General description

MIFARE DESFire Light (MF2DL(H)x0) is a versatile contactless smart card platform

serving the requirements of applications managed by one single entity. Offering a

powerful mix between performance, security, privacy and flexibility. It addresses the

needs of limited use and simple extended use applications. Based on these parameters

MIFARE DESFire Light is a trusted platform targeting the secure authentication of people

with an intuitive convenient user experience.

MIFARE DESFire Light is fully compliant with the contactless proximity smart card

protocol according to ISO/IEC 14443-4 and ISO/IEC 7816-4 communication frames

making it compatible with the majority of existing contactless infrastructure devices and

with NFC devices, such as NFC enabled mobile handsets. Its contactless performance

supports superior user convenience and reading distances up to 10 cm.

MIFARE DESFire Light has a file-based memory structure compliant to ISO/IEC 7816-4

with a fixed, pre-defined configuration of six individual files (EF). The pre-defined

configuration enables various use cases and allows the management of data according

to best practice. Organized in one single directory (DF) and configurable access rights

per file it enables different use cases of one issuing instance. MIFARE DESFire Light

offers three individual standard data files with totally 544 bytes of memory for storage of

application-specific data. The value file with a stored signed integer value and an upper

and lower limit enables fast, flexible and secure implementation of monetary transactions,

e.g. for micropayment applications. The cyclic record file with 4 entries of 16 bytes each

enables an on-card logging of transactions.

As a contactless platform, MIFARE DESFire Light includes a powerful transaction

management. This transaction management ensures data and transaction consistency

supporting applications with the avoidance of disrupted or incomplete transactions. The

optional Transaction Message Authentication (TMAC) further enables operators of, e.g.,

payment applications with a cryptographic checksum over the complete transaction

enabling the verification of a transaction by a clearing entity.

MIFARE DESFire Light offers AES-based security features for authentication and data

transfer over the contactless interface. The required level of security is defined by the

needs of the application and can be done on a file basis. With 5 customer defined keys,

MIFARE DESFire Light supports a key management addressing the organizational and

security needs of the issuing entity.

Beside the standard AES implementation, MIFARE DESFire Light offers an alternative

AES-based protocol for authentication and secure messaging using a Leakage Resilient

Primitive, LRP. The LRP works as a wrapper around the AES cryptography and

enhances side-channel and fault resistance.

MIFARE DESFire Light contains features like the fully encrypted communication mode

enabling contactless applications to address privacy sensitive applications. With its

optional support of Random ID, it enables compliance with latest user data protection

regulations.

Users of MIFARE DESFire Light can change the application identifier (AID) and the file

identifiers (FID) according to their needs enabling compatibility with existing data models.

This further enables users to complement their use cases with an NFC forum-compliant

Type 4 Tag in order to enable additional, end-user centric services, such as business

card sharing or pairing with a network.

MIFARE DESFire Light is compatible with MIFARE DESFire EV2, a secure multiapplication

platform. Through this compatibility single application running on

MIFARE DESFire Light can become part of a multi-application solution, combining

applications from different entities, with minimal system impact.

MIFARE DESFire Light is designed to support standards Class 1 smart cards antenna

designs with a 17 pF input capacitance as well as smaller form factors, i.e. key fobs,

wristbands, by providing 50 pF input capacitance delivery forms. This ensures high user

convenience throughout different form factors.

Features and benefits

2.1 RF Interface & Communication Protocol

? Contactless interface compliant to ISO/IEC 14443A-2/ -3/ -4, see [1] , [2], [3]

? Support of ISO/IEC 7816-4 communication frames for highest interoperability with

mobile and wearables

? Low power consumption (Hmin) enabling operating distances of up to 10 cm

? Support of fast data rates: 106 kbit/s, 212 kbit/s, 424 kbit/s, and 848 kbit/s

? Support of double size (7-byte) Unique Identifiers (UID) and optionally Random ID

(RID) according to ISO 14443-3 [2]

? Configurable communication frame size to support up to 128 bytes

? Fast start-up time for reliable and robust detection of MIFARE DESFire Light in legacy

terminals

? Support of ISO 7816-4 wrapped commands compliant to a subset of MIFARE DESFire

EV2 commands

2.2 Memory Organization

? 640 bytes user memory, equivalent to available user memory on legacy MIFARE

Classic 1 kB product

? Data retention of 10 years and write endurance of minimum 200.000 cycles

? File system compliant to ISO/IEC 7816-4 with one predefined Directory File (DF) and a

set of Elementary Files (EF)

– Three standard data files, one with 32 bytes and two with 256 bytes

– One cyclic record file of 4 records of each 16-byte record size

– One value file for value operations including upper and lower limits

– Optional Transaction Message Authentication Code (TMAC) file for transaction

protection

? File system compliant with MIFARE DESFire EV2 file system

? User configurable file naming enabling compatibility to legacy systems and NFC Type 4

Tag compliant configurations

2.3 Security and Privacy

? Common Criteria certification: EAL4 for both Hardware and Software

? Secure messaging compliant to standard AES according to NIST Special Publication

800-38A and 800-38B [5] [6]

– Optional enhanced side channel attack protection using LRP wrapped AES operation

according to [10]

– Secure messaging compatible with a subset of MIFARE DESFire EV2 secure

messaging

? Five customer defined AES 128-bit keys including key versions

? Optional Random ID for enhanced privacy

? Individual AES 128-bit TMAC key for enhanced transaction protection

? Transaction counter limit to limit the number of transactions with the application

? 3-pass mutual authentication

? Flexible access control configurable per file (EF)

– Individual key configuration for Read (R) / Write (W) / ReadWrite (RW) / Configuration

? Configurable secure messaging communication mode

– Plain communication

– CMAC protected for message integrity protection

– Full Enciphered plus CMAC for full encryption of complete data transferred through

contactless interface

? ECC-based NXP originality signature

? AES-based originality keys leveraging the LRP wrapped AES authentication

2.4 Specific Features

? Transaction-oriented automatic anti-tearing mechanism

? Configurable ATS information for card personalization

? Functional compatibility with MIFARE DESFire EV2 for easy integration of applications

designed on MF2DL(H)x0 into flexible multi-application solutions

? High input capacitance (50 pF) for small form factor design available

Applications

MIFARE DESFire Light can be used in various contactless applications, some target

applications are mentioned below.

? Access management

? Event ticketing

? Transport ticketing

? Account based services

? Electronic voucher

? Gaming

? Loyalty cards