AT88RF04C-WA1 Atmel, AT88RF04C-WA1 Datasheet
AT88RF04C-WA1
Specifications of AT88RF04C-WA1
Related parts for AT88RF04C-WA1
AT88RF04C-WA1 Summary of contents
Page 1
... Password and Authentication Attempts Counters ⎯ Anti-tearing Function ⎯ Tamper Sensors • High Reliability ⎯ Endurance : 100,000 Write Cycles ⎯ Data Retention : 10 Years 128 byte (1 Kbit) User Zones [AT88SC0808CRF] 128 byte (1 Kbit) User Zones [AT88RF04C] CryptoRF ® Specification AT88RF04C AT88SC0808CRF AT88SC1616CRF ...
Page 2
... used in numerous applications in the same geographic area with seamless discrimination of cards assigned to a particular application during the anticollision process. Figure 1. Block Diagram RF Interface AC1 Over Voltage C Clamp VSS AC2 AT88SC0808/1616/3216/6416CRF, AT88RF04C 2 Command and Response V Regulator DD Frame Formatting and Error Clock ...
Page 3
... Verify Crypto Command [$c8] ....................................................................................................... 56 6.16. Send Checksum Command [$c9].................................................................................................. 59 6.17. DESELECT Command [$cA]......................................................................................................... 61 6.18. IDLE Command [$cB].................................................................................................................... 62 6.19. Check Password Command [$cC]................................................................................................. 63 7. Transaction Flow ................................................................................................................................... 66 8. Absolute Maximum Ratings*................................................................................................................ 67 9. Reliability................................................................................................................................................ 67 10. Electrical Characteristics ..................................................................................................................... 68 10.1. Tamper Detection .......................................................................................................................... 68 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C 3 ...
Page 4
... Appendix O. The ISO/IEC 14443 Type B RF Signal Interface................................................................ 136 Appendix P. RF Specifications and Characteristics ............................................................................. 140 Appendix Q. Transaction Time ................................................................................................................ 144 Appendix R. 88RF PICC Backward Compatibility.................................................................................. 148 Appendix S. Ordering Information .......................................................................................................... 150 Appendix T. Errata .................................................................................................................................... 155 Appendix U. Revision History.................................................................................................................. 157 AT88SC0808/1616/3216/6416CRF, AT88RF04C 4 5276C–RFID–3/09 ...
Page 5
... CryptoRF specifications. Each command / response exchange between the PCD and PICC is formatted as shown in Figure 2. The bytes are shown in the order in which they are transmitted, with PCD transmissions in the left column, and PICC transmissions in the right column. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C 5 ...
Page 6
... The CRC error detection codes are calculated using all of the previous bytes in the command or response and are appended to each command and response to allow detection of RF communication errors. These bytes are required by ISO/IEC 14443-3:2001 and are usually calculated and verified in the reader hardware. AT88SC0808/1616/3216/6416CRF, AT88RF04C 6 Reader ...
Page 7
... For User Memory Maps see Appendix C. Table 1. CryptoRF User Memory Characteristics CryptoRF Part Number AT88RF04C AT88SC0808CRF AT88SC1616CRF AT88SC3216CRF AT88SC6416CRF 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C User Memory Size User Memory Organization Bits Bytes # Zones Bytes/Zones 4K 512 ...
Page 8
... Write System Zone commands are used to access the configuration memory. For Configuration Memory Maps see Appendix D. Table 2. Configuration Memory Characteristics CryptoRF Password Sets Part Number AT88RF04C AT88SC0808CRF AT88SC1616CRF AT88SC3216CRF AT88SC6416CRF AT88SC0808/1616/3216/6416CRF, AT88RF04C 8 Key Sets Free For Customer Use 4 Sets 4 Sets 8 Sets 4 Sets 8 Sets 4 Sets 8 Sets 4 Sets ...
Page 9
... Slot Number Table 4. Coding of the Command byte for the CryptoRF Active State Command Set. Bit 7 Bit 6 Bit 5 CID CID CID CID CID CID CID CID CID CID 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Bit 4 Bit 3 Bit 2 Bit Bit 4 Bit 3 Bit 2 Bit 1 0 ...
Page 10
... The “Request B” (REQB) and “Wake-Up B” (WUPB) commands are used to probe the RF field for Type B PICCs as the first step in the anticollision process. The response to an REQB or WUPB command is the “Answer to Request B” (ATQB). PICCs in the Active State are not permitted to answer this command. AT88SC0808/1616/3216/6416CRF, AT88RF04C 10 Reader ...
Page 11
... Coding of the REQB / WUPB selection bit in the PARAM byte. Bit 3 Command 0 REQB 1 WUPB Communication error detection bytes. CRC: 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C REQB/WUPB Polling produces a PICC response from: $0 All Families and sub-families $0 All sub-families of Family “X” “Y” Only sub-family “Y” of Family “X” “Y” ...
Page 12
... Communication error detection bytes. CRC: 5.1.4. Error Handling If an REQB or WUPB command containing errors is received by the PICC ignored and no response is sent. 5.1.5. Notes The REQB and WUPB commands are identical for 88SC and 88RF CryptoRF PICCs. AT88SC0808/1616/3216/6416CRF, AT88RF04C 12 Density Code $22 $33 $44 ...
Page 13
... ATQB. PICCs in the Active State are not permitted to answer this command. 5.2.2. Command Field Description The slot number “S” is encoded within the command byte as shown in Table 9. S: Communication error detection bytes. CRC: 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader S $5 CRC1 CRC2 Protocol 1 ...
Page 14
... Protocol: Communication error detection bytes. CRC: 5.2.4. Error Handling If a Slot MARKER command containing errors is received by the PICC ignored and no response is sent. 5.2.5. Notes The Slot MARKER command is identical for 88SC and 88RF CryptoRF PICCs. AT88SC0808/1616/3216/6416CRF, AT88RF04C 14 Bit 4 Slot 0 Not Supported 1 ...
Page 15
... Sending the ATTRIB command (with a matching PUPI) after an ATQB response places the PICC in the Active State and assigns the Card ID Number (CID) to the PICC. PICCs already in the Active State or Halt State are not permitted to answer this command. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader $1D PUPI 0 ...
Page 16
... CryptoRF Active State commands use the assigned CID to direct the commands to the desired PICC. Table 10. Coding of the Card ID in the ATTRIB command and response for 88SC PICCs. Bit 7 Bit 6 Bit AT88SC0808/1616/3216/6416CRF, AT88RF04C 16 Bit 4 CID 0 Not Supported Not Supported 5276C–RFID–3/09 ...
Page 17
... If an ATTRIB command containing transmission errors is received by the PICC ignored and no response is sent. 5.3.5. Notes The ATTRIB command for 88SC PICCs is used to assign a CID in the range the PICC; CID = 0 is not supported. The ATTRIB command for 88RF PICCs is used to assign a CID in the range the PICC. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Bit 4 CID 0 0 ...
Page 18
... Response Field Description Communication error detection bytes. CRC: 5.4.4. Error Handling If a HLTB command containing errors is received by the PICC ignored and no response is sent. 5.4.5. Notes The HLTB command is identical for 88SC and 88RF CryptoRF PICCs. AT88SC0808/1616/3216/6416CRF, AT88RF04C 18 Reader PICC $50 PUPI 0 PUPI 1 ...
Page 19
... The STATUS byte does not report the success or failure of a command. In the event of multiple errors, the STATUS byte reports the first error detected. The PICC ignores commands that do not have a matching CID. Invalid command codes are also ignored. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Bit 4 Bit 3 Bit 2 ...
Page 20
... Table 15. Coding of the Password Attempt Count or Authentication Attempts Count in the 88RF ACK/NACK byte. Hexadecimal Bit AT88SC0808/1616/3216/6416CRF, AT88RF04C 20 Bit 6 Bit 5 Bit Failed Attempts Failed Attempt Failed Attempts Failed Attempts Failed Attempts Failed Attempts Failed Attempts Failed Attempts Failed Attempts Bit 6 Bit 5 Bit 4 ...
Page 21
... Bit 6 Bit Table 17. Coding of the Anti-Tearing Select bit within the PARAM byte Bit 7 Write User Zone 0 Normal Write Enabled 1 Anti-Tearing Write Enabled 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader CID $1 PARAM CRC1 CRC2 Bit 4 Bit 3 Bit 2 Bit 1 0 User Zone PICC CID ...
Page 22
... If a Set User Zone command containing transmission errors is received by the PICC ignored and no response is sent. Table 19. Status Codes returned in the Set User Zone response Error/Status Message No Errors User Zone PARAM Invalid 6.2.5. Notes The Set User Zone command is identical for 88SC and 88RF CryptoRF PICCs. AT88SC0808/1616/3216/6416CRF, AT88RF04C 22 Bit 0 User Zone ...
Page 23
... User Zone is prohibited. Only PICCs in the Active State are permitted to answer this command. If Encryption Communication Security is active the DATA bytes are encrypted; no other bytes are encrypted. In the Normal and Authentication Communication Security modes none of the bytes are encrypted. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader CID $2 ...
Page 24
... Access Denied (User Zone Not Set) PARAM Invalid Address Invalid Length Invalid Authentication or Encryption Activation Required Password Required Memory Access Error 6.3.5. Notes The Read User Zone command is identical for 88SC and 88RF CryptoRF PICCs when PARAM = $00. AT88SC0808/1616/3216/6416CRF, AT88RF04C 24 Status Code Type $00 ACK $99 NACK $A1 ...
Page 25
... User Zone is prohibited. Only PICCs in the Active State are permitted to answer this command. If Encryption Communication Security is active the DATA bytes are encrypted; no other bytes are encrypted. In the Normal and Authentication Communication Security modes none of the bytes are encrypted. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader CID $2 ...
Page 26
... Error/Status Message No errors Access Denied (User Zone Not Set) Address Invalid Length Invalid Authentication or Encryption Activation Required Password Required Memory Access Error 6.4.5. Notes The Read User Zone (Large Memory) command is not supported by 88RF PICCs. AT88SC0808/1616/3216/6416CRF, AT88RF04C 26 Bit 4 Bit 3 Bit 2 Bit ...
Page 27
... Authentication or Encryption Communication Security mode is not active, then a NACK response is returned. If the Encryption Communication Security mode is active, then the DATA bytes are encrypted. In Authentication Communication Security mode the DATA bytes are not encrypted. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader CID $2 PARAM ADDR “ ...
Page 28
... Not Acknowledge, the command did not execute correctly. NACK: The data bytes read from user memory. DATA: The checksum bytes read from the cryptographic engine. MAC: PICC status code. STATUS: Communication error detection bytes. CRC: AT88SC0808/1616/3216/6416CRF, AT88RF04C 28 PARAM $00 $80 5276C–RFID–3/09 ...
Page 29
... Access Denied (User Zone Not Set) PARAM Invalid Address Invalid Length Invalid Authentication or Encryption Activation Required Password Required Memory Access Error 6.5.5. Notes The Read User Zone command with Integrated MAC is not supported by 88SC PICCs. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Status Code Type $00 ACK $99 NACK $A1 NACK $A2 ...
Page 30
... EEPROM write is complete the data verification logic reads the new EEPROM contents and compares it to the data received in the Write User Zone command. If the data does not match then the PICC returns a NACK response with $ED in the status byte. If the data matches, the PICC returns an ACK response. AT88SC0808/1616/3216/6416CRF, AT88RF04C 30 Reader ...
Page 31
... Acknowledge, the command executed correctly. ACK: Not Acknowledge, the command did not execute correctly. NACK: PICC status code. STATUS: Communication error detection bytes. CRC: 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Write Characteristics Standard Write Anti-Tearing Write Bytes Bytes Bytes Bytes Bytes Bytes ...
Page 32
... Memory Write Error - Data Mismatch Memory Access Error 6.6.5. Notes The Write User Zone command is identical for 88SC and 88RF CryptoRF PICCs when PARAM = $00. Automatic data write verification is performed by 88RF PICCs; this function is not supported by 88SC PICCs. AT88SC0808/1616/3216/6416CRF, AT88RF04C 32 Status Code Type $00 ...
Page 33
... Only PICCs in the Active State are permitted to answer this command. If Encryption Communication Security is active the DATA bytes are encrypted; no other bytes are encrypted. In the Normal and Authentication Communication Security modes none of the bytes are encrypted. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader CID $3 ...
Page 34
... The PICC transmits its assigned card ID in the response. CID: Acknowledge, the command executed correctly. ACK: Not Acknowledge, the command did not execute correctly. NACK: PICC status code. STATUS: Communication error detection bytes. CRC: AT88SC0808/1616/3216/6416CRF, AT88RF04C 34 Bit 4 Bit 3 Bit 2 Bit Write Characteristics ...
Page 35
... Data Written (Program Only Mode) Access denied (Write Lock Mode) Password Required Modify Forbidden Memory Access Error 6.7.5. Notes The Write User Zone (Large Memory) command is not supported by 88RF PICCs. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Status Code Type $00 ACK $0C ACK $1B ACK ...
Page 36
... Write User Zone command. If the data does not match the PICC returns a NACK response with $ED in the status byte. If the data matches, the PICC returns an ACK response. If the Encryption Communication Security mode is active, then the DATA bytes are encrypted. In Authentication Communication Security mode the DATA bytes are not encrypted. AT88SC0808/1616/3216/6416CRF, AT88RF04C 36 Reader CID ...
Page 37
... The PICC transmits its assigned card ID in the response. CID: Acknowledge, the command executed correctly. ACK: Not Acknowledge, the command did not execute correctly. NACK: PICC status code. STATUS: Communication error detection bytes. CRC: 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C PARAM $00 $80 Write Characteristics Normal Write Anti-Tearing Write Bytes Bytes 37 ...
Page 38
... Authentication or Encryption Activation Required Data Written (Program Only Mode) Checksum Failure Password Required Modify Forbidden Memory Write Error - Data Mismatch Memory Access Error 6.8.5. Notes The Write User Zone command with Integrated MAC is not supported by 88SC PICCs. AT88SC0808/1616/3216/6416CRF, AT88RF04C 38 Status Code Type $00 ACK $0C ACK $99 ...
Page 39
... EEPROM write is complete the data verification logic reads the new EEPROM contents and compares it to the data received in the Write System Zone command. If the data does not match then the PICC returns a NACK response with $ED in the status byte. If the data matches, the PICC returns an ACK response. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader CID $4 ...
Page 40
... The PICC transmits its assigned card ID in the response. CID: Acknowledge, the command executed correctly. ACK: Not Acknowledge, the command did not execute correctly. NACK: PICC status code. STATUS: Communication error detection bytes. CRC: AT88SC0808/1616/3216/6416CRF, AT88RF04C 40 PARAM ADDR $00 Address $80 Address $01 Fuse addr ...
Page 41
... The Write System Zone command is identical for 88SC and 88RF CryptoRF PICCs when PARAM = $00. 88RF PICCs do not support PARAM = $80. Automatic data write verification is performed by 88RF PICCs; this function is not supported by 88SC PICCs. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Status Code Type $00 ACK ...
Page 42
... EEPROM write is complete the data verification logic reads the new EEPROM contents and compares it to the data received in the Write System Zone command. If the data does not match the PICC returns a NACK response with $ED in the status byte. If the data matches, the PICC returns an ACK response. AT88SC0808/1616/3216/6416CRF, AT88RF04C 42 Reader ...
Page 43
... Acknowledge, the command executed correctly. ACK: Not Acknowledge, the command did not execute correctly. NACK: PICC status code. STATUS: Communication error detection bytes. CRC: 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C PARAM $00 $01 $08 All Other Values Are Not Supported ADDR “L” Address # of bytes – ...
Page 44
... Integrated Checksum Mode Write Complete Access denied (Write Not Allowed) Checksum Failure Password Required Memory Write Error - Data Mismatch Memory Access Error 6.10.5. Notes The Write System Zone command with Integrated MAC is not supported by 88SC PICCs. AT88SC0808/1616/3216/6416CRF, AT88RF04C 44 Status Code Type $00 ACK $A1 NACK ...
Page 45
... Write System Zone w/ AT Write Fuse Byte When performing a fuse byte write the ADDR byte contains the address of the fuse; only one fuse may be ADDR: programmed per Write System Zone command. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader CID $4 PARAM ADDR “L” ...
Page 46
... Response Field Descriptions The PICC transmits its assigned card ID in the response. CID: Acknowledge; the command executed correctly. ACK: Not Acknowledge, the command did not execute correctly. NACK: PICC status code. STATUS: Communication error detection bytes. CRC: AT88SC0808/1616/3216/6416CRF, AT88RF04C 46 Bit 5 Bit 4 Bit 3 Bit ...
Page 47
... Fuse Access Denied Access denied (Fuse Order Incorrect) Memory Access Error 6.11.5. Notes The Write Fuse Byte option of the Write System Zone command is identical for 88SC and 88RF CryptoRF PICCs. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Status Code Type Fuse byte ACK $A2 ...
Page 48
... Only PICCs in the Active State are permitted to answer this command. If Authentication or Encryption Communication Security is active the DATA bytes read from the password (PW) registers are encrypted; no other bytes are encrypted. In the Normal Communication Security mode none of the bytes are encrypted. AT88SC0808/1616/3216/6416CRF, AT88RF04C 48 Reader CID $6 ...
Page 49
... Acknowledge, the command executed correctly. ACK: Not Acknowledge, the command did not execute correctly. NACK: PICC status code. STATUS: Communication error detection bytes. CRC: 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C PARAM ADDR $00 Address $01 $FF $02 $FF All Other Values Are Not Supported “ ...
Page 50
... PARAM Invalid Address Invalid Length Invalid Byte Access denied (Read Not Allowed) Byte Access denied (Password Required) Memory Access Error 6.12.5. Notes The Read System Zone command is identical for 88SC and 88RF CryptoRF PICCs. AT88SC0808/1616/3216/6416CRF, AT88RF04C 50 Status Code Type $00 ACK $A1 NACK ...
Page 51
... The Read Fuse Byte Option of the Read System Zone command reads the Security Fuse byte. This operation can be performed in the Normal, Authentication, or Encryption Communication modes. The fuse byte value is never encrypted. Only PICCs in the Active State are permitted to answer this command. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader CID $6 ...
Page 52
... F5 RFU RFU RFU Acknowledge, the command executed correctly. ACK: Not Acknowledge, the command did not execute correctly. NACK: PICC status code. STATUS: Communication error detection bytes. CRC: AT88SC0808/1616/3216/6416CRF, AT88RF04C 52 PARAM ADDR $00 Address $01 $FF $02 $FF All Other Values Are Not Supported SEC ...
Page 53
... Error/Status Message No errors PARAM Invalid Address Invalid Length Invalid Memory Access Error 6.13.5. Notes The Read Fuse Byte Option of the Read System Zone command is identical for 88SC and 88RF CryptoRF PICCs. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Status Code Type $00 ACK $A1 NACK $A2 NACK ...
Page 54
... Active State are permitted to answer this command. 6.14.2. Command Field Description The Card ID assigned by the ATTRIB command. CID: The PARAM byte selects the type of read operation to be performed. PARAM must be $02 for Read PARAM: Checksum. AT88SC0808/1616/3216/6416CRF, AT88RF04C 54 Reader CID $6 PARAM ADDR “ ...
Page 55
... Error/Status Message No errors PARAM Invalid Address Invalid Length Invalid Memory Access Error 6.14.5. Notes The Read Checksum Option of the Read System Zone command is identical for 88SC and 88RF CryptoRF PICCs. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C PARAM ADDR $00 Address $01 $FF $02 $FF All Other Values Are Not Supported “ ...
Page 56
... The Verify Crypto command is used to perform mutual authentication between the PICC and the Host system. The Verify Crypto command is also used to activate the Encryption Communication Security mode. Only PICCs in the Active State are permitted to answer this command. AT88SC0808/1616/3216/6416CRF, AT88RF04C 56 Reader CID ...
Page 57
... ACK: Not Acknowledge, the command did not execute correctly. NACK: PICC status code. STATUS: Communication error detection bytes. CRC: 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C The Authentication process uses one of the Secret Seeds G Key Secret Seed G 0 Secret Seed G 1 Secret Seed G ...
Page 58
... Status Codes returned in the Verify Crypto response Error/Status Message No errors Invalid Key Index Authentication or Encryption Activation Failure Memory Access Error (Security Operation) Memory Access Error 6.15.5. Notes The Verify Crypto command is identical for 88SC and 88RF CryptoRF PICCs. AT88SC0808/1616/3216/6416CRF, AT88RF04C 58 Status Code Type $00 ACK $99 NACK $A9 ...
Page 59
... The PICC transmits its assigned card ID in the response. CID: Acknowledge, the command executed correctly. ACK: Not Acknowledge, the command did not execute correctly. NACK: PICC status code. STATUS: Communication error detection bytes. CRC: 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader CID $9 MAC1 MAC2 CRC1 CRC2 CID ACK/NACK PICC ...
Page 60
... Status Codes returned in the Send Checksum response Error/Status Message No errors Checksum Failure Checksum Failure Memory Write Error - Data Mismatch Memory Access Error 6.16.5. Notes The Send Checksum command is identical for 88SC and 88RF CryptoRF PICCs. AT88SC0808/1616/3216/6416CRF, AT88RF04C 60 Status Code Type $00 ACK $C8 NACK $C9 ...
Page 61
... The PICC reports errors in the status byte of the response. Table 51. Status Codes returned in the DESELECT response Error/Status Message No errors 6.17.5. Notes The HLTB command is identical for 88SC and 88RF CryptoRF PICCs. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader CID $A CRC1 CRC2 CID PICC ...
Page 62
... If an IDLE command containing transmission errors is received by the PICC ignored and no response is sent. The PICC reports errors in the status byte of the response. Table 52. Status Codes returned in the IDLE response Error/Status Message No errors 6.18.5. Notes The HLTB command is identical for 88SC and 88RF CryptoRF PICCs. AT88SC0808/1616/3216/6416CRF, AT88RF04C 62 Reader CID $B CRC1 CRC2 CID ...
Page 63
... In Normal Communication mode the PW bytes are not encrypted. 6.19.2. Command Field Descriptions The Card ID assigned by the ATTRIB command. CID: Password Index: Identifies the password register that the PICC will check the transmitted password against. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Reader CID $C Password Index PW 1 ...
Page 64
... All Other Values Are Not Supported The password bytes. PW: Communication error detection bytes. CRC: AT88SC0808/1616/3216/6416CRF, AT88RF04C 64 Check Password Password Read 0 Password Read 1 Password Read 2 Password Read 7 Password Write 0 Password Write 1 Password Write 2 Password Write 7 Check Password Password Read 0 ...
Page 65
... Memory Access Error (Security Operation) Memory Access Error 6.19.5. Notes The Check Password command is identical for 88SC and 88RF CryptoRF PICCs. Password indexes of $03 to $06, and $13 to $16 will be NACKed by 88RF PICCs. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Status Code Type $00 ACK $A1 NACK ...
Page 66
... In a typical CryptoRF transaction the host performs anticollision, selects a User Zone, and reads or writes the user memory. When a User Zone requires a password, authentication, or encryption the host performs the required security operation before accessing the User Zone. The Set User Zone command may be sent before or after the security operation. Note: AT88SC0808/1616/3216/6416CRF, AT88RF04C 66 Polling (REQB/WUPB) Select Card ...
Page 67
... The optional CryptoRF anti-tearing functions use a single anti-tearing EEPROM buffer memory. Every anti-tearing write operation utilizes the same buffer. The anti-tearing write endurance specification is a limitation in the total number of anti-tearing write operations that can be performed by each die. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C *NOTICE: Stresses beyond those listed under “Absolute Min 100,000 ...
Page 68
... CryptoRF contains tamper detection sensors to detect operation outside of specified limits. These sensors monitor the internal supply voltage and clock frequency. An additional sensor detects high intensity light attacks. The die is disabled and will not function when tampering is detected. AT88SC0808/1616/3216/6416CRF, AT88RF04C 68 (1) Parameter temperature coefficient is < ...
Page 69
... Challenge from Host (for Encryption Activation). CH Challenge calculated by CryptoRF for Comparison with Ch C Initial Cryptogram with Index i, stored in CryptoRF Cryptogram with Index i after Authentication, stored in CryptoRF. i CID Card ID. The 4 bit code used to identify a PICC in the Active state. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C ...
Page 70
... The second of four security fuses on 88SC PICCs. fc Carrier Frequency = 13.56 MHz nominal. Fo Resonant Frequency. FO Frame Option. Forbidden Registers in the Configuration Memory that cannot be written or read. fs Subcarrier Frequency = fc/16 = 847.5 kHz nominal. AT88SC0808/1616/3216/6416CRF, AT88RF04C 70 Registers in the Configuration Memory that are reserved for security information. 5276C–RFID–3/09 ...
Page 71
... Message Authentication Code. Checksum. MDF Modify Forbidden. AR Register mode control bit. M.D. PCD Modulation Depth. MHz MegaHertz. M.I. PCD Modulation Index. Calculated from calibration coil voltages as (A – B)/(A + B). mm MilliMeter. mS MilliSecond. μS MicroSecond MSB Most Significant Bit. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C 71 ...
Page 72
... Receive Buffer size code. ATQB protocol byte returned by PICC. RCS Read Checksum. A DCR mode control bit on 88RF PICCs. RF Radio Frequency. Reserved for Future Use. Any feature or bit reserved by ISO or by Atmel. RFU rms Root Mean Square. AT88SC0808/1616/3216/6416CRF, AT88RF04C 72 5276C–RFID–3/09 ...
Page 73
... Write Checksum Timeout. A DCR mode control bit on 88RF PICCs. WG8 ISO/IEC Working Group eight. Develops standards for contactless smartcards. WLM Write Lock Mode. AR Register mode control bit on 88SC PICCs. WUPB Wake Up command, Type B. z Variable for the Index of a Password Set or Key Set. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C 73 ...
Page 74
... Atmel Application Note: Understanding the Requirements of ISO/IEC 14443 for Type B Proximity Contactless Identification Cards. Document 2056x (Available at www.atmel.com) CryptoRF Ordering Codes: CryptoRF and Secure RF Standard Product Offerings. Document 5047x (Available at www.atmel.com) AT88SC0808/1616/3216/6416CRF, AT88RF04C 74 Identification Cards – Physical Characteristics Identification Cards – Test Methods – Part 6: Proximity Cards Identification Cards – ...
Page 75
... User Memory configuration. The physical page length is equal to the maximum number of bytes that can be written with a standard write command. The Write User Zone command will not write data across page boundaries; each physical page must be written with a separate command. Figure 7. AT88RF04C Memory Map for 4 Kbit User Memory Zone $00 ― ...
Page 76
... User 1 ― $78 $00 User 2 ― $78 $00 User 3 ― $78 $00 User 4 ― $78 $00 User 5 ― $78 $00 User 6 ― $78 $00 User 7 ― $78 AT88SC0808/1616/3216/6416CRF, AT88RF04C 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes $ 5276C–RFID–3/09 ...
Page 77
... User 12 ― $78 $00 User 13 ― $78 $00 User 14 ― $78 $00 User 15 ― $78 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C $ 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes 128 Bytes ...
Page 78
... User 12 ― $F8 $00 User 13 ― $F8 $00 User 14 ― $F8 $00 User 15 ― $F8 AT88SC0808/1616/3216/6416CRF, AT88RF04C 256 Bytes 256 Bytes 256 Bytes 256 Bytes 256 Bytes 256 Bytes 256 Bytes 256 Bytes 256 Bytes 256 Bytes 256 Bytes 256 Bytes 256 Bytes ...
Page 79
... User 12 ― $1F8 $000 User 13 ― $1F8 $000 User 14 ― $1F8 $000 User 15 ― $1F8 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C $ 512 Bytes 512 Bytes 512 Bytes 512 Bytes 512 Bytes 512 Bytes 512 Bytes 512 Bytes 512 Bytes 512 Bytes ...
Page 80
... Only 27 bytes of OTP memory are available for general customer use on 88SC PICCs and 25 bytes of OTP memory are available on 88RF PICCs, all other registers have assigned functionality. The OTP memory bytes available for customer use are described in Appendix E. AT88SC0808/1616/3216/6416CRF, AT88RF04C 80 Password Sets ...
Page 81
... Figure 12. Configuration Memory map for AT88RF04C $00 RBmax AFI $08 $10 DCR $18 AR0 KR0 $20 $28 $30 $38 $40 $48 AAC $50 0 $58 AAC $60 1 $68 AAC $70 2 $78 AAC $80 3 $88 $90 $98 $A0 $A8 PAC $B0 PAC $B8 PAC $C0 $C8 $D0 $D8 $E0 PAC $E8 $F0 $F8 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C $ PUPI MTZ CMC Unique Die Serial Number ...
Page 82
... PAC $B0 PAC $B8 PAC $C0 PAC $C8 PAC $D0 PAC $D8 PAC $E0 PAC $E8 $F0 $F8 AT88SC0808/1616/3216/6416CRF, AT88RF04C PUPI MTZ Unique Die Serial Number Identification Number Nc AR1 PR1 AR2 AR5 PR5 AR6 Reserved Issuer Code Cryptogram C Session Encryption Key S Cryptogram C Session Encryption Key S Cryptogram C Session Encryption Key S ...
Page 83
... PAC $B0 PAC $B8 PAC $C0 PAC $C8 PAC $D0 PAC $D8 PAC $E0 PAC $E8 $F0 $F8 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C $ PUPI MTZ Unique Die Serial Number Identification Number Nc AR1 PR1 AR2 AR5 PR5 AR6 AR9 PR9 AR10 AR13 PR13 AR14 Issuer Code Cryptogram C Session Encryption Key S ...
Page 84
... CryptoRF is delivered with the user memory filled with $FF data and with the security features disabled. Before issuing a CryptoRF PICC to the end user personalized with initial data and the security settings. The last step in the personalization process is to program the security fuses. Figure 15. Personalization Process Flowchart AT88SC0808/1616/3216/6416CRF, AT88RF04C 84 START Select User Zone ...
Page 85
... System Zone Map for 88RF PICCs showing the OTP and Polling Response Registers $0 $1 $00 RBmax AFI $08 $10 DCR $18 $20 $28 Access Registers, Password Registers, and Reserved $30 $38 $40 $48 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C $ PUPI MTZ Unique Die Serial Number Identification Number Nc Issuer Code $ PUPI MTZ CMC Unique Die Serial Number Identification Number Nc Issuer Code ...
Page 86
... Memory. The Transport Password for each CryptoRF device is shown in Table 60. The Transport Password is the same for every device with the same base part number never changed. Table 60. CryptoRF Transport Passwords CryptoRF Part Number AT88RF04C AT88SC0808CRF AT88SC1616CRF AT88SC3216CRF AT88SC6416CRF AT88SC0808/1616/3216/6416CRF, AT88RF04C 86 Transport Password PW Index Password $07 $ $07 $ $07 $ ...
Page 87
... STATUS byte. After all three fuses are programmed, the device configuration is locked and personalization is complete. E.5. Secure Personalization The 88RF PICCs support an optional encrypted personalization mode for programming the device secrets. The Secure Personalization option is described in Appendix F. This option is not available on 88SC PICCs. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C 87 ...
Page 88
... This appendix describes the optional Secure Personalization mode for 88RF PICCs. This mode allows the device secrets to be written with data encryption, so that eavesdropping on the personalization process cannot compromise the device secrets. Figure 18. Secure Personalization Process Flowchart AT88SC0808/1616/3216/6416CRF, AT88RF04C 88 START Personalize User Zones ...
Page 89
... Communication Security mode has been activated (with any key set). The contents of these "secrets" registers is encrypted when reading or writing. Use of the Write System Zone with Integrated MAC command is mandatory when writing the "secrets" registers (see Section 6.10). 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Transport Password PW Index Password ...
Page 90
... Personalization mode and disables the Write System Zone with Integrated MAC command. The Configuration Memory Access requirements for all four of the Security Fuse states is described in Appendix G. Note that it is not necessary to initialize the Session Encryption Key registers since any data contained in these registers will be overwritten by the first Authentication Activation attempt. AT88SC0808/1616/3216/6416CRF, AT88RF04C ...
Page 91
... Configuration Memory map. The next column indicates if that row applies to Read System Zone commands or Write System Zone commands. The four columns to the right show the security fuse states. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C ...
Page 92
... Transport Password is validated using the Check Password command, then access is granted. The text “Write PW” indicates that if the Write Password of a password set is validated using the Check Password command, then access is granted to the PAC registers and password registers for that password set only. AT88SC0808/1616/3216/6416CRF, AT88RF04C 92 SEC = 0b ...
Page 93
... Unique Die Serial Number Access Control (Except Nc, DCR) Nc and DCR Cryptography (Except Encryption Keys S) Encryption Keys (S) Secret Passwords Password Attempt Counters (PAC) Forbidden 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C SEC = 0b Operation ENC = 1b SKY = 1b PER = 1b Read Open Write Transport PW Read Open Write Read Open ...
Page 94
... The three Communication Security Mode control bits: AM0, AM1, and ER control the communication security requirements for the User Zone as shown in Table 65. By default authentication and encryption communication security are disabled. See Appendix J for information on the Authentication Communication Security modes. Encryption Mode selection bit. ER: AT88SC0808/1616/3216/6416CRF, AT88RF04C 94 Bit 4 Bit 3 Bit 2 ...
Page 95
... By default the Program Only mode is disabled. If PGO = 0b then data within the User Zone may be changed from 1b to 0b, but never from 0b to 1b. Note that when PGO is enabled, Write User Zone commands are restricted to a length of one byte. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Communication Security Mode Reserved For Future Use (Not Supported) Dual Access Authentication Mode ...
Page 96
... Coding of the Password Mode bits of the Access Register. PM1 PM0 Communication Security Mode control. M: The Access Register M bits determine the Communication Security mode requirements for the User Zone. By default M = 111b and no Authentication or Encryption Activation is required to access the user memory. AT88SC0808/1616/3216/6416CRF, AT88RF04C 96 Bit 4 Bit 3 Bit 2 Bit MDF RFU Bit 4 ...
Page 97
... AT88SC0808/1616/3216/6416CRF, AT88RF04C Communication Security Mode Reserved For Future Use (Not Supported) Reserved For Future Use (Not Supported) Authentication for Read / Encryption for Write Authentication for Read / Write Encryption for Write Authentication for Write Encryption for Read / Write No Authentication or Encryption Required ...
Page 98
... Primary Key Set selection bits. PK: The Primary Key Set selection bits control the key set assigned to a User Zone for communication security. The Access Register M bits determine the Communication Security mode associated with the PK bits. AT88SC0808/1616/3216/6416CRF, AT88RF04C 98 Authentication Key Secret Seed G ...
Page 99
... Coding of the Password Set select bits on 88RF PICCs. PW2 PW1 All Other Values Are Not Supported 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Authentication Key Encryption Key Secret Seed G Session Key S 0 Secret Seed G Session Key S 1 Secret Seed G Session Key S 2 Secret Seed G ...
Page 100
... By default the WCS is enabled. In authentication and encryption communication security modes the correct checksum must be provided within the write operation is aborted. Setting WCS = 1b disables the timeout function. Read Checksum control. [88RF] RCS: By default the RCS is enabled, which allows one Read Checksum operation without resetting the cryptographic engine. AT88SC0808/1616/3216/6416CRF, AT88RF04C 100 Bit 4 Bit 3 Bit 2 ...
Page 101
... No changes to the Configuration Memory are permitted unless the Transport Password has been verified using the Check Password command. Table 75. CryptoRF Family Password Characteristics and Transport Passwords CryptoRF Part Number AT88RF04C AT88SC0808CRF AT88SC1616CRF AT88SC3216CRF AT88SC6416CRF 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C User Data Clear Clear Encryption Password Sets Set Number 4 Sets 0,1,2,7 8 Sets 0,1,2,3,4,5,6,7 8 Sets ...
Page 102
... All Other Values Are Not Supported Table 77. Password Attempt Counter Coding for the Extended Trials Allowed DCR Configuration of 88SC PICCs. PAC Register $FF $FE $FC $F8 $F0 $E0 $C0 $80 $00 All Other Values Are Not Supported AT88SC0808/1616/3216/6416CRF, AT88RF04C 102 $ Write z PAC PW1 PW2 PW3 PAC Description No Failed Attempts ...
Page 103
... Table 79 shows the available password security options. The default setting of PM=11b disables password security. The remaining two options enable password security for either writes only, or for both reads and writes. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Description No Failed Attempts 1 Failed Attempt 2 Failed Attempts ...
Page 104
... If a Check Password command fails, then the PICC returns a NACK and a non-zero Status byte in the response. This Status byte reports the reason for failure of the operation. See the Check Password Command [$cC], Section 6.19 of this specification for a description of the Status codes. AT88SC0808/1616/3216/6416CRF, AT88RF04C 104 Reader ...
Page 105
... Supervisor Password will fail. Supervisor Mode changes the Configuration Memory access requirements for the Password section of the memory only. Enabling Supervisor Mode does not change the access requirements for any other configuration registers. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Bit 4 Bit 3 Bit 2 ...
Page 106
... Table 82 shows the three 88SC PICC Authentication Communication Security options, plus the default setting. By default M = 111b and no Authentication or Encryption Activation is required to access the user memory. AT88SC0808/1616/3216/6416CRF, AT88RF04C 106 User Data Clear Clear Encryption Communication Security Mode Dual Access Authentication Mode Authentication for Read / Write ...
Page 107
... If the PK and ROK bits of the Key Register select the same Key Set, then the Read-Only function is effectively disabled. Authenticating 88RF PICCs with the PK key results in behavior identical to 88SC devices. The Read-Only function is not supported by 88SC devices. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Communication Security Mode Authentication for Read / Encryption for Write Authentication for Read / Write ...
Page 108
... Access Register bits determine the Communication Security mode associated with the POK bits. The POK bits are only used in Dual Access Authentication mode. Table 85. Coding of the Program-Only Key Set select bits for CryptoRF communication security. POK1 POK0 AT88SC0808/1616/3216/6416CRF, AT88RF04C 108 Bit 4 Bit 3 Bit 2 Bit 1 POK0 PW2 PW1 RFU ...
Page 109
... Access Register M bits determine the Communication Security mode associated with the ROK bits. For some Communication Security modes the ROK register bits are not used. Table 87. Coding of the Read-Only Key Set select bits. ROK1 ROK2 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Bit 4 Bit 3 Bit 2 Bit 1 ROK2 PW2 PW1 RFU Authentication Key Encryption Key ...
Page 110
... The Secret Seeds cannot be modified after the Security Fuses are programmed during personalization. The AAC registers cannot be re-written after the Security Fuses are programmed either. This is true even if the SME option in the DCR register is enabled. AT88SC0808/1616/3216/6416CRF, AT88RF04C 110 register. The Authentication Attempt Counter for Secret Seed G ...
Page 111
... Authentication Attempt Counter Coding for the Extended Trials Allowed Configuration of 88SC PICCs. AAC Register $FF $FE $FC $F8 $F0 $E0 $C0 $80 $00 All Other Values Are Not Supported 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Description No Failed Attempts 1 Failed Attempt 2 Failed Attempts 3 Failed Attempts 4 Failed Attempts (LOCK) Description No Failed Attempts 1 Failed Attempt 2 Failed Attempts 3 Failed Attempts 4 Failed Attempts ...
Page 112
... PICC) each time the Mutual Authentication procedure succeeds. If the Host receives a NACK response from the PICC, then the Mutual Authentication procedure can be retried starting with step 2. Figure 35 shows the Mutual Authentication procedure as a flowchart. AT88SC0808/1616/3216/6416CRF, AT88RF04C 112 Description No Failed Attempts 1 Failed Attempt ...
Page 113
... Card Key Set Number Alternate Flow (if new "C" already stored) END (FAILURE) YES Do you want to retry ? NO Card Authentication Failed 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C START Authentication Read Card Read System Zone Command Store ID ID (Nc field or other ID) Return Data Read Read System Zone Command ...
Page 114
... If the PICC receives a Send Checksum command containing an incorrect checksum, the PICC resets the cryptographic engine, returns to Normal Communication mode, and returns a NACK response to the host. The AAC incremented by the PICC when a bad checksum is received, so there is no penalty for using Send Checksum to exit Authentication mode. AT88SC0808/1616/3216/6416CRF, AT88RF04C 114 Key Secret Seed G ...
Page 115
... When M = 110b Encryption is required for Read or Write access to the User Zone. If Encryption Activation is performed with the key identified in the AK bits of the Password Register, then Read/Write access is granted to the User Zone. A checksum is required for write operations. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C User Data Clear Clear ...
Page 116
... If the PK and ROK bits of the Key Register select the same Key Set, then the Read-Only function is effectively disabled. Encryption Activation of 88RF PICCs with the PK key results in behavior identical to 88SC devices. The Read-Only function is not supported by 88SC devices. AT88SC0808/1616/3216/6416CRF, AT88RF04C 116 Communication Security Mode ...
Page 117
... Access Register bits determine the Communication Security mode associated with the POK bits. The POK bits are only used in Dual Access Authentication mode. Table 96. Coding of the Program-Only Key Set select bits for CryptoRF communication security. POK1 POK0 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Bit 4 Bit 3 Bit 2 Bit 1 POK0 PW2 PW1 RFU Authentication Key Encryption Key ...
Page 118
... Access Register M bits determine the Communication Security mode associated with the ROK bits. For some Communication Security modes the ROK register bits are not used. Table 98. Coding of the Read-Only Key Set select bits for CryptoRF communication security. ROK1 ROK2 AT88SC0808/1616/3216/6416CRF, AT88RF04C 118 Bit 4 Bit 3 Bit 2 Bit 1 ROK2 PW2 PW1 RFU ...
Page 119
... Security Fuses are programmed either. This is true even if the SME option in the DCR register is enabled. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C register. The Authentication Attempt Counter for Secret Seed G i register is used during Authentication Activation and Encryption ...
Page 120
... Authentication Attempt Counter Coding for the Extended Trials Allowed DCR Configuration on 88SC PICCs. AAC Register $FF $FE $FC $F8 $F0 $E0 $C0 $80 $00 All Other Values Are Not Supported AT88SC0808/1616/3216/6416CRF, AT88RF04C 120 Description No Failed Attempts 1 Failed Attempt 2 Failed Attempts 3 Failed Attempts 4 Failed Attempts (LOCK) Description No Failed Attempts 1 Failed Attempt 2 Failed Attempts 3 Failed Attempts ...
Page 121
... All Other Values Are Not Supported 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Description No Failed Attempts 1 Failed Attempt 2 Failed Attempts 3 Failed Attempts 4 Failed Attempts 5 Failed Attempts 6 Failed Attempts 7 Failed Attempts 8 Failed Attempts 9 Failed Attempts 10 Failed Attempts 11 Failed Attempts ...
Page 122
... PICC) each time the Mutual Authentication procedure succeeds. If the Host receives a NACK response from the PICC, then the Mutual Authentication procedure can be retried starting with step 2. Figure 35 shows the Authentication Activation procedure as a flowchart. Figure 39 shows the Encryption Activation procedure as a flowchart. AT88SC0808/1616/3216/6416CRF, AT88RF04C 122 , and C registers i ...
Page 123
... Encryption Activation Procedure Host System Operations i = Card Key Set Number (Same i as used for Authentication) Goto START Authentication YES Do you want to retry ? NO Encryption Activation Failed 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C START Encryption Activation Session Key S A Cryptogram A C Calculate Generate E Challenge Ch , Random ...
Page 124
... If the PICC receives a Send Checksum command containing an incorrect checksum, the PICC resets the cryptographic engine, returns to Normal Communication mode, and returns a NACK response to the host. The AAC incremented by the PICC when a bad checksum is received, so there is no penalty for using Send Checksum to exit Authentication or Encryption mode. AT88SC0808/1616/3216/6416CRF, AT88RF04C 124 Key Secret Seed G0 ...
Page 125
... Anti-Tearing flag is set; when the PICC is next powered up, the anti-tearing write will be completed as part of the POR process. If power is interrupted during step the Anti-Tearing Flag will be set and the write will be completed on the next POR. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C 125 ...
Page 126
... Figure 40. CryptoRF Anti-Tearing Write Process AT88SC0808/1616/3216/6416CRF, AT88RF04C 126 START Receive Anti-Tearing Write Command Transmit PICC NO NACK Power OK Response ? YES END Write to Anti-Tearing Buffer Write Anti-Tearing Flag Write Data to Final EEPROM Location Clear Anti-Tearing Flag Transmit ACK Response END STEP 1 STEP 2 STEP ...
Page 127
... When large amounts of data are written, the increase in transaction time is significant. Writing the entire 128 byte User Zone on AT88RF04C takes 155 milliseconds with anti-tearing, but only 47 milliseconds without anti-tearing. Writing the entire 256 byte User Zone on AT88SC3216CRF takes 292 milliseconds with anti-tearing, but only 54 milliseconds without anti-tearing ...
Page 128
... Table 106. PARAM byte options for the Write System Zone command for 88SC PICCs. Command Write System Zone Write System Zone w A/T Write Fuse Byte AT88SC0808/1616/3216/6416CRF, AT88RF04C 128 Min Typical 100,000 50,000 Bit 4 ...
Page 129
... The REQB/WUPB polling command and response are shown in Figure 44 with color-coding which matches Figure 42 and Figure 43. Nine bytes of the ATQB response are customer programmable on CryptoRF. In addition, the AFI code used for selection of cards for a particular application during anticollision is also customer configured. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C $ ...
Page 130
... ISO/IEC 14443 Part 3 places on the register values. Pseudo Unique PICC Identifier (PUPI) PUPI bit serial number defined by the customer during personalization; the PUPI is usually unique. This code is transmitted as part of the ATQB response during anticollision. PUPI may be set to any value. AT88SC0808/1616/3216/6416CRF, AT88RF04C 130 Reader PICC ...
Page 131
... The PCD will store the lower 4 bits of ATQB protocol byte register and echo it back to a selected PICC in the lower 4 bits of ATTRIB parameter byte 3. CryptoRF will not accept an ATTRIB command with a non-zero value in parameter byte 3. Note that intelligent PCDs will reject invalid ATQB responses and will not send invalid ATTRIB commands. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Density Code $22 $33 $44 ...
Page 132
... Table 110. Application Family Codes as defined in ISO/IEC 14443 Part 3. AFI High Bits AFI Low Bits $ – “Y” Note: AT88SC0808/1616/3216/6416CRF, AT88RF04C 132 RBmax Code $10 $10 $10 $30 $30 Application Family “Y” Proprietary “Y” Transport “Y” Financial “Y” Identification “Y” ...
Page 133
... PICC. Intelligent RF readers will reconfigure themselves based on the contents of the protocol bytes in ATQB and may malfunction if invalid values are returned by the card. For this reason, the values of the CryptoRF anticollision registers must be carefully selected using the guidelines in this appendix. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C REQB/WUPB Polling produces a PICC response from: $0 ...
Page 134
... The anticollision process continues in this manner until all PICCs in the field have completed their transactions. Any command received by the PICC with a CRC error is ignored. ISO/IEC 14443 Part 3 describes two anticollision options for Type B PICCs; the Timeslot option has been Note: implemented in the CryptoRF family. AT88SC0808/1616/3216/6416CRF, AT88RF04C 134 5276C–RFID–3/09 ...
Page 135
... Figure 45. Anticollision and State Transition Flow Chart Wait for WUPB 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Power On Reset Process Anti-Tearing Registers Wait for REQB or WUPB AFI Match ? NO YES YES YES Send ATQB Response Matched Slot Marker Wait for ATTRIB or HLTB with PUPI match ...
Page 136
... Despite the fact that data transmissions occur LSB first, all of the commands, data, and CRC bytes in ISO/IEC 14443 and in this specification are listed in the conventional manner, with MSB on the left and LSB on the right. AT88SC0808/1616/3216/6416CRF, AT88RF04C 136 One Byte Transmission is 10 ETUs long plus EGT ...
Page 137
... A frame transmitted by the reader consists of SOF, several bytes of data byte CRC_B, and the EOF. Figure 48. Format of a frame transmitted by the reader to the card. No Modulation ("1"s ) 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C ETUs of “0”s Total Start of Frame Length ETUs Total Start of Frame Length ETUs Last Byte C o ...
Page 138
... Appendix Q of this specification. See Appendix P for signal timing specifications. The PCD is not permitted to modulate the RF field while waiting for a PICC to respond to a command. Modulation of the RF field during a memory read or write operation may corrupt the operation or cause reset of the PICC. AT88SC0808/1616/3216/6416CRF, AT88RF04C 138 Transmit Data and CRC_B ...
Page 139
... In a typical multi-protocol application the reader will poll for Type B cards and complete all transactions with any Type B cards present in the field. The reader will then poll for Type A cards and complete all transactions with them. The reader alternates between the two types of modulation and protocols. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C K data bytes CRC1 CRC2 ...
Page 140
... The RF Interface characteristics of the CryptoRF family are listed in Table 112. Compliance with these specifications has been verified by characterization of PICCs with ID-1 size antennas, but these items are not antenna size dependent. The parameters in Table 112 are guaranteed by design. Appendix O contains illustrations of the RF interface timing parameters. AT88SC0808/1616/3216/6416CRF, AT88RF04C 140 Parameter Min 847 ...
Page 141
... ISO/IEC 10373-6 section 7.1. This apparatus uses sense coils to detect the signal generated by a PICC transmitting a message to the PCD. The sense coils are optimized to detect a signal generated by an ID-1 PICC. The ISO/IEC 14443 Load Modulation Amplitude requirements apply to this test apparatus only. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Parameter 13.553 Parameter ...
Page 142
... PICC and may cause it to reset. Figure 52. Measurement of the PCD Amplitude Modulation Index Modulation Index = Modulation Depth = AT88SC0808/1616/3216/6416CRF, AT88RF04C 142 2 PICC Antenna. 3000/6000 = 0.5 The minimum Operating Magnetic Field 2 PICC Antenna. 3000/1000 = 3.0 The minimum Operating Magnetic Field ...
Page 143
... The ISO/IEC 14443 standards do not guarantee that any compliant PCD will operate with any compliant PICC. A reliable RFID system uses PICCs and PCDs matched to the application, with appropriately sized antennas. Discussion of the numerous factors impacting the performance of RFID systems is beyond the scope of this document. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C 143 ...
Page 144
... Send Checksum Send Checksum Authentication Mode Send Checksum Encryption Mode Get Checksum Read Fuse Byte Write Fuse Byte Check Password 1. Nominal values at 25° C. Values are based on characterization and are not tested. Note: AT88SC0808/1616/3216/6416CRF, AT88RF04C 144 (1) Typical TR0 Maximum TR0 (microseconds) (microseconds ...
Page 145
... Send Checksum Authentication Mode Send Checksum Encryption Mode Get Checksum Read Fuse Byte Write Fuse Byte Check Password 1. Nominal values at 25° C. Values are based on characterization and are not tested. Note: 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Typical TR0 (microseconds) (1) Maximum TR0 (microseconds ...
Page 146
... Verify Crypto Send Checksum Send Checksum Authentication Mode Send Checksum Encryption Mode Get Checksum Check Password 1. Nominal values at 25° C. Values are based on characterization and are not tested. Note: AT88SC0808/1616/3216/6416CRF, AT88RF04C 146 (1) Typical Transaction Time Maximum Transaction Time (milliseconds) 2.4 2.3 2.0 1 ...
Page 147
... Send Checksum Authentication Mode Send Checksum Encryption Mode Get Checksum Check Password 1. Nominal values at 25° C. Values are based on characterization and are not tested. Note: 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Typical Transaction Time (milliseconds) (1) Maximum Transaction Time (milliseconds) 2.4 2.8 2.3 2 ...
Page 148
... Access Register security mode bits for the current User Zone require that Encryption Communication mode or Authentication Communication mode be active to write the User Zone. If Authentication or Encryption is not required, then 88SC PICCs do not always require that a valid checksum be supplied to perform a write.] AT88SC0808/1616/3216/6416CRF, AT88RF04C 148 5276C–RFID–3/09 ...
Page 149
... PICCs have 25 bytes of OTP memory available for customer use in the Configuration Memory; 88SC PICCs have 27 bytes of OTP memory available for customer use. In 88RF PICCs bytes $0E and $0F are the read-only Hardware Revision Register (HWR); in 88SC PICCs these bytes are available for customer use. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C 149 ...
Page 150
... Appendix S. Ordering Information CryptoRF with 4K bits of User Memory configured as 4 Zones of 128 Bytes each Ordering Code AT88RF04C-MR1G AT88RF04C-MX1G AT88RF04C-MY1G AT88RF04C-WA1 CryptoRF with 8K bits of User Memory configured as 8 Zones of 128 Bytes each Ordering Code AT88SC0808CRF-MR1 AT88SC0808CRF-MX1 AT88SC0808CRF-MY1 AT88SC0808CRF-WA1 CryptoRF with 16K bits of User Memory configured as 16 Zones of 128 Bytes each ...
Page 151
... Lead-free, halogen-free package. Exceeds RoHS requirements. Note: The ordering codes for CryptoRF in standard packages are listed here. For additional ordering information see CryptoRF and Secure RF Standard Product Offerings at 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C Package R Module MX1 RFID Tag Square MY1 RFID Tag Round ...
Page 152
... S.2. Mechanical Mechanical Drawing of Module R Package (XOA2 Style) Ordering Code: AT88RFxxC-MR1G and AT88SCxxxxCRF-MR1 Dimension: Glob Top: Thickness: Pitch: AT88SC0808/1616/3216/6416CRF, AT88RF04C 152 5.06 x 8.00 [mm] Square – 4.8 x 5.1 [mm] 0.38 [mm] 9.5 [mm] 5276C–RFID–3/09 ...
Page 153
... Mechanical Drawing of MX1 Epoxy Glass RFID Tag Ordering Code: AT88RFxxC-MX1G and AT88SCxxxxCRF-MX1 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C 153 ...
Page 154
... Mechanical Drawing of MY1 Epoxy Glass RFID Tag Ordering Code: AT88RFxxC-MY1G and AT88SCxxxxCRF-MY1 AT88SC0808/1616/3216/6416CRF, AT88RF04C 154 5276C–RFID–3/09 ...
Page 155
... The write operation fails and no data is written. The Write System Zone command returns Status Code $00 and NACK when PARAM = $0C and an invalid ADDR is sent. A Status Code $A2 is expected. The operation fails and no data is written. 5276C–RFID–3/09 AT88SC0808/1616/3216/6416CRF, AT88RF04C $11 $12 $13 ...
Page 156
... PICCs if the Encryption Communication Security mode is used. When the host calculates the Authentication Activation Challenge at step 8 in the procedure in section K.8, a value of $FF must be substituted in the calculation (in place of the actual 88RF PICC AAC value of $55). This change is intentional. AT88SC0808/1616/3216/6416CRF, AT88RF04C 156 5276C–RFID–3/09 ...
Page 157
... AT88SC0808/1616/3216/6416CRF, AT88RF04C Date Initial document release Add all CryptoRF Security Function Specifications. This Specification now requires an LLA license. REMOVED LLA AUGUST 2009 Delete AT88SC0104CRF, AT88SC0204CRF, AT88SC0404CRF Specifications. Add AT88RF04C Specifications. Comments 157 ...
Page 158
... OF THE POSSIBILITY OF SUCH DAMAGES. Atmel makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Atmel does not make any commitment to update the information contained herein. Unless specifically provided otherwise, Atmel products are not suitable for, and shall not be used in, automotive applications. Atmel’ ...