#Mifare Plus SL3 Template

#Description

Use the Mifare Plus SL3 Template to read data from a NXP Mifare Plus PICC (Mifare Plus 2K, Mifare Plus 4K) running in Security Level 3.

The reader may either

• Read arbitrary data; the data will be transmitted in hexadecimal format. To do so, select the RAW mode in TOF register.

• Read a number (decimal output). To do so, select the decimal mode in TOF register.

• Read a string (ASCII-encoded data). To do so, select either the Short String or the Long String mode in TOF register.

The target data is pointed to by either:

• A sector AID in the MAD (Mifare Access Directory) of the card,

• An absolute block address.

The AID or the block address is specified in the LOC register.

#Registers

This Template uses 6 configuration registers:

Alias	Offset	Name	Description
LKL	0	Lookup List	Set to 63 to use this Template
LOC	3	Location of Data	See details below
AUT	5	Authentication	See details below
TOF	1	Output Size and Format	See details below
OPT	4	Options	Template-specific Options
PFX	2	Prefix	Template-specific Prefix

#LOC - Location of Data

Offset : 3

Size : 5

Remark : Reading can cross sector boundaries, but sector trailers are always discarded.

#Bytes 0-1 : AID

AID of the sector (MSB-first).

Remark : Set to 0000 to specify an absolute address in the next byte.

#Byte 2 : Address

This is the Address of the 1st block to read.

Valid range depends on the memory size of the PICC (1K->64 blocks, 4K->256 blocks).

Remark : Set to 00 to specify an AID in the previous bytes.

#Byte 3 : Shift Bytes

Leading bytes to suppress; valid range is 0 to 48 (in decimal).

#Byte 4 : Shift Bits

Leading bits to suppress; valid range is 0 to 7.

#AUT - Authentication

Offset : 5

Size : 17

#Byte 0 : Settings

Bit	Role	Values
7	Type of Key	0 : Key A 1 : Key B
6-5	Location of Secret Key	0 : Key is provided in the Template 1 : Internal SAM AV 3 : SAM AV in 1st slot
4-3	RFU
2-0	Read mode	0 : Read encrypted, MAC on command, no MAC on response 1 : Read encrypted, MAC on command, MAC on response 2 : Read in plain, MAC on command, no MAC on response 3 : Read in plain, MAC on command, MAC on response 4 : Read encrypted, no MAC on command, no MAC on response 5 : Read encrypted, no MAC on command, MAC on response 6 : Read in plain, no MAC on command, no MAC on response 7 : Read in plain, no MAC on command, MAC on response

#Byte 1 : Key slot in the SAM AV

Condition : When one of the two “SAM specified” options is selected in Byte 0, Byte 1 specifies the Key slot. Other bytes (if present) are ignored.

#Bytes 1-16 : Value of the AES Secret Key

Condition : When “Key is provided in the Template” is selected in byte 0, Bytes 1-16 store the actual Key.

#TOF - Output Size and Format

Offset : 1

Size : 2

#Byte 0 : RAW Mode

Condition : When RAW Mode is selected (Bit 6 in Byte 0 is 0)

Bit	Role	Values
7	Invert Data?	0 : Transmit the sequence of bytes as is 1 : Transmit the sequence of bytes in reverse order
6	Mode	0 : RAW Mode (Data is a numerical value) 1 : String Mode (Data is an ASCII string)
5	Padding if Data is shorted than specified length	0 : Padd with 0 on the left 1 : Padd with F on the right
4	Remove leading zeroes?	0 : Keep all digits 1 : Suppress 0 digits on the left of the Data
3-0	Length and Format	0 : Decimal, 10 digits (truncation on 4-B) 1 : Raw (hex), 4 bytes (32 bits) 2 : Raw (hex), 8 bytes (64 bits) 3 : Raw (hex), 5 bytes (40 bits) 4 : Raw (hex), 10 bytes (80 bits) 5 : Raw (hex), 7 bytes (56 bits) 6 : Raw (hex), 11 bytes (88 bits) 7 : RFU 8 : Raw (hex), 16 bytes (128 bits) 9 : Raw (hex), 20 bytes (160 bits) 10 : Raw (hex), 24 bytes (196 bits) 11 : Raw (hex), 32 bytes (256 bits) 12 : Decimal, 12 digits (truncation on 5-B) 13 : Decimal, 13 digits (truncation on 5-B) 14 : Decimal, variable length 15 : Raw (hex), variable length

#Byte 0 : String Mode

Condition : When String Mode is selected (Bit 6 in Byte 0 is 1)

Bit	Role	Values
7	Invert Data?	0 : Transmit the sequence of characters as is 1 : Transmit the sequence of characters in reverse order
6	Mode	0 : RAW Mode (Data is a numerical value) 1 : String Mode (Data is an ASCII string)
5	Padding if Data is shorted than specified length	0 : Variable length (no padding) 1 : Padd with (space characters) on the right until the specified length
4	Short string or Long string?	0 : Short string (truncate to 16 characters or less) 1 : Long string (more than 16 characters)
3-0	Length	0 : 16 characters 1 : 1 character 2 : 2 characters 3 : 3 characters 4 : 4 characters 5 : 5 characters 6 : 6 characters 7 : 7 characters 8 : 8 characters 9 : 9 characters 10 : 10 characters 11 : 11 characters 12 : 12 characters 13 : 13 characters 14 : 14 characters 15 : 15 characters

#Byte 1 : Options for Long String

Condition : When Long String Mode is selected (Bit 6 in Byte 0 is 1 and Bit 4 is 1)

Use this byte to specify the exact length to read from the card. Valid range is 1 to 255.

#OPT - Options

Offset : 4

Size : 1

If this register is set, the Reader adds a token to its output to tell the receiver what kind of credential has been read.

Bit	Role	Values
7-4	RFU
3-2	Position of the Card Type Token	0 : Before the Prefix 1 : After the Prefix, before the Data 2 : After the Data (before the Suffix) 3 : RFU
1-0	Add a Card Type Token to the output stream?	0 : Do not add a Card Type Token 1 : Add Card Type Token in hex (63) 2 : Add Card Type Token as char (M) 3 : RFU

#PFX - Prefix

Offset : 2

Size : 8

A Template-specific Prefix, that is added after the Reader’s global Prefix.

Remark : Use \t for a Tab, \n for Enter, \b for Back space, \v for Vertical space.