARE SAM AV2 is a secure access module designed specifically for integration into contactless reader devices, providing enhanced security services for offline transaction processing. It features an AV2 cryptographic co-processor that supports Triple DES (TDEA), AES, and RSA algorithms, along with secure key storage for protecting access keys and assets in MIFARE-based systems. This module enables secure messaging options, including plain, MACed, and fully protected modes, and supports host authentication commands, making it suitable for applications requiring robust offline key management in terminals such as access control readers and payment devices.^[34]^[35] Introduced in November 2024, the MIFARE DUOX represents a specialized evolution in NXP's MIFARE portfolio, combining symmetric AES cryptography with asymmetric methods like ECDSA and EdDSA in a single contactless NFC IC. Available in 2 kB, 4 kB, 8 kB, and 16 kB memory configurations, it is optimized for high-security use cases including secure access control, electric vehicle (EV) charging authentication, and digital car keys. Key features include Public Key Infrastructure (PKI) support for mutual authentication between devices, secure boot mechanisms to prevent tampering, and a high data transfer rate of up to 1 Mbit/s, simplifying key management while maintaining compatibility with ISO/IEC 14443 standards.^[36]^[37] These specialized variants extend the MIFARE ecosystem beyond traditional cards by focusing on reader-side and hybrid cryptographic solutions; for instance, the SAM AV2 facilitates offline key derivation and session key generation in reader terminals, ensuring secure interactions without constant online connectivity. While other niche products like MIFARE FleX enable flexible multi-application support in sensor-integrated environments, the SAM AV2 and DUOX stand out for their targeted advancements in cryptographic versatility and deployment efficiency.^[34]^[38]

History

Origins and Early Development

The development of MIFARE began in 1994 when the Austrian company Mikron, based in Gratkorn, launched the first contactless MIFARE Classic integrated circuit (IC) chip in response to growing demand for efficient contactless ticketing solutions in public transportation and related applications. This initial chip, known as MIFARE Classic 1K, featured 1 kilobyte of user memory and operated on a 13.56 MHz radio frequency, enabling short-range proximity reading without physical contact.^[2] The technology addressed limitations of magnetic stripe and contact-based cards by offering faster transaction times and greater durability, particularly for high-volume scenarios like fare collection.^[39] In 1995, Philips Semiconductors acquired Mikron, integrating its RFID expertise and investing heavily in scaled production to commercialize MIFARE more broadly. This acquisition facilitated the first practical deployments of MIFARE chips in vending machines and access control systems across Europe, where the contactless interface simplified operations in environments requiring quick, hygienic interactions.^[2] By the late 1990s, adoption expanded to pilot projects in European public transportation, such as the Transmo system in Hertfordshire, UK, which utilized MIFARE for rapid bus boarding.^[40] During this period, the proprietary Crypto-1 stream cipher algorithm was finalized as the core security mechanism for MIFARE Classic, providing authentication and basic encryption to protect against unauthorized access in these early implementations.^[41] From 2000 to 2005, the MIFARE lineup evolved with the introduction of higher-capacity models, including the MIFARE Classic 4K variant offering 4 kilobytes of memory to support more complex multi-application use cases.^[3] This expansion coincided with rapid market growth, culminating in over 1 billion MIFARE ICs shipped worldwide by 2009, driven by widespread integration in transportation and identification systems.^[42] Early commercialization faced challenges in achieving interoperability, particularly in aligning with the emerging ISO/IEC 14443 standard for contactless proximity cards, which was published in 2000 and formalized MIFARE's Type A modulation as a baseline for global compatibility.^[8] These efforts helped solidify MIFARE's position as a foundational technology in contactless smart cards during its formative years.

Key Milestones and Evolution

In 2006, Philips Semiconductors was spun off to form NXP Semiconductors, an independent company that positioned MIFARE as its flagship product line for near-field communication (NFC) technologies, building on its established role in contactless smart cards.^[43]^[2] In 2001, NXP introduced MIFARE Ultralight, a low-cost IC designed for single-use tickets and basic applications in public transport and event ticketing, followed in 2002 by the original MIFARE DESFire, a microprocessor-based product for multi-application environments. By 2008, the portfolio expanded further with MIFARE DESFire EV1, which introduced advanced security features like AES-128 encryption.^[24]^[44] Throughout the 2010s, NXP addressed security vulnerabilities in MIFARE Classic by releasing enhanced variants and providing migration guidelines to transition systems to more secure options like MIFARE Plus and DESFire, ensuring backward compatibility while upgrading cryptographic protections.^[45] Key releases included MIFARE DESFire EV2 in 2016, which improved transaction speeds and added features such as proximity check and transaction relax for efficient multi-application smart city services.^[46] In 2020, MIFARE Plus EV2 was introduced as a drop-in replacement for legacy systems, offering AES authentication and enhanced connectivity for mobile NFC integration.^[47] Entering the 2020s, NXP continued innovation with MIFARE DESFire EV3 in 2020, enhancing operating distances and supporting NFC Forum Type 4 tags for broader interoperability in smart city ecosystems.^[48] This was followed by MIFARE DESFire EV3 variants with certified security profiles in subsequent years, culminating in the 2024 launch of MIFARE DUOX, the first contactless IC combining asymmetric (e.g., ECDSA) and symmetric cryptography for simplified public key infrastructure (PKI) integration in access control and secure transactions.^[36] By 2024, NXP had shipped over 12 billion MIFARE ICs, reflecting widespread adoption.^[5] Over these decades, MIFARE's market focus evolved from dominant use in public transportation ticketing to expanded roles in Internet of Things (IoT) devices, mobile NFC emulation for virtual credentials, and secure multi-service platforms across industries.^[5]

Security Features and Vulnerabilities

MIFARE Classic

The MIFARE Classic family employs Crypto-1, a proprietary 48-bit linear feedback shift register (LFSR)-based stream cipher for authentication and data encryption between the card and reader.^[49] This cipher generates a keystream by filtering the output of the LFSR through a non-linear function, but it is vulnerable to cryptanalytic attacks due to linear approximations that exploit statistical biases in the keystream and the use of a predictable initialization vector derived from a weak 16-bit nonce.^[49] These weaknesses allow recovery of the internal state with limited data, compromising the confidentiality of the card's 1KB or 4KB EEPROM memory, which is organized into 16 or 64 sectors of four blocks each, protected by per-sector keys. Key vulnerabilities in Crypto-1 were first demonstrated through a nested authentication attack in 2008, which recovers the pseudo-random number generator (PRNG) state by exploiting the low entropy of the card's nonce generation—limited to 16 bits—allowing an attacker with temporary physical access to replay modified authentications and extract keystream bits for sector zero. This enables partial decryption without the full key. A full break followed later in 2008 via algebraic cryptanalysis, solving a system of non-linear equations over GF(2 derived from observed keystream; using just 50 bits of keystream and one known initialization vector, the 48-bit key can be recovered in approximately 200 seconds on a 1.66 GHz PC.^[49] Subsequent attacks built on these flaws. The 2009 Dark Side attack is a card-only exploit requiring no prior trace or eavesdropping, where an attacker in proximity to the target card sends around 300 targeted queries over several minutes to reproduce the nonce and analyze keystream differentials via parity bits, fully recovering the key without reader interaction.^[50] MIFARE Classic is also susceptible to relay attacks, where communication between card and reader is intercepted and forwarded in real-time; the protocol's design tolerates message delays of up to several seconds, enabling man-in-the-middle scenarios without immediate detection.^[51] Once keys are compromised—via nested, algebraic, or Dark Side methods—cloning becomes straightforward using tools like the Proxmark3, an open-source RFID research platform that automates key recovery, memory dumping, and emulation onto blank cards.^[52] To mitigate these issues, implementers are advised to diversify sector keys from a master key using the card's unique identifier (UID) and sector number, reducing the risk of widespread key compromise from a single interception.^[53] However, due to the fundamental weaknesses in Crypto-1, long-term security requires migration to successors like MIFARE Plus, which introduces stronger encryption options while maintaining backward compatibility for gradual replacement.^[53] These vulnerabilities have had significant real-world impact, affecting an estimated 1 billion cards in circulation by 2008 across global applications like public transit and access control.^[54] A prominent example is the Dutch OV-chipkaart system for public transportation, where exploitation of Crypto-1 flaws enabled unauthorized cloning and free rides; following the 2008 disclosure, the Dutch government implemented additional security measures rather than replacing the cards. In 2024, further vulnerabilities were disclosed in unlicensed MIFARE Classic-compatible chips, such as the FM11RF08S produced by Shanghai Fudan Microelectronics, revealing a hardware backdoor that allows brute-forcing of a backdoor key in minutes to gain unauthorized access and clone cards without standard authentication.^[55] Additionally, researchers demonstrated attacks on a static encrypted nonce variant intended to resist card-only exploits, enabling key recovery through analysis of nonce generation flaws.^[56] These findings, as of 2025, underscore ongoing risks in legacy and clone deployments, particularly in access control systems for hotels and offices.

MIFARE DESFire

MIFARE DESFire is a family of contactless smart cards designed for secure multi-application use, employing standardized cryptographic algorithms to ensure confidentiality, integrity, and authentication. Early variants, such as the MF3ICD40 (also known as D40), primarily relied on the Data Encryption Standard (DES) and Triple DES (3DES) with key lengths up to 112 bits for encryption and mutual authentication.^[32] Subsequent evolutions, starting with DESFire EV1, introduced support for the Advanced Encryption Standard (AES) with 128-bit or 256-bit keys, alongside continued compatibility with DES and 3DES, allowing flexible cryptographic settings per application.^[1] These algorithms facilitate secure messaging modes, including plain communication, MACed communication for integrity, and fully enciphered modes, with Cipher-based Message Authentication Code (CMAC) derived from AES or 3DES in CBC mode to verify data integrity and authenticity during transactions.^[32] Despite these robust primitives, DESFire implementations have faced side-channel vulnerabilities requiring physical access. In 2011, researchers demonstrated a differential power analysis (DPA) attack on the MF3ICD40 variant's 3DES implementation, recovering the full 112-bit session key using non-invasive power traces collected via an oscilloscope and template-based correlation, with an attack setup costing under $3,000.^[57] This exploit targeted the authentication protocol's encryption of nonces, enabling key extraction after approximately 10,000 traces, though it did not affect later AES-based modes directly. Fault injection attacks on AES implementations have also been a concern, as demonstrated in broader cryptographic research around 2015, where induced errors during AES rounds could potentially leak key material if countermeasures are absent, though no full remote exploitation of DESFire AES has been publicly reported.^[58] The DESFire EV3 addresses prior weaknesses with enhanced protections, including the D40 Native mode for backward compatibility using DES-based authentication, but prioritizing AES-128 in EV2 secure messaging for new deployments.^[32] EV3 incorporates hardware-level resistance to DPA through exception sensors that detect anomalous power consumption and self-securing mechanisms, alongside secure key derivation that generates session keys from concatenated and rotated nonces (nR and nC) encrypted under the master key, reducing leakage risks.^[59] These features achieve Common Criteria EAL5+ certification, emphasizing resistance to physical attacks like power analysis and fault injection.^[32] All known attacks on DESFire require physical proximity and specialized equipment for side-channel or fault induction, with no documented remote full key recoveries as of 2025.^[57] For optimal security, deployments should prioritize EV3 cards with AES-128 or higher, enable EV2 secure messaging with CMAC, and implement regular key rotation to mitigate long-term exposure from potential physical compromises.^[32]

MIFARE Ultralight and Plus

The MIFARE Ultralight family, designed for low-cost applications like disposable tickets, features a base model without built-in cryptographic protections, relying instead on basic mechanisms such as one-time programmable (OTP) bits and monotonic counters for data integrity. This lack of encryption exposes the card's memory to unauthorized modifications, including bit-flipping attacks that alter specific data fields, such as lock bytes, to enable unauthorized reuse of tickets. A 2013 analysis of Ultralight-based transport tickets demonstrated how attackers could flip bits in the lock sector to bypass OTP restrictions, effectively creating unlimited-use cards without triggering security checks.^[60] The AES variant of MIFARE Ultralight introduces 128-bit AES cryptography to enhance security, supporting three-pass mutual authentication and secure messaging with CMAC for data integrity. However, this protection is limited primarily to authentication processes and does not extend to full data encryption across all operations, leaving room for cloning or replay attacks if not paired with additional system-level safeguards. In practice, the AES implementation allows limited negative authentication attempts via configurable limits, but its constrained memory (144 bytes) and focus on cost-sensitive uses make it unsuitable for scenarios requiring comprehensive encryption.^[61] MIFARE Ultralight C, an evolution within the family, incorporates a 3DES-based authentication alongside monotonic counters to track usage, but remains vulnerable to counter manipulation. Specifically, attackers can exploit a tear-off attack during write operations to the counter, bypassing anti-tearing mechanisms and resetting the 24-bit monotonic counter to zero, which undermines usage limits in applications like event ticketing. This vulnerability, documented as CVE-2021-33881, affects Ultralight C and related NTAG variants, allowing repeated use despite increment protections.^[62]^[63] MIFARE Plus builds on the Ultralight foundation with configurable security levels (SL1 to SL3), incorporating 128-bit AES for authentication and secure messaging in SL2 and SL3 modes. In SL2, AES handles authentication while retaining some Crypto-1 compatibility for data confidentiality, providing resistance to known MIFARE Classic attacks like key recovery; SL3 operates in a native AES-only mode, fully avoiding the vulnerable Crypto-1 algorithm and enhancing overall integrity with MACing. However, operation in SL1 emulates MIFARE Classic behavior, and improper configuration allowing downgrade to this level exposes the card to classic vulnerabilities, such as nested attacks.^[22] Despite these upgrades, MIFARE Plus is susceptible to relay attacks if the optional proximity check feature—available in SL3—is not enabled, as it measures response times to verify physical card proximity to the reader. Without this check, attackers can relay signals over distance, bypassing location-based controls in access systems. Enhancements like lock bits in the EV1 variant of Ultralight and Plus provide anti-tampering support, freezing memory pages and incorporating ECC signatures to prevent unauthorized writes during power interruptions.^[22]^[25] Compared to MIFARE Classic, Ultralight and Plus variants offer improved security through AES adoption and reduced reliance on proprietary Crypto-1, mitigating risks like full key extraction; however, their lightweight design limits them to low-to-medium security applications, necessitating additional backend protections for high-value uses to address residual vulnerabilities like counter bypass or relay threats.^[22]^[64]

Applications

Public Transportation

MIFARE technology saw its initial adoption in public transportation during the mid-1990s through pilot projects in Europe, particularly in Germany and the Netherlands, where contactless smart cards were tested for fare collection in urban transit systems.^[2] Today, MIFARE-based solutions are deployed in over 750 cities worldwide, enabling seamless ticketing for billions of daily journeys across buses, trains, subways, and trams.^[4] Prominent implementations include London's Oyster card system, which utilizes MIFARE DESFire EV1 cards for stored-value fare payments on the city's extensive public transport network, having migrated from MIFARE Classic in 2011.^[65] In Istanbul, the Istanbulkart employs MIFARE DESFire technology to support multi-application ticketing, allowing users to load fares for buses, metros, and ferries on a single card.^[66] Similarly, Moscow's Troika card leverages MIFARE Ultralight chips for disposable tickets and MIFARE Classic for low-cost refillable tickets, facilitating quick access to the metro, buses, and trams.^[67] Key features of MIFARE in transit include stored-value purses for flexible fare deductions and multi-ride tickets that support time-based or zonal passes, all processed via contactless readers at fare gates for rapid validation.^[29] These capabilities enable offline transactions with minimal infrastructure, reducing the need for physical ticket handling.^[68] The technology's benefits are evident in faster boarding times, with transactions completing in less than 100 milliseconds to maintain passenger flow at high-volume gates.^[17] Additionally, integration with mobile NFC via services like MIFARE 2GO allows users to provision digital tickets on smartphones, including compatibility with Google Pay for virtual transit credentials, eliminating the need for physical cards and enhancing convenience in smart city environments.^[28]^[69] A notable challenge involves upgrading legacy systems based on the vulnerable MIFARE Classic to more secure variants like DESFire EV2, which offers AES-128 encryption and improved resistance to attacks, ensuring long-term reliability in high-stakes transit operations.^[70] These migrations address security concerns while preserving backward compatibility for existing infrastructure.^[71]

Access Control and Identification

MIFARE contactless smart cards are widely deployed in physical access control systems for securing building entries, campus facilities, and corporate environments through employee badges and identification credentials. These cards facilitate rapid, secure authentication at readers installed on doors, turnstiles, and gates, enabling organizations to manage permissions efficiently across large-scale installations. The technology's compatibility with ISO/IEC 14443 standards ensures interoperability with diverse reader hardware, supporting both high-frequency operations and backward compatibility with legacy systems.^[72] MIFARE cards feature a segmented memory structure, with securely isolated sectors that allow storage of multiple data types, including photo IDs for visual identity verification alongside access credentials. This multi-sector design supports up to 28 applications on advanced variants like DESFire, permitting the coexistence of identification data and access logic without compromising security through independent key protection per sector. For instance, universities commonly issue MIFARE DESFire EV1 cards as multifunctional student IDs, which grant entry to residences, lecture halls, and dining areas while storing personal photos and enrollment details in dedicated sectors.^[73]^[74] Government entities leverage MIFARE DESFire configurations for national and agency ID cards, capitalizing on AES-128 encryption to protect sensitive access rights in high-security settings. Hotels, meanwhile, favor MIFARE Ultralight variants for disposable key cards, where the limited-use memory and AES authentication provide cost-effective room access without the need for extensive data storage. These implementations highlight MIFARE's versatility in balancing security and usability across institutional applications.^[75]^[76] Key features of MIFARE in access control include time-based permissions, where card data encodes validity windows to restrict entry outside designated hours, enhancing operational efficiency in shift-based or event-driven environments. Integration with biometrics enables multi-factor authentication, such as combining a MIFARE card tap with fingerprint scanning for heightened verification at critical entry points. Readers supporting offline operations rely on MIFARE Secure Access Modules (SAMs), which perform cryptographic authentication and key management locally, ensuring reliability in areas with intermittent connectivity.^[77]^[34] MIFARE systems integrate seamlessly with building infrastructure for zoned control, linking card readers to elevator controllers that authorize floor-specific access based on user profiles, preventing unauthorized movement within multi-level facilities. When paired with CCTV networks, access events trigger video recording or alerts, providing comprehensive audit trails and real-time monitoring to correlate entries with visual evidence. This holistic approach underpins MIFARE's widespread adoption, with billions of units enabling secure access in global institutional deployments.^[78]^[79]^[80]

Payment and Loyalty Programs

MIFARE technologies facilitate various retail payment and loyalty applications by enabling secure, contactless transactions in non-transit environments. MIFARE Classic cards are commonly deployed in vending machines for closed-loop payments, where users preload value onto the card to purchase items without external network connectivity.^[81] This setup allows operators to implement loyalty rewards, such as discounts or promotional credits, directly on the MIFARE media to encourage repeat usage.^[81] In loyalty programs, MIFARE Ultralight cards serve as cost-effective options for store-specific schemes, storing points or rewards data on low-memory chips suitable for high-volume issuance.^[29] These cards support simple read-write operations for accumulating and redeeming loyalty points at retail points of sale. For more advanced closed-loop payments, MIFARE DESFire variants handle micropayments in retail settings, supporting multiple applications on a single card for seamless integration of payment and rewards.^[1] Key features of MIFARE in these contexts include stored value purses, which use dedicated value files to securely manage prepaid balances with decrement and increment operations protected by cryptographic checks.^[1] Coupon redemption is enabled through file structures that store digital vouchers, verifiable via mutual authentication to prevent unauthorized use. Additionally, NFC compatibility allows smartphone linking, where mobile devices emulate MIFARE cards or read tags to transfer loyalty data or initiate payments.^[82] MIFARE solutions continue to support secure contactless payments in emerging markets, leveraging their established infrastructure and compatibility with NFC standards for affordable transactions in growing digital economies as of 2025.^[5] This growth aligns with broader contactless adoption, where MIFARE's backward compatibility facilitates upgrades to higher-security standards without replacing existing ecosystems.^[5] Security in MIFARE payment and loyalty implementations relies on AES encryption for transaction integrity, ensuring that data exchanges, such as value updates or point redemptions, remain confidential and unaltered.^[83] Anti-cloning measures employ diversified keys, where unique per-card derivations from a master key prevent duplication, enhancing protection against unauthorized replication in retail environments.^[84]^[83]

Integration and Standards

Systems Integration Considerations

When integrating MIFARE systems in multi-vendor environments, effective key management is essential to maintain security across diverse hardware. The Secure Application Module (SAM), such as the MIFARE SAM AV3, serves as a dedicated secure element for storing master keys and performing cryptographic operations, thereby isolating sensitive data from the main reader processor.^[85] Key diversification techniques, supported by SAM AV2 and AV3, generate unique session keys from a base master key using card-specific identifiers like unique identifiers (UIDs), which mitigates risks from master key compromise by limiting the impact of any single breach.^[86]^[34] Compatibility across MIFARE variants requires standardized reader configurations to ensure seamless interoperability. All MIFARE products operate under ISO/IEC 14443 Type A modulation, allowing universal support via Type A-compatible readers without the need for variant-specific hardware.^[7] For advanced protocols, firmware updates on readers enable compliance with ISO 14443-4, facilitating higher-layer communications for variants like DESFire while maintaining backward compatibility with legacy systems.^[87] Multi-application deployments leverage the flexibility of MIFARE DESFire to consolidate multiple services on a single card, reducing issuance costs and user friction in environments like access control and payments. DESFire EV1 and later support native multi-application architecture, enabling independent applets for distinct schemes such as transit ticketing and loyalty programs within one credential.^[28] Migration from MIFARE Classic to DESFire can utilize dual-interface cards that embed both chips, allowing phased rollouts where legacy readers continue to function alongside new secure applications.^[88] Performance optimization in MIFARE integrations focuses on environmental factors to achieve reliable operation within the technology's inherent constraints. Readers should be positioned to maintain a 5-10 cm read range, accounting for typical high-frequency (13.56 MHz) signal attenuation from metal surfaces or interference, which ensures collision-free anti-collision during peak usage.^[89] For battery-powered readers, intelligent power management features, such as those in advanced modules like the MFRC630, dynamically adjust transmission power to extend operational life while preserving detection accuracy.^[90] Scalability in large-scale MIFARE deployments relies on robust backend architectures to handle high transaction volumes without latency. Integration with centralized databases, often via cloud platforms like MIFARE 2GO, enables real-time authorization by querying user permissions and updating card states during each tap, supporting millions of daily interactions in urban transit or enterprise access systems.^[28] This approach decouples reader hardware from data processing, allowing horizontal scaling through API-driven middleware for multi-vendor ecosystems.

Certification and Compliance

MIFARE products adhere to the ISO/IEC 14443 Type A standard for contactless smart cards, ensuring compatibility across layers 1 through 4 for physical characteristics, radio frequency power, initialization, anticollision, and transmission protocols.^[80] This compliance facilitates seamless integration in global applications such as access control and public transport. For payment variants, MIFARE DESFire series supports EMVCo specifications through its ISO/IEC 14443 foundation and secure messaging, enabling certification in contactless payment ecosystems.^[91] Additionally, specific MIFARE implementations align with NFC Forum standards, including Type 2 Tag compliance for Ultralight variants, which provide 144 bytes of user memory and anticollision support, and Type 4 Tag certification for DESFire EV3, certified under NFC Forum ID 58652 with ISO/IEC 7816-4 APDU support.^[92]^[32] Security certifications underscore the robustness of MIFARE ICs in regulated environments. The MIFARE DESFire EV3 achieves Common Criteria EAL5+ certification for both hardware and software, equivalent to levels required for e-passports and banking cards, validating resistance to sophisticated attacks.^[32] Complementing this, the MIFARE SAM AV3 secure access module holds FIPS 140-2 CAVP validation for its cryptographic functions, ensuring validated security for key management and authentication in high-stakes deployments.^[93] The MIFARE DUOX, introduced for advanced access management, attains Common Criteria EAL6+ and NFC Forum Type 4 Tag compliance, further enhancing its suitability for multi-site systems.^[37] NXP's MIFARE Certification program, conducted by independent test houses, verifies functional and security conformance at two levels: Level 1 for specification adherence and Level 2 for RFID interface integrity per ISO/IEC 14443-3, promoting interoperability among cards, readers, and terminals.^[94] This testing includes fraud detection mechanisms, such as backend monitoring for anomalous card behavior and UID deny-listing to prevent deployment of counterfeit or cloned devices.^[95] As of 2025, evolving security landscapes emphasize quantum-resistant features, with MIFARE DUOX incorporating post-quantum cryptography readiness through AES-256 alongside support for ECC-based algorithms like NIST P-256, aligning with anticipated regulatory shifts toward PQC in contactless systems.^[37] These certifications collectively enable vendor-agnostic global deployment, reducing lock-in risks and supporting scalable, secure implementations across industries.^[94]

References

[1]
[PDF] MIFARE DESFire EV2 Fact Sheet
The MIFARE DESFire EV2 contactless IC is ideal for system operators and developers building reliable, interoperable and scalable contactless solutions. The ...
[2]
25 Years of MIFARE and “THE NEW NORMAL” - NXP Semiconductors
Aug 13, 2019 · In 1994 the first MIFARE chip was introduced to the public, and just two years later the contactless revolution in transport ticketing began to ...
[3]
MIFARE Classic - NXP Semiconductors
MIFARE Classic ICs started a revolution in the contactless smart card business back in 1994. Today, they're still used in a variety of applications worldwide.
[4]
MIFARE (HF) - NXP Semiconductors
NXP MIFARE is the leading brand for contactless and dual interface smart card schemes supporting public transport, hospitality, loyalty, and micropayment ...MIFARE DESFire · MIFARE Classic · MIFARE Plus · Mifare sam
[5]
Celebrating 30 Years of MIFARE | NXP Semiconductors
Nov 28, 2024 · Since its inception by NXP in 1994, MIFARE technology has transformed from a simple electronic purse into a comprehensive suite of solutions ...<|control11|><|separator|>
[6]
MIFARE: Contactless NFC Solutions | NXP Semiconductors
MIFARE provides NFC-enabled contactless solutions in multiple form factors for a range of applications, including smart car access and smart cards.
[7]
[PDF] MIFARE ISO/IEC 14443 PICC selection - NXP Semiconductors
Aug 10, 2021 · The anti-collision procedure is mandatory for both type A and type B cards. In addition to the card activation procedure, the system itself has ...
[8]
IS THE DEBATE STILL RELEVANT? An in-depth look at ISO 14443 ...
Jul 1, 2003 · Mikron's own technology, called Mifare, was used as the basis for the standard. In 1995, Philips purchased Mikron and the Mifare technology ...
[9]
PHILIPS SEMICONDUCTORS ACQUIRES MIKRON - Telecompaper
Jun 27, 1995 · With the acquisition, Philips will gain access to advanced technology in RF transmission, including anti-collision transmission and high-data ...
[10]
Philips Semiconductors to become NXP - EE Times
Aug 31, 2006 · NXP is also associated with Philips Semiconductors' Nexperia platform where audio and video processing technologies reside. The NXP trademark ...
[11]
[PDF] The value of genuine MIfare products - NXP Semiconductors
MIFARE® is NXP's well-known brand for a wide range of contactless IC products with more than 12 billion contactless and dual interface ICs sold. MIFARE is used ...
[12]
Mifare Fobs & Cards - Security Fobs Direct
According to NXP, 10 billion of their Mifare Smart Card chips have already been sold and over 150 million reader modules are used throughout the world.
[13]
NXP and Gemalto Sign Licensing Agreement for Adding MIFARE to ...
Nov 29, 2010 · In addition to this latest license for SIM cards, NXP has licensed MIFARE technology to various chip manufacturers, while hundreds of ...
[14]
[PDF] MFRC630 (PDF) - NXP Semiconductors
READER. 1. Reader to Card 100 % ASK, Miller Coded, Transfer speed 106 kbit/s to 848 kbit/s. 2. Card to Reader, Subcarrier Load Modulation Manchester Coded or ...
[15]
[PDF] High-performance ISO/IEC 14443 A/B frontend MFRC631 and ...
Jan 3, 2024 · The MFRC631 supports higher transfer speeds of the MIFARE product family up to 848 kbit/s in both directions. The MFRC631 supports layer 2 and 3 ...
[16]
[PDF] Implementation of ISO14443A Anti-Collision Sequence in the TI ...
This application note discusses the anti-collision sequence of the ISO14443A standard implemented in the MSP430F2370 (a 16-bit ultra-low power microcontroller ...
[17]
All about the anti-collision mechanisms ! - SpringCard
Nov 13, 2018 · The part A of the norm ISO 14443 is based on a principle well-adapted to wired-logic cards: cards should answer in a synchronic manner and the ...
[18]
[PDF] MIFARE Classic EV1 1K - Mainstream contactless smart card IC for ...
• Write endurance 200000 cycles. 3 Applications. • Public transportation ... For detailed and full information see the relevant full data sheet, which is ...
[19]
[PDF] MIFARE Classic EV1 4K - Mainstream contactless smart card IC for ...
Sep 3, 2017 · The 4096 × 8 bit EEPROM memory is organized in 32 sectors of 4 blocks and 8 sectors of 16 blocks. One block contains 16 bytes. Page 8. NXP ...
[20]
[PDF] MF1 IC S20 - IDcardMarket.com
Jan 23, 2007 · 1.1 Contactless energy and data transfer. In the Mifare system, the MF1 IC S20 is connected to a coil with a few turns and then.
[21]
https://www.nxp.com/products/no-longer-manufactured/mifare-classic-1k-mainstream-contactless-smart-card-ic-for-fast-and-easy-solution-development:MF1S5035DUD
[22]
[PDF] NXP® MIFARE Plus® X
KEY FEATURES. ▻ 2K or 4K EEPROM. ▻ Simple fixed memory structure compatible with MIFARE Classic with 1K memory (MF1ICS50),. MIFARE Classic with 4K memory ...
[23]
[PDF] MIFARE Plus EV2 - NXP Semiconductors
Aug 9, 2021 · The non-volatile memory of the MF1P(H)22 is organized in 32 sectors of 4 blocks (from sector 0d to 31d). The MF1P(H)42 has in addition 8 sectors ...
[24]
[PDF] MF0ICU1 MIFARE Ultralight contactless single-ticket IC
Jul 23, 2014 · The unique 7-byte serial number (UID) and its two check bytes are programmed into the first 9 bytes of memory covering page addresses 00h, 01h ...
[25]
[PDF] MF0ULX1 - MIFARE Ultralight EV1 - NXP Semiconductors
Apr 9, 2019 · • Write endurance 100.000 cycles. • Write endurance for one-way counters. 1.000.000 cycles. 3 Applications. • Public transportation. • Event ...
[26]
[PDF] MIFARE Ultralight C - Contactless ticket IC - NXP Semiconductors
Mar 20, 2024 · MIFARE Ultralight C - Contactless ticket IC. • 32-bit user definable One-Time Programmable (OTP) area • Write endurance 100000 cycles. • Data ...
[27]
[PDF] MIFARE Ultralight AES quick start guide - NXP Semiconductors
Feb 18, 2022 · Abstract. This document gives a quick introduction to MIFARE Ultralight AES and lists all supporting documents, software tools and further ...
[28]
MIFARE 2GO | Cloud Service for NFC Devices - NXP Semiconductors
The MIFARE 2GO cloud service digitizes traditional smart city services so they can be seamlessly managed and used on NFC-enabled devices.
[29]
MIFARE® Ultralight® | NXP Semiconductors
MIFARE Ultralight ICs for limited-use applications can lead industry standard for contactless and dual interface smart card schemes.MIFARE Ultralight C · MIFARE Ultralight AES · MIFARE Ultralight EV1
[30]
MIFARE DESFire - NXP Semiconductors
NXP MIFARE DESFire product family provides highly secure microcontroller-based ICs for contactless and dual interface smart card schemes.
[31]
[PDF] MIFARE DESFire EV2 contactless multi-application IC
Jun 12, 2019 · MIFARE DESFire EV2 offers best flexibility when creating multi-application schemes and features such as MIsmartApp with multiple key sets and ...
[32]
[PDF] MF3ICDx21_41_81 MIFARE DESFire EV1 contactless multi ...
Dec 9, 2015 · It is compliant to all 4 levels of ISO/IEC 14443A and uses optional ISO/IEC 7816-4 commands.<|separator|>
[33]
[PDF] MIFARE DESFire EV3 contactless multi-application IC
Jan 11, 2024 · MF3D(H)x3 offers best flexibility when creating multi-application schemes and feature such as MIsmartApp is supporting new business models.Missing: emulation capabilities
[34]
MF3D83C0DA8 Product Information - NXP Semiconductors
30-day returnsFeatures. MIFARE DESFire EV3C, 8 KB, 17 pF, MOA8 ; Package. PLLMC: plastic leadless module carrier package; 35 mm wide tape ; Operating Features. No information ...
[35]
[PDF] MIFARE secure access module SAM AV2 - NXP Semiconductors
Sep 13, 2023 · SAM_AuthenticateMFP. SAM_AuthenticateMFP can be used for all MIFARE Plus authentications (e.g. SL1, SL2,. SL3, originality keys, SL2 re- ...
[36]
MIFARE SAM AV2 - NXP Semiconductors
The NXP MIFARE SAM AV2 hardware solution is an ideal add-on for reader devices offering additional security services. Supporting TDEA, AES and RSA capabilities.
[37]
NXP Simplifies NFC Security Applications with New MIFARE DUOX
Nov 19, 2024 · About MIFARE. Celebrating 30 years of innovation, MIFARE has been at the forefront of contactless smart card technology since its inception.
[38]
MIFARE DUOX - NXP Semiconductors
As the first contactless smartcard IC in its class to combine asymmetric and symmetric cryptography in a single chip, MIFARE DUOX simplifies key management and ...
[39]
SMARTMX3 P71D321 | Secure and Flexible Microcontroller
Available with fully certified symmetric, hash and asymmetric cryptography libraries. Solutions. Multi-application enabled by MIFARE FleX® with MIFARE ...
[40]
[PDF] NXP History: A Timeline
Philips Semiconductor founded. 1994. Philips launches MIFARE® 1K chip for automaticfare collection. 1995. Motorola technology powers. OnStar®—one of the first.Missing: Mikron | Show results with:Mikron
[41]
We're all getting smarter | Technology | The Guardian
Feb 17, 1999 · Transmo's Mifare system uses a "contactless card" based on radio-frequency identification or RFID, which allows for rapid boarding of buses, ...
[42]
Reverse-Engineering a Cryptographic RFID Tag - USENIX
2 Mifare Crypto-1 Cipher. We analyzed the Mifare Classic RFID tag by NXP (formerly Philips). This tag has been on the market for over a decade with over a ...Missing: pilots Europe 1990s
[43]
NXP History
NXP launches MIFARE Ultralight EV1—the smart paper ticketing IC. 2012. NXP-HISTORY-2012-1. Freescale launches industry's first MCU built on the Arm Cortex-M0+ ...
[44]
MIFARE DESFire EV1 - NXP Semiconductors
A MIFARE DESFire EV1 card can hold up to 28 different applications and 32 files per application. The size of each file is defined at the moment of its creation.Missing: original | Show results with:original
[45]
[PDF] AN11340 - NXP Semiconductors
May 5, 2021 · In this document the term „MIFARE Classic card“ refers to a MIFARE Classic IC-based contactless card, the term „MIFARE Ultralight card“ refers ...
[46]
NXP's MIFARE® DESFire® EV2 Fast Tracks Multi-Application Smart ...
Mar 1, 2016 · “NXP's MIFARE DESFire EV2 allows cities to easily integrate additional services like our bike-sharing service to existing city cards,” said ...
[47]
Secure Smart City Access Cardss - NXP Semiconductors
Jun 2, 2020 · In addition, NXP's upcoming MIFARE Plus EV2 IC will provide a drop-in replacement for upgrading existing MIFARE Plus and MIFARE Classic ...Missing: date | Show results with:date
[48]
[PDF] NXP Introduces MIFARE DESFire EV3 IC, Ushers In New Era of ...
Jun 2, 2020 · “With the launch of MIFARE DESFire EV3, NXP is laying the foundation for a new level of connected smart city services that are form factor.
[49]
MIFARE Innovation Roadmap – | NXP Semiconductors
Oct 24, 2016 · Since 1994, MIFARE has shaped the contactless industry like no other brand. With 260 million reader and over 10 billion ICs sold, ...Missing: milestones | Show results with:milestones
[50]
[PDF] Algebraic Attacks on the Crypto-1 Stream Cipher in MiFare Classic ...
MiFare Crypto 1 is a lightweight stream cipher used in Lon- don's Oyster card, Netherland's OV-Chipcard, US Boston's CharlieCard, and in numerous wireless ...Missing: pilots Europe late 1990s
[51]
[PDF] THE DARK SIDE OF SECURITY BY OBSCURITY
The main security vulnerability that we need to address with regard to MiFare Classic is not about cryptogra- phy, RFID protocols and software vulnerabilities.Missing: trace | Show results with:trace
[52]
[PDF] Practical Relay Attack on Contactless Transactions by Using NFC ...
session setup, would introduce about a 1.5 second delay to the attack. This ... Dismantling MIFARE Classic. In Pro- ceedings of European Symposium on ...
[53]
[PDF] A Practical Attack on the MIFARE Classic - Proxmark3
Contactless cards are based on radio frequency identification technology (RFID) [1]. In 1995 NXP,. Philips at that time, introduced mifare6. Some target ...
[54]
[PDF] Making the Best of Mifare Classic Update
Oct 6, 2008 · the Mifare sector keys should be diversified from a master key. Mifare master key (MASTER) This key is given to all readers in the sys- tem.
[55]
[PDF] Security Flaw in MIFARE Classic
Mar 12, 2008 · The working of the CRYPTO1 encryption algorithm has been reverse engineered, and we developed our own implementation of the algorithm. • We ...Missing: pilots | Show results with:pilots
[56]
OV-chipkaart - Wikipedia
Later in 2011, it appeared that TLS had started issuing a new version of the OV-chipkaart, which no longer uses the Dutch MIFARE chip but a chip manufactured by ...History and coverage · Travelling with the OV-chipkaart · Issues and criticisms
[57]
Breaking Mifare DESFire MF3ICD40: Power Analysis and Templates ...
We detail on how to recover the complete 112-bit secret key of the employed 3DES algorithm, using non-invasive power analysis and template attacks. Our methods ...
[58]
[PDF] Fault Tolerant Infective Countermeasure for AES
The fault tolerant implementation of algorithm 2 requires a much higher number of fault injections per success as compared to algorithm 2, and the ratio ...Missing: MIFARE DESFire<|control11|><|separator|>
[59]
[PDF] Reverse Engineering of Authentication Protocol in DesFire
Jul 17, 2023 · We have reverse-engineered the authentication proto- col of MIFARE DESFire EV3 cards, which consists of. D40, EV1, and EV2 secure messaging. AES ...Missing: CMAC | Show results with:CMAC
[60]
None
### Summary of Vulnerabilities in MIFARE Ultralight (circa 2012)
[61]
[PDF] MIFARE Ultralight AES contactless limited-use IC
Mar 28, 2023 · MIFARE Ultralight AES can be configured to comply to the NFC Forum Tag 2 Type technical specification, see. [20] and allows to enable NDEF data ...
[62]
CVE-2021-33881 Detail - NVD
Jun 6, 2021 · On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a tear off attack) over RFID to bypass a Monotonic Counter ...Missing: overflow | Show results with:overflow
[63]
RFID: Monotonic Counter Anti-Tearing Defeated - Quarkslab's blog
May 18, 2021 · We have demonstrated the possibility to reset completely a MIFARE Ultralight EV1 counter despite its anti-tearing features and we reported the issue to NXP.Missing: flipping 2012<|separator|>
[64]
[PDF] The Fall of a Tiny Star - Flavio D. Garcia
Verdult quickly found out that the disposable cards were MIFARE Ultralight. This kind of card does not support any cryptography and the only security mechanism.
[65]
NXP's MIFARE 2GO and Google Pay Transform Public Transportation
Mar 19, 2018 · Companies integrate NXP's MIFARE 2GO with Google Pay to provide seamless mobile travel experiences.
[66]
MIFARE Cards: A Comprehensive Guide for Beginners - Nexqo
Dec 15, 2023 · MIFARE cards were first introduced in 1994 by Philips (now NXP Semiconductors), as a brand name for their contactless smart card products. The ...What are MIFARE cards? · The history of MIFARE cards · The types of MIFARE cards
[67]
City of Istanbul Selects NXP's Multi-Application ID Technology for ...
With over 4.5 million Istanbulkarts already deployed in recent months, the MIFARE DESFire-based system delivers an improved level of service, as well as a ...
[68]
What is a MIFARE Card? - Oomph Made
Jul 1, 2025 · Introduced in 1994, MIFARE was the world's first contactless ISO/IEC 14443 memory IC with built-in cryptography. Owned and developed by NXP ...
[69]
Transport Ticketing - NXP Semiconductors
Our secure RAIN RFID ICs support hands-free access in public transport, which makes it easier to get around without having to tap a card or ticket to a reader.
[70]
Transit Payment Security Solutionss | NXP Semiconductors
Dec 2, 2014 · Virtual MIFARE tickets on a smartphone make transport that much easier. You can use your phone for anywhere, anytime ticket purchases – there's no need to wait ...Missing: value gates
[71]
MIFARE DESFire EV2 - NXP Semiconductors
... MIFARE DESFire EV2 card can hold as many applications as the memory can accommodate. Each application can hold up to 32 files with various data configurations.
[72]
How To Choose Mifare DESFire Ev1 Or Ev2-www.s4a-access.com
In this blog, we'll examine the differences between the two and hopefully demonstrate why the latter is the better choice for access control.
[73]
Access Management - NXP Semiconductors
Physical and logical access control solutions from NXP spanning MIFARE cards, NFC and UWB technologies for seamless building and device security.
[74]
MIFARE DESFire - Universal Smart Cards
This allows universities to issue DESFire cards as student ID badges that also work with any of the existing campus applications including: access control ...
[75]
HID® MIFARE Classic/HID Prox™ 1431 Combo Card | HID Global
... photo ID cards. Securely separated sectors enable multiple applications and support future growth. Different keys can protect read/write operations to build ...
[76]
https://www.nxp.com/products/MF0AESx20
[77]
MIFARE Ultralight AES - NXP Semiconductors
The MIFARE Ultralight AES IC delivers a new level of trust for limited-use tickets and key cards by supporting AES cryptographic authentication.Missing: core | Show results with:core<|control11|><|separator|>
[78]
Finger and MiFare Classic Card Based Biometric Access Control ...
Matrix offers Finger and MiFare Classic Card Based Biometric Access Control Reader with Built-in Buzzer Alert System with Tamper Detection !!
[79]
How to Choose an Elevator Access Control Security System - Avigilon
Elevator access control consists of both hardware and software that regulate who can call or enter an elevator in a building.Missing: MIFARE CCTV
[80]
https://www.nxp.com/support/microsites/mifare:MF-MIFARE
[81]
MIFARE: Contactless NFC Solutions - NXP Semiconductors
MIFARE provides NFC-enabled contactless solutions in multiple form factors for a range of applications, including smart car access and smart cards.
[82]
Closed Loop Devices - Cashless - Crane Payment Innovations
Closed loop solutions let customers load credit on MIFARE media to make vending purchases. Site operators offer loyalty rewards, promos, and discounts to ...
[83]
US8799085B2 - Redeeming coupons using NFC - Google Patents
The invention describes how a consumer can hold their NFC enabled device in proximity to an NFC enabled point-of-sale terminal and with a single “wave” or “tap ...
[84]
[PDF] MIFARE Ultralight AES features and hints - NXP Semiconductors
Feb 22, 2022 · For MIFARE Ultralight AES with 144 bytes of user memory, the lock bytes 2, 3 and 4 are located at page 28h.Missing: models structure
[85]
What are diversified security keys? - Idesco
Diversified security keys gives each transponder its own, unique security key. With 128-bit AES encryption protecting it, DESFire already provides effectively ...Missing: integrity anti-
[86]
[PDF] AN10975 MIFARE SAM AV2 Documentation and Sampling
Sep 11, 2013 · MIFARE SAMs (Secure Application Module) have been designed to provide the secure storage of cryptographic keys and cryptographic functions for ...<|control11|><|separator|>
[87]
[PDF] AN10922 Symmetric key diversifications - NXP Semiconductors
Jul 2, 2019 · MIFARE. SAM AV3 can be an optimum secure solution for this key diversification process. The master (base) key can be stored securely in the ...Missing: management | Show results with:management
[88]
MIFARE Classic EV1 1K - 4K - NXP Semiconductors
EEPROM. 1 kB - 4 kB, organized in 16 sectors with 4 blocks of 16 bytes each (one block consists of 16 bytes); User-definable access conditions for each memory ...
[89]
Multi-Technology Cards with MIFARE Classic / MIFARE DESFire
Jan 23, 2019 · Ideal Migration Solution – Multi-application card that supports two 13.56 MHz read/write contactless chips that are fully compatible with MIFARE ...
[90]
5 Ways to Solve the Difficulty of RFID Reading Distance Problem
Mifare Classic series (such as Mifare 1K and Mifare 4K): The reading distance is generally 2-10 cm, widely used in bus cards, access control cards, hotel door ...
[91]
[PDF] MFRC630 High performance MIFARE reader solution - AdvanIDe
Feb 11, 2016 · The digital module manages the complete ISO/IEC 14443A framing and error detection functionality (parity and CRC). The MFRC630 supports MIFARE ...Missing: placement | Show results with:placement
[92]
EMVCo Trademark License Agreement For Non-Payment Uses of ...
The applicable MiFARE protocols published by NXP Semiconductors NV; The applicable FeliCa protocols published by Sony Corporation. Schedule 2. Permitted Uses.
[93]
[PDF] NXP® MIFARE Ultralight® C
NXP®. MIFARE. Ultralight® C. KEY FEATURES. ▻ Fully ISO/IEC 14443 A 3 compliant. ▻ NFC Forum Type 2 Tag compliant. ▻ 144 byte EEPROM user memory.
[94]
MIFARE SAM AV3 - NXP Semiconductors
The MIFARE SAM AV3 (secure access module) is designed for flexible performance in today's IoT edge nodes, as it helps to secure keys and protect assets.Missing: offline | Show results with:offline
[95]
MIFARE Functional and Security Certifications - NXP Semiconductors
NXP MIFARE certification ensures conformity and interoperability with MIFARE products including smart cards and terminals or readers.
[96]
[PDF] AN10969 - NXP Semiconductors
Apr 22, 2020 · Fraud detection: The ability to find out that a fraudulent card exists. 3. Mechanism to stop deployment of fraudulent cards: This can be either ...