USING MIFARE CLASSIC TAGS

VERSION 100212

Using MIFARE Classic Tags

Page |2

TABLE OF CONTENTS
1

Overview .............................................................................................................. 4
1.1

Required Reading ............................................................................................. 4

1.2

Document Scope ............................................................................................... 4

1.3

MIFARE Features ............................................................................................... 4

1.4

Accessing Memory ............................................................................................. 4

1.5

MIFARE Classic 1k Memory Structure ...................................................................... 5

1.6

MIFARE Classic 4k Memory Structure ...................................................................... 6

1.7

MIFARE Classic Access Control Options ................................................................... 7

Select Tag (0x0101) ................................................................................................10

2.1

Command Description .......................................................................................10

2.2

Command Structure..........................................................................................10

2.2.1

Flags ......................................................................................................10

2.2.2

Fields .....................................................................................................10

2.3

2.3.1

Request ..................................................................................................10

2.3.2

Response .................................................................................................10

2.4

Example 1 Selecting with Auto-detect Tag Type .....................................................10

Example 2 Starting a Tag Session using the TID .......................................................11

2.4.1

Request ..................................................................................................11

2.4.2

Response .................................................................................................11

Authenticate Tag (0x0201) .......................................................................................12

3.1

Command Description .......................................................................................12

3.2

Command Structure..........................................................................................12

3.2.1

Flags ......................................................................................................12

3.2.2

Fields .....................................................................................................12

3.3

Example 1 Authenticating MIFARE Classic Tags .......................................................12

3.3.1

Request ..................................................................................................12

3.3.2

Response .................................................................................................12

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

4

Read Tag Data (0x0102) ...........................................................................................13

4.1

Command Description .......................................................................................13

4.2

Command Structure..........................................................................................13

4.2.1

Flags ......................................................................................................13

4.2.2

Fields .....................................................................................................13

4.3

Request ..................................................................................................13

4.3.2

Response .................................................................................................13

Example 2 Reading different blocks within the authenticated sector. ...........................14

4.4.1

Request ..................................................................................................14

4.4.2

Response .................................................................................................14

4.5

Example 3 Reading the sector trailer ...................................................................14

4.5.1

Request ..................................................................................................14

4.5.2

Response .................................................................................................14

Write Tag Data (0x0103) ..........................................................................................15

5.1

Command Description .......................................................................................15

5.2

Command Structure..........................................................................................15

5.2.1

Flags ......................................................................................................15

5.2.2

Fields .....................................................................................................15

5.3

Example 1 Reading MIFARE Tag Memory ...............................................................13

4.3.1

4.4

Page |3

Example 1 Writing a block of data ......................................................................15

5.3.1

Request ..................................................................................................15

5.3.2

Response .................................................................................................15

Revision History .....................................................................................................16

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

1
1.1

Page |4

Overview
Required Reading

This document assumes you have read and are familiar with the SkyeTek Protocol V3 Reference Guide
and the SkyeTek Protocol V3 Basic Examples application note.

1.2

Document Scope

This application note describes commands for the MIFARE Classic family of tags created by the NXP
Corporation. These tags are used in contactless smart cards and proximity cards.

1.3

MIFARE Features

The MIFARE Classic card is fundamentally a memory storage device, where the memory is divided into
segments and blocks with simple security mechanisms for access control. They are ASIC-based and have
limited computational power. Thanks to their reliability and low cost, these cards are widely used for
electronic wallet, access control, corporate ID cards, transportation and stadium ticketing.

1.4

Accessing Memory

Before any memory operation can be done, the MIFARE tag must be selected and authenticated. The
possible memory operations for an addressed block depend on the key used and the access
configuration as set up in each sectors trailing block. The following sections describe the memory
structures of the MIFARE Classic 1k and Classic 4k.

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

1.5

Page |5

MIFARE Classic 1k Memory Structure

The MIFARE Classic 1K offers 1024 bytes of data storage, split into 16 sectors of 4 blocks, each
containing 16 bytes of storage. The first block of memory is reserved for manufacturer data including
the tags UID. Each sector is protected by two different keys, called A and B, which are stored in the
4th block of each sector. Each sector key can be programmed to control the reading and writing
operations within that sector. Figure 1-1 shows the memory structure of the MIFARE Classic 1k.

Figure 1-1: MIFARE Classic 1k Memory Structure

The addressing of the MIFAREs memory is done at the block level where each block address is
sequential. For example block 2 of sector 1 is address 6. The access control for each sector is
determined by the sector trailer which holds two keys as well as the access configuration bits.
Additionally, access to the sector trailer itself is also determined by the access bits and therefore care
must be taken to write the proper configuration during the personalization of new tags.

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

1.6

Page |6

MIFARE Classic 4k Memory Structure

MIFARE Classic 4K offers 4096 bytes split into forty sectors, of which 32 are same size as in the 1K with
eight more that are quadruple size sectors. The following figure shows the structure of the MIFARE
Classic 4k memory.

Figure 1-2: MIFARE Classic 4k Memory Structure

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

1.7

Page |7

MIFARE Classic Access Control Options

The MIFARE Classic tags require key A while leaving key B as optional. If key B is not used for security
it can be used for general data storage. The byte numbers for the sector trailer are shown in Figure
1-3.

Figure 1-3: Sector Trailer Byte Numbering

Within the access bits only 3 bytes (6,7, and 8) control the access for each block within that sector.
The following figure illustrates how the individual access bits are structured.

Figure 1-4: Access Control Bit Structure

In Figure 1-4 the subscripts for each bit correspond to the block number within that sector to which
that bit applies. In addition, each bits compliment is included for redundancy and security. Table 3
shows the access conditions for the sector trailer.
NOTE MIFARE Classic Tags ship with key A set to 0xFFFFFFFFFFFF.

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

Page |8

Table 1-1: Sector Trailer Access Conditions

MIFARE Classic tags are shipped in the transport configuration with C1 = 0, C2 = 0, and C3 = 0. In this
configuration key A can be used to enable configuration of the access conditions. The access conditions
for the data blocks are shown in the following table.

[1]
If key B may be read in the corresponding Sector Trailer it cannot serve for authentication
(see grey marked lines in Table 4). As a consequences, if the reader authenticates any block of a sector
which uses such access conditions for the Sector Trailer and using key B, the card will refuse any
subsequent memory access after authentication.
Table 1-2: Data Block Access Conditions

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

Page |9

For more information about value blocks, consult the tags datasheet.

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

2
2.1

P a g e | 10

Select Tag (0x0101)

Command Description

This command queries a tag placed in the readers field and returns the tags TID (UID) in the response
data. This command requires no flags to be set (except CRC if using binary communication). The
returned TID is used for further communication to select a tag out of multiple tags which may be
present in the readers field.

2.2

Command Structure

2.2.1 Flags
This and all binary mode request commands require that the CRC flag be set. In addition, this
command has the optional flags, RF and TID.
2.2.2 Fields
This command requires the basic fields shown in 2.3.1 in addition to the TID field if the TID flag is set.

2.3

Example 1 Selecting with Auto-detect Tag Type

2.3.1 Request
Start
02

Message Length
0008

Flags
0020

Command
0101

Tag Type
0000

CRC
F81A

In this request the tag type field is set with the auto detect tag type (0x0000) and only the CRC flag set
(0x0020). This causes the SkyeModule to respond with the tag type and TID of a tag in the reader field.
NOTE More information about computing the CRC, tag types, commands, and flags can be found in
the SkyeTek Protocol V3 Guide.

2.3.2 Response
The response data from the tag depends on which MIFARE tag you are using however the general
format for a MIFARE Classic 1k is illustrated below.
Start
02

Message
Length
000C

Command
Response
0101

Tag
Type
0212

TID Length

TID

CRC

0004

244EEDAB

8EC2

The readers response includes the requested command indicating a successful operation, the tag type
number (0x0212) which corresponds to a MIFARE Classic 1k card, and the tags TID which must be used
in the next command in order to start a session with the tag.

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

2.4

P a g e | 11

Example 2 Starting a Tag Session using the TID

This time repeat the select tag request while including the TID flag and RF flags as well as the TID and
tag type fields.
2.4.1 Request
Start
02

Message
Length
000D

Flags

Command

Tag Type

TID Length

TID

CRC

0068

0101

0212

04

244EEDAB

2BCD

The flag field is now 0x0068 due to the inclusion of the TID and RF Flags. The tag type has now been
changed and the TID included, indicating the tag type and specific tag we would like to start a session
with.
2.4.2 Response
Start
02

Message
Length
0007

Command
Response
0101

Data Length

Data

CRC

0001

01

037F

The response from the reader will include a session number in the data field which is to be included in
subsequent commands in order to maintain secure communication with the tag.

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

3
3.1

P a g e | 12

Authenticate Tag (0x0201)

Command Description

This SkyeProtocol V3 command handles all of the authentication routines necessary to access your tags
memory.

3.2

Command Structure

3.2.1 Flags
This command requires the session, RF, and CRC flags
3.2.2 Fields
The session number, address, and data fields are included in this request.
NOTE MIFARE Classic Tags ship with key A set to 0xFFFFFFFFFFFF.

3.3

Example 1 Authenticating MIFARE Classic Tags

3.3.1 Request
The following examples shows the format of an authenticate tag command for the MIFARE Classic tag
using the session number returned during the second tag select command. For this example we will
authenticate to block 0 in sector 0 (address 0). The RF and session flags are set and so the TID does
not need to be included.
Start
02

Message
Length
0014

Flags

Cmd

0C28

0201

Tag
Type
0212

Session

Address

01

0000

Data
Length
0007

Data

CRC

00FFFFFFFFFFFF

A6A2

NOTE The one-byte key value shown in bold is always 0x00 for key A and is any other value (0x010xFF) for key B. The next bytes define the key.

3.3.2 Response
Start
02

Message Length
0004

Command Response
0201

CRC
4158

The tag responds with the sent authenticate command (0x0201) if successful. Authentication between
the tag and reader will allow access to all user blocks within that blocks sector unless configured
otherwise. Attempting to access a block address out of the valid range will return an error and the tag
will have to be re-authenticated.

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

4
4.1

P a g e | 13

Read Tag Data (0x0102)

Command Description

This command is used to read blocks of data from a tag. MIFARE Classic cards require that an
authenticated session be established before reading tag memory.

4.2

Command Structure

4.2.1 Flags
For this command we include the session, RF, and CRC flags.
Note The TID flag is not required as long as the RF flag remains set.
4.2.2 Fields
This command requires that a number of blocks be included in addition to an address.

4.3

Example 1 Reading MIFARE Tag Memory

4.3.1 Request
Now that the tag sector has been authenticated the tag will allow read and write operations to the tags
memory blocks within that sector. The following examples illustrate reading data from the tags
memory.
STX

Message Length

Flags

Command Tag Type

Session

Address

02

000D

0428

0102

01

0000

0212

Number
Blocks
0001

CRC
3004

4.3.2 Response
Start
02

Message
Length
0016

Command
Response
0102

Data
Length
0010

Data

CRC

244EEDAB2C88040047C11E1855004805

A6A2

The 16 byte data block returned for block 1 is the manufacturer reserved block. The first 7 bytes of
the data (shown in bold) are the tags UID while the remaining blocks are for manufacturer data.

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

4.4

P a g e | 14

Example 2 Reading different blocks within the authenticated sector.

4.4.1 Request
To read the 2nd block of data we issue the following command.
STX
02

Message
Length
000D

Flags

Command

Tag Type

Session

Address

0428

0102

0212

01

0001

Number
Blocks
0001

CRC
6AD8

4.4.2 Response
STX
02

Message
Length
0016

Command
Response
0102

Data Length

Data

CRC

0010

00000000000000000000000000000000

24AF

The second block of data is user data and is not defined on shipping. For our tag, the data should be
zeros.

4.5

Example 3 Reading the sector trailer

For the last example well look at the 4th block of data (address 0x0003) which contains the sector
trailer.
4.5.1 Request
Start
02

Message
Length
000D

Flags

Command

Tag Type

Session

Address

0428

0102

0212

01

0003

Number
Blocks
0001

CRC
DF60

4.5.2 Response
Sta
rt
02

Message
Length
0016

Command
Response
0102

Data Length

Data

CRC

0010

000000000000FF078069FFFFFFFFFFFF

A6A2

The sector trailer contains keys A and B as well as the access control bits. Key A (underlined) always
returns 0s and is never readable. Key B is shown shipped with 0xFFFFFFFFFFFF. The bits shown in bold
are the access control bits. Writing an improper format to these bits will result in locking of the block,
so take precaution to format this data as shown in section 1.7.

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

5
5.1

P a g e | 15

Write Tag Data (0x0103)

Command Description

This command is used to write data to a capable tag. Writing data to the MIFARE Classic tags can only
be done with a tag in the authenticated state. See Section 3 for examples of authenticating a MIFARE
Classic tag.

5.2

Command Structure

5.2.1 Flags
This command requires the RF, session, and CRC flags to be set.
5.2.2 Fields
This command is similar to the read tag command however data length and data fields with the bits to
be written must also be included.

5.3

Example 1 Writing a block of data

In this example we will populate the second memory block with some example data.
5.3.1 Request
STX
02

Message
Length
001F

Flags

Cmd

0C28

0103

Tag
Type
0212

Session

Address

01

0001

Number
Blocks
0001

Data
Length
0010

Data

CRC

4AF1

[X = CAFEDEADBABEFADE1122334455667788]
The data X was chosen arbitrarily but must be 16 bytes long.
The response data will include the write tag command indicating a success as shown below.
5.3.2 Response
Start
02

Message Length
0004

Data
0103

CRC
4882

You can now issue a read tag command again to see your data written to the block. That concludes
this application note describing how to select, authenticate, and perform memory operations with
MIFARE Classic tags.

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com

Using MIFARE Classic Tags

P a g e | 16

Revision History

Revision

Author

Change

100212

Ryan Smith

Initial release.

Table 6-1: Revision History

Main 720.328.3425 Fax:720.228.2400

Skyetek Inc
1525 Market St. Ste 200
Denver, CO 80202
www.skyetek.com