SpringCard PMA82TP-BB, Reference Manual

Page 1: ...1 619 544 1450 Fax 1 619 573 6867 www springcard com SPRINGCARD the SPRINGCARD logo PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS All other brand names product names o...

Page 2: ...MATION Category Manual Keywords Group ProxRunner RFID Scanner Reader Bluetooth Configuration Reference PMA82TP Version BB Abstract Status Approved pma82tp bb doc saved 08 04 09 printed 08 04 09 REVISI...

Page 3: ...TES 8 3 CARD ACCEPTANCE TEMPLATES 9 3 1 BASIS 9 3 2 ID ONLY ACCEPTANCE TEMPLATES 12 3 3 MIFARE CLASSIC ACCEPTANCE TEMPLATE 17 3 4 MIFARE ULTRALIGHT ACCEPTANCE TEMPLATE 22 3 5 DESFIRE ACCEPTANCE TEMPLA...

Page 4: ...PRO ACTIVE and the PRO ACTIVE logo are registered trademarks of PRO ACTIVE SAS All other brand names product names or trademarks belong to their respective holders Information in this document is sub...

Page 5: ...unner Bluetooth RFID scanner is the easiest product for mobile contactless operation Thanks to its Bluetooth connection ProxRunner is integrated easily in PC PocketPC or SmartPhone based solutions Lig...

Page 6: ...emarks belong to their respective holders Information in this document is subject to change without notice Reproduction without written permission of PRO ACTIVE is forbidden 1 3 RELATED DOCUMENTS You...

Page 7: ...cts in the SpringCard RFID Scanner family and are exposed in detail in the next chapter In this chapter we ll introduce configuration tags and detail the ProxRunner s specific configuration attributes...

Page 8: ...nti collision model RFU RFU When 2 cards are in the field process the 1st and ignore the 2nd When 2 cards are in the field ignore both 3 2 00 01 10 11 Master Card Master Cards are disabled1 RFU RFU Ma...

Page 9: ...how it would get the actual data serial number block reading file selection and reading authentication keys to be used for Mifare or Desfire etc The template also defines which formatting is to be ap...

Page 10: ...443 type A layer 3 h02 ISO IEC 14443 type B layer 3 h03 ISO IEC 14443 A B layer 3 h04 ISO IEC 15693 h07 ISO IEC 14443 A B and ISO IEC 15693 h08 NXP ICODE1 h0C NXP ICODE1 and ISO IEC 15693 h0F All of t...

Page 11: ...nly Mifare UltraLight Mifare Classic Desfire 7816 4 Calypso ht1 Output format ht2 Output prefix ht3 Offset Location of data ht4 Options T CL options C options ht5 Auth method key 1st APDU ht6 Sign met...

Page 12: ...tless cards Depending on the settings you define in the Lookup List attribute tag LKL IDO the reader may either Find any supported contactless card Find only a specific family of contactless cards Fin...

Page 13: ...PUPI 4 bytes as ID Use complete ISO 14443 B ATQ 11 bytes as ID 3 0 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Output length Decimal 4 bytes seen as 10 digits i e 3...

Page 14: ...ame Tag Description Size PFX IDO ht2 ID only output prefix Var Default value absent no prefix If a non null ASCII value is specified either a single character or a string it will be transmitted before...

Page 15: ...the lookup sequence for cards in the ST MicroElectronics SR family SR176 SRX SRIX A 8 byte serial number is returned by the card Use TOF IDO and LOC IDO if you need to truncate it b ASK CTS256B and CT...

Page 16: ...d type is sent after the actual ID12 RFU 1 0 00 01 10 11 Send card s type in the output Do not send card s type Send card s type on one byte 2 hex digits see table b below Send card s type as a string...

Page 17: ...me Tag Description Size LKL MIF ht0 Mifare classic lookup list value h61 See 3 1 1 a for details 1 3 3 2 Output format Name Tag Description Size TOF MIF ht1 Mifare output format See table a below 1 a...

Page 18: ...gth 8 bytes 64 bits Fixed length 5 bytes 40 bits Fixed length 12 bytes 96 bits Fixed length 7 bytes 56 bits Fixed length 11 bytes 88 bits RFU Fixed length 16 bytes 128 bits RFU RFU RFU Decimal 5 bytes...

Page 19: ...63 for Mifare 1k cards Between 0 and 255 for Mifare 4k cards Note that data must start on a block boundary Mifare sector trailers security blocks numbered 3 7 can be read but their content is masked...

Page 20: ...s can take a long time Name Tag Description Size AUT MIF ht5 Mifare authentication key See below Default value absent a Size 1 pointer to a key in RC s secure EEPROM Values h00 to h0F refer to type A...

Page 21: ...ctor number 5 4 01 Diversify the key using RC171 algorithm 3 0 RFU 3 3 6 Reading a long string from a Mifare Classic card Note This option is only available on Prox N Roll RFID Scanner RDR K632 and Pr...

Page 22: ...d has a 7 byte serial number located on blocks 0 and 1 As the card is ISO IEC 14443 3 compliant you can read the serial number through the generic ID Only template instead of using this dedicated temp...

Page 23: ...Roll RFID Scanner RDR K632 and ProxRunner When bits 4 and 6 in TOF MIF are set ASCII output long string reading extension enabled the reader behaves as follow The output length bits 0 to 3 of TOF MIF...

Page 24: ...Triple DES authentication same ATQ SAK as MF3ICD40 3 5 1 Lookup list Name Tag Description Size LKL DFR ht0 Desfire lookup list value h71 See 3 1 1 a for details 1 3 5 2 Output format Name Tag Descrip...

Page 25: ...on Size AUT DFR ht5 Desfire authentication key See table a below 9 or 17 Default value absent No authentication is performed plain read operation is used to fetch the data a Authentication key bytes O...

Page 26: ...den 3 5 7 Reading a long string from a Desfire card Note This option is only available on Prox N Roll RFID Scanner RDR K632 and ProxRunner When bits 4 and 6 in TOF DFR are set ASCII output long string...

Page 27: ...me Tag Description Size LKL TCL ht0 7816 4 lookup list h11 value h13 See 3 1 1 a for details 1 3 6 2 Output format Name Tag Description Size TOF TCL ht1 T CL output format 1 Same as Mifare Classic out...

Page 28: ...m PPS DRI 212kbit s if card allows it Perform PPS DRI 424kbit s if card allows it Perform PPS DRI 848kbit s if card allows it 3 0 0000 0001 to 1110 1111 Card identifier CID Empty CID d0 CID from d1 to...

Page 29: ...particular error values as defined by ISO 7816 4 between h6100 and h6FFF is considered as an error and the reader will ignore the card Reader s internal buffer is limited to 128 bytes If card s answe...

Page 30: ...ading a long string from a T CL card Note This option is only available on Prox N Roll RFID Scanner RDR K632 and ProxRunner When bits 4 and 6 in TOF TCL are set ASCII output long string reading extens...

Page 31: ...essed either through ID Only or ISO IEC 7816 4 templates Working with Calypso cards is subject to a specific licence fee This function is therefore disabled in our readers unless you order them with t...

Page 32: ...nd h9FFF is considered valid Any other value for SW and in particular error values as defined by ISO 7816 4 between h6100 and h6FFF is considered as an error and the reader will ignore the card Reader...

Page 33: ...ission of PRO ACTIVE is forbidden 3 7 7 Calypso APDU 3 Typically this is a Read Binary command Name Tag Description Size AU3 CYO ht7 Calypso Innovatron APDU 3 Var Card s Status Word is checked by the...

Page 34: ...holders Information in this document is subject to change without notice Reproduction without written permission of PRO ACTIVE is forbidden 4 CONFIGURING IWM X ProxRunner RFID Scanner must be configur...

Page 35: ...horing the Master Configuration File SpringCard SQ844P also includes various configuration files that show typical configuration for Prox N Roll RFID Scanner IWM K632 FunkyGate RDR K632 ProxRunner etc...

Page 36: ...gfilecreator exe 5 2 CONFIGURATION FILES cfgfilecreator exe uses a configuration file to retrieve configuration data to be written into the Master Card Configuration files are written like standard Wi...

Page 37: ...transport key b2 000000000000 other transport key b3 CCCCCCCCCCCC unused b15 CCCCCCCCCCCC unused This section and each line in it is optional Only keys listed in this section will be written other ke...

Page 38: ...new configuration for future Master Cards The tpl5 section allows to update the card processing template reserved to Master Cards See paragraph 5 4 1 for details tpl5 aut E0 xx xx 16 byte authenticat...

Page 39: ...ait until Master Card is written If the Desfire card is not virgin the software will try to format it i e erase the whole file structure with all the data without prior notification Be sure to put on...

Page 40: ...4 lines master Master section is empty we use SpringCard s default keys tpl5 aut E0 xx xx where xx xx is the site specific 16 byte authentication key22 Put a virgin card on the Prox N Roll label it 1...

Page 41: ...instance when reader goes from one site to another This is done easily by erasing all tags from reader s memory Create a configuration file say factory ini with only those 3 lines master aut E0 xx xx...

Page 42: ...k The reader tries to fetch configuration data from Desfire cards according to the Master Card template specified in next paragraph Data are protected by an authentication key that may be changed on a...

Page 43: ...uld replace this key as soon as they receive the readers as explained in 5 4 This is the same structure as AUT DFR Name Tag Description Size AUT MAS h55 Authentication key See table a below 17 a Authe...

Page 44: ...ent 0 1 Index and options See table b below 1 16 Key data this is 128 bits key b Signing key index and options Bit Value Meaning 7 6 00 Those bits are RFU and must be 00 5 4 00 01 10 11 Key diversific...

Page 45: ...RC s secure EEPROM use the T L V scheme as follow Tag 1 byte h80 key index see chapter Mifare Classic Card Acceptance Template Len 1 byte h06 Value is the Mifare key 6 bytes exactly 6 4 DIGITAL SIGNA...

Page 46: ...K is the secret key padded with extra zeros up to 64 bytes m is the message to be authenticated opad is the value h5C repeated 64 times and ipad the value h36 repeated 64 times b HMAC MD5 HMAC MD5 is...

Page 47: ...to this card Ku HMAC Km uid0 n Ku h88 The diversified key can now be used either for Desfire authentication or for HMAC MD5 signature b Mifare key diversification The algorithm takes as inputs A 16 b...

Page 48: ...tails The algorithm takes as inputs A 16 byte Triple DES master key Km 29 The 7 byte card serial number uid It provides as output The 16 byte diversified key specific to this card Ku Here s the flowch...

Page 49: ...s the flowchart uid0 uid1 uid2 uid3 Km0 Km1 Km2 Km3 Km4 Km5 adr b0 b1 b2 b3 b4 b5 b6 b7 TDES or DES Kd b0 b1 b2 b3 b4 b5 b6 b7 Ku0 Ku1 Ku2 Ku3 Ku4 Ku5 b Diversification based on UID only If this optio...

Page 50: ...any results derived from the use of the products described in this document PRO ACTIVE will not be liable for any indirect consequential or incidental damages including but not limited to lost profits...