MF0ULX1 Datasheet, PDF (16/50 Pages) NXP Semiconductors – MIFARE Ultralight EV1 - contactless ticket IC

NXP Semiconductors
MF0ULx1
MIFARE Ultralight EV1 - contactless ticket IC
Remark: The CFGLCK bit activates the permanent write protection of the first two
configuration pages. The write lock is only activated after a power cycle of the MF0ULx1.
If write protection is enabled, each write attempt leads to a NAK response.
8.6 Password verification protection
The memory write or read/write access to a configurable part of the memory can be
constrained to a positive password verification. The 32-bit secret password (PWD) and
the 16-bit password acknowledge (PACK) are typically programmed into the configuration
pages at ticket issuing or personalization. The use of a chip individual password
acknowledge response raises the trust level on the PCD side into the PICC.
The AUTHLIM parameter specified in Section 8.5.6 can be used to limit the negative
verification attempts.
In the initial state of the MF0ULx1, an AUTH0 value of FFh disables password protection.
PWD and PACK are freely writable in this state. Access to the configuration pages and
any part of the user memory, can be restricted by setting AUTH0 a page address within
the available memory space. The page address is the first one protected.
Remark: Note that the password verification method available in then MF0ULx1 does not
offer a high security protection. It is an easy and convenient way to prevent unauthorized
memory access. If a higher level of protection is required, cryptographic methods on
application layer can be used to increase overall system security.
8.6.1 Programming of PWD and PACK
Program the 32-bit PWD and the 16-bit PACK into the configuration pages, see
Section 8.5.6. The password as well as the password acknowledge, are written LSByte
first. This byte order is the same as the byte order used during the PWD_AUTH command
and its response.
The PWD and PACK bytes can never be read out of the memory. Instead of transmitting
the real value on any valid READ or FAST_READ command, only 00h bytes are replied.
If the password verification does not protect the configuration pages, PWD and PACK can
be written with normal WRITE and COMPATIBILITY_WRITE commands.
If the password verification protects the configuration pages, PWD and PACK can be
written after a successful PWD_AUTH command.
The PWD and PACK are writable even if the CFGLCK bit is set to 1b. Therefore it is
strongly recommended to set AUTH0 to the page where the PWD is located after the
password has been written. This page is 12h for the MF0UL11 and 27h for the MF0UL21.
Remark: To improve the overall system security, it is strongly recommended to diversify
the password and the password acknowledge using a die individual parameter, that is, the
7-byte UID available on the MF0ULx1.
2345
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.0 — 19 February 2013
234530
© NXP B.V. 2013. All rights reserved.
16 of 50