3

How to identify different types of MIFARE Ultralight tags?

In document AN10834 Ultralight and Ultralight C differ by the answer from "Auth". What is this "Auth"? There is no description of this function in the datasheets to the chips.

I noticed that Ultralight C and EV1 support GET_VERSION (60h), I sent this request to EV1 card, it does not return anything to me.

Michael Roland
  • 39,663
  • 10
  • 99
  • 206
Николай
  • 131
  • 4

1 Answers1

4

In order to distinguish MIFARE Ultralight, Ultralight C, Ultralight EV1, and NTAG tags, you would first send a GET_VERSION command:

> 60

If this command succeeds, you know that the tag is an EV1 (or later) tag (e.g. MIFARE Ultralight EV1 or NTAG21x). You can, thus, narrow down the specific tag type by analyzing the resonse to the GET_VERSION command. This will reveal the product type (NTAG or Ultralight EV1) as well as product subtype, product version and storage size (which allows you to determine the exact chip type). See Distinguish NTAG213 from MF0ICU2 for a list of example product identification values.

If the GET_VERSION command fails, you can assume that it is a first generation tag (MIFARE Ultralight, Ultralight C, NTAG203). You can, thus, narrow down the specific tag type by sending an AUTHENTICATE (part 1) command:

> 1A 00

If this command succeeds, you know that the tag is MIFARE Ultralight C.

If this command fails, you can assume that the tag is either Ultralight or NTAG203. In order to distinguish between MIFARE Ultralight and NTAG203, you can try to read pages that do not exist on Ultralight (e.g. read page 41):

> 30 29
Michael Roland
  • 39,663
  • 10
  • 99
  • 206
  • For some reason, when I send the `GET_VERSION` to Ultralight EV1, it does not respond to me, although NFC TagInfo by NXP application says exactly that it's Ultralight EV1. What could be the problem? P.S. Tried the same team to send to Plus EV1, the answer was successful. At the command `1A 00` Ultralight EV1 is also not responding. – Николай Aug 14 '17 at 10:54
  • If the tag doesn't respond to GET_VERSION (and if it's properly connected to the reader), it's definitely not an EV1 tag. Does it respond to the READ_SIGNATURE command (`3C 00`)? Note that Ultralight EV1 tags do not support cryptographic authentication (`1A 00`). – Michael Roland Aug 14 '17 at 13:25
  • `READ_SIGNATURE` does not respond either. And why then the NFC TagInfo by NXP application says it's Ultralight ev1? Could it be that in some mode it will not be reflected as EV1? Well, as in analogy with the Plus EV1 and Classic. I also have Mifare Plus EV1, it's exactly EV1. She reacts to all these commands. Means commands correctly I send. – Николай Aug 15 '17 at 04:59
  • What exactly is displayed in NXP TagInfo for that tag? What does my NFC TagInfo app say about the tag? – Michael Roland Aug 15 '17 at 08:55
  • The TagInfo application defines the chip as Mifare Ultralight EV1 (MF0UL11), the manufacturer of NXP. – Николай Aug 16 '17 at 09:39