NXP Semiconductors

MF1P(H)x1y1

MIFARE Plus EV1

MF1P(H)x1y1

All information provided in this document is subject to legal disclaimers.

© NXP B.V. 2019. All rights reserved.

Product short data sheet

Rev. 3.2 — 6 December 2018

COMPANY PUBLIC

366932

14 / 33

8.7 Security level switching

The MIFARE Plus EV1 offers a unique feature to support migration from CRYPTO1

based systems to AES based operation. The migration on the card-side is done using

different security levels supporting different cryptographic algorithms and protocols.

There are three security levels:

• Security level 0: initial delivery configuration, used for card personalization

• Security level 1: 3-Pass CRYPTO1 Authentication (backwards compatibility mode

with MIFARE Classic EV1 1K and MIFARE Classic EV1 4K) with optional AES

authentication, optional 3-Pass AES Authentication and secure messaging.

• Security level 3: 3-Pass authentication based on AES, new data manipulation

commands secured by AES encryption and an AES based MACing method

The security level switching (i.e. from security level 1 to security level 3) is performed

using the dedicated AES authentication switching keys.

Security level switching can be done for the whole card (CardSecurityLevel) or for

dedicated sectors only (SectorSecurityLevel). In case of dedicated sectors, these can

also be switched to a mixed mode SL1SL3Mix, where both security level 1 and security

level 3 operations are accepted. Security level switching, both at card or at sector level, is

only possible to a higher security level and not to a lower security level.

8.7.1 Switching CardSecurityLevel

CardSecurityLevel switching of MF1P(H)x1y1 means that the whole PICC is switching its

security level at once. This is also the method available in MIFARE Plus EV0 and is done

by an AES authentication with the L3SwitchKey.

The product is delivered in SL0. It is possible to upgrade the PICC to security level 3

either passing through the security level 1 or directly from security level 0.

8.7.2 Switching SectorSecurityLevel

Switching the Security Level of dedicated MIFARE Sectors is done by a multiple key

AES authentication, called AuthenticateSectorSwitch, addressing the L3SectorSwitchKey

or L1L3MixSectorSwitchKey, and the AESSectorKeyB of the targeted sectors. This

command is only available after ISO/IEC 14443-4 activation in security level 1.