Mifare DESFire Key Settings
PICC Master Key Settings
PICC Master Key Settings are eight bits long.
-
Bit 0: Allows changing the Master Key.
-
"0": The Master Key is not changeable.
-
"1": The Master Key is changeable.
-
-
Bit 1: Allows listing applications and/or files.
-
"0": Master Key authentication is required to list applications and/or files.
-
"1": Master Key authentication is not required.
-
-
Bit 2: Allows creating and deleting applications and/or files without Master Key authentication.
-
"0": Master Key authentication is required to create and delete applications and/or files.
-
"1": Maser Key authentication is not required.
-
-
Bit 3: Allows changing the PICC configuration.
-
"0": Master Key authentication is required to change the PICC configuration.
-
"1": Master Key authentication is not required.
-
-
Bits 4-7: Determine key change access rights. Applying only to applications, the default value for PICC is "0000".
-
"1110": Authentication with the key to be changed is required.
-
"1111": Keys are frozen and cannot be changed
-
"0001"-"1101": Authentication with the specified key number is required.
-
PICC Master Key Setting Examples
| Hexadecimal Value | Authentication Requirement | Changeable Master Key? | Listing Applications/Files Authentication Requirement | Create/Delete | PICC Configuration Change |
| 0x0F | Master Key authentication required to change any key | Yes | Does not require Master Key authentication | Permitted without Master Key authentication | Requires Master Key authentication |
| 0xEF | Authentication with key to be changed required to change any key | Yes | Does not require Master Key authentication | Permitted without Master Key authentication | Requires Master key authentication |
| 0x1F | Authentication with key 1 required to change any key | Yes | Does not require Master Key authentication | Permitted without Master Key authentication | Requires Master Key authentication |
| 0x0E | Master Key authentication required to change any key | No | Does not require Master Key authentication | Permitted without master key authentication | Requires Master Key authentication |
| 0x07 | Master Key authentication required to change any key | Yes | Does not require Master Key authentication | Permitted without Master Key authentication | Does not require Master Key authentication |
Application Auxiliary Key Settings
Application Auxiliary Key Settings are one byte (2 characters) long that must be in the hexadecimal range (0-9 or A-F), such as "00", "01", "AA", "FF", etc.
The rightmost (least significant) digit defines the number of keys stored in an application. 0-9 or A-D are the only values allowed. For example, with an Auxiliary Key Settings value of "01", the rightmost digit ("1") defines that the application will only be created with one key, whereas with a value of "0D", the rightmost digit ("D") defines that the application will on be created with thirteen keys.
The leftmost (most significant) digit defines the encryption type and whether or not the two-byte file ID is used. The encryption type determines whether the application has a Key Type of AES, DES, or Triple DES. The appropriate Auxiliary Key Settings for each Key Type are determined by bit values as follows.
-
Bit 0 is reserved for further use and is not used; should always be set to 0.
-
Bit 1 determines if the two-byte file ID is used.
-
"__0_": The two-byte file ID is not used
-
"__1_": The two-byte file ID is used.
-
-
Bits 2-3 determine the Key Type.
-
"00__": DES
-
"01__": Triple DES
-
"10__": AES
-
Accordingly, the hexadecimal values of Application Auxiliary Key Settings for: DES applications will contain a leftmost digit of "0" if the two-byte file ID is not used, or of "2" if it is used; AES applications will contain a leftmost digit of "8" if the two-byte file ID is not used, or of "A" if it is used; Triple DES applications will contain a leftmost value of "4" if the two-byte file ID is not used, and of "6" if it is used.
Application Auxiliary Key Setting Examples
| Hexadecimal Value | Key Type | Two-Byte File IDs? | # of Keys | Key IDs |
| 05 | DES | No | 5 | 0-4 |
| 0A | DES | No | 10 | 0-9 |
| 85 | AES | No | 5 | 0-4 |
| A5 | AES | Yes | 5 | 0-4 |