NXP Semiconductors

MF3D(H)x3

MIFARE DESFire EV3 contactless multi-application IC

7.5 Memory organization

The NV memory is organized using a flexible file system. This file system allows multiple numbers of different

applications on one MIFARE DESFire EV3. Each application can have multiple files. Every application is

represented by its 3 bytes Application IDentifier (AID) and an optional ISO DF Name.

5 different data file types and 1 Transaction MAC file type are supported; see Section 8.6.

A guideline to assign DESFire AIDs can be found in the application note MIFARE Application Directory (MAD);

see [3].

Each file can be created either at MIFARE DESFire EV3 initialization (card production/card printing), at MIFARE

DESFire EV3 personalization (vending machine) or in the field.

If a file or application becomes obsolete in operation, it can be permanently invalidated.

Commands which have impact on the file structure itself (e.g. creation or deletion of applications, change of

keys) activate an automatic rollback mechanism, which protects the file structure from being corrupted.

If this rollback is necessary, it is done without user interaction before carrying out further commands. To ensure

data integrity on application level, a transaction-oriented backup is implemented for all file types with backup. It

is possible to mix file types with and without backup within one application.

7.6 Available file types

The files within an application can be any of the following types:

• Standard data files

• Backup data files

• Value files with backup

• Linear record files with backup

• Cyclic record files with backup

• Transaction MAC file

7.7 Security

The 7 byte UID is fixed, programmed into each device during production. It cannot be altered and ensures the

uniqueness of each device.

The UID may be used to derive diversified keys for each ticket. Diversified MIFARE DESFire EV3 keys

contribute to gain an effective anti-cloning mechanism and increase the security of the original key.

Prior to data transmission a mutual three-pass authentication can be done between MIFARE DESFire EV3 and

PCD depending on the configuration employing either 56-bit DES (single DES, DES), 112-bit DES (triple DES,

3DES), 168-bit DES (3 key triple DES, 3K3DES) or AES. During the authentication, the level of security of all

further commands during the session is set. In addition, the communication settings of the file/application result

in the following options of secure communication between MIFARE DESFire EV3 and PCD:

• Plain data transfer (only possible within the backwards-compatible mode to MF3ICD40 and EV2 secure

messaging)

• Plain data transfer with cryptographic checksum (MAC): Authentication with backwards-compatible mode to

MF3ICD40: 4 byte MAC; All other authentications based on DES/3DES/AES: 8 byte CMAC

• Encrypted data transfer (secured by CRC before encryption): Authentication with backwards-compatible mode

to MF3ICD40: A 16-bit CRC is calculated over the stream and attached. The resulting stream is encrypted

using the chosen cryptographic method. All other authentications-based DES/3DES/AES: A 32-bit CRC is

calculated over the stream and attached. The resulting stream is encrypted using the chosen cryptographic

method. A cryptographic checksum (CMAC) will also be attached when using EV2 secure messaging.

MF3D_H_X3_SDS

All information provided in this document is subject to legal disclaimers.

© 2024 NXP B.V. All rights reserved.

Product short data sheet

Rev. 3.1 — 11 January 2024

13 / 29