10

I have an ACR122U Contactless NFC reader. I bought a lot of blank RFID Mifare 4k tags. Their default Authentication KEY A and KEY B is FF FF FF FF FF FF.

Now I want to change them to something else. I'm using APDU structure. I'm sending commands like this and it works well:

byte[] baData = { 0x01, 0x00, (byte)i, 0x60, 0x00 };
APDUCommand apdux3 = new APDUCommand((byte)0xFF, (byte)0x86, (byte)0x00, (byte)0x00, baData, 0x05);

It works well. I don't know what this interface and model means, but using this type and structure, I want to change KEY A and KEY B.

Please help me. I can't find any document.

Regards

sarnold
  • 102,305
  • 22
  • 181
  • 238
Marc Raibowitz
  • 109
  • 1
  • 1
  • 4
  • Wasn't the SDK documentation included in the development kit, looking online it appears to all be supplied on a CD. – JonWillis Feb 06 '11 at 16:35

1 Answers1

17

That's true, chips are delivered with default key FF FF FF FF FF FF for key A and B.

To change them you have to authenticate the card with the correct access bits.

Note: the Mifare key is composed as follow:

  • 6 byte for key A
  • 4 byte for Access Bits
  • 6 byte for key B which is optional and can be set to 00 or any other value

To change your keys you have to authenticate the Sector Trailer and the write your new keys + new access conditions if you want to change them too.

Example

New key A = 00 11 22 33 44 55 Access bits not overwritten Key B not used (so FF FF FF FF FF FF)

=> Write to Sector Trailer 00 11 22 33 44 55 FF 0F 00 FF FF FF FF FF FF FF

Further details are on the NXP website available or directly at the following link: https://www.nxp.com/docs/en/data-sheet/MF1S50YYX_V1.pdf

A default Access Bits is usually FF 0F 00 that allow to write and read each block and to read and write key B.

Community
  • 1
  • 1
lucaboni
  • 2,334
  • 2
  • 29
  • 41
  • Hi @imx51, as mentioned here http://stackoverflow.com/questions/14635394/recover-sector-in-mifare-classic-1k-with-overwritten-permission-bits, I have overwritten my access keys incorrectly. Is there a way to fallback? I know what data I have over-written with. But I don't seem to be able to read/write anymore in that sector (block 7, sector 1). – gsbabil Feb 01 '13 at 00:02
  • 1
    Thanks for the answer. I was searching for hours to find a documentation. But your NXP link is dead. I found the document here: http://www.mouser.com/ds/2/302/MF1S503x-89574.pdf – Elmue Apr 21 '16 at 20:27