Password Authentication - Ntag213 + PN512

fernandohcoelho — Thu, 01 Dec 2016 20:24:50 GMT

Hi everyone,

I'm having trouble to remove a password applied to a NTAG213. I set a password to a tag and I can't authenticate to write in tag again. Also, I can't remove the tag password either. Can someone help me?

Here are my code:

...

// already connect to tag

//Changing password in NTAG213 - sector 2B

uCla = 0xFF;
uIns = 0xD6; //write command used by my reader
uP1 = 0x00;
uP2 = 0x2B; //memory block to write
Data[0] = 0x40; //PWD data -- @ A B C
Data[1] = 0x41;
Data[2] = 0x42;
Data[3] = 0x43;
uLe = 0x04; //Return lenght expected
uLc = 0x04; //Data size

response = piccClass.sendCommand(iCaseType, uCla, uIns, uP1, uP2, uLc, uLe, Data); //Everything looks fine

//Activate (AUTH0)
uCla = 0xFF;
uIns = 0xD6; // write command used by my reader
uP1 = 0x00;
uP2 = 0x29; //memory block to write
Data[0] = 0x04; //Data filled with NTAG213 specs - Strong encript + protect block 04h and foward
Data[1] = 0x00;
Data[2] = 0x00;
Data[3] = 0x04;
uLe = 0x04;
uLc = 0x04;

response = piccClass.sendCommand(iCaseType, uCla, uIns, uP1, uP2, uLc, uLe, Data); //Everything looks fine

-- From now on, the tag is protected. With the NXP Writer APP I can unlock it with no problems. I didn't changed the PACK number, because this seems to lock the authentication.

Next step, I'll try to authenticate (AUTH_PWD) and write the sector 09h of the tag.

// already connect to tag

//Authenticate the tag

uCla = 0xFF;
uIns = 0x00;
uP1 = 0x00;
uP2 = 0x00;
uLc = 0x05;
uLe = 0xFF;
Data[0] = 0x1B; //PWD_AUTH command in NTAG213 specs
Data[1] = 0x40; //PWD data - @ A B C
Data[2] = 0x41;
Data[3] = 0x42;
Data[4] = 0x43;

response = piccClass.sendCommand(iCaseType, uCla, uIns, uP1, uP2, uLc, uLe, Data); //Received response 00 00 90 00 - PACK (00 00) and ACK (90 00)

-- As said in NTAG21x docs, after an authentication I can send a write command to the tag and it will accept it. So I tried to write a memory sector:

//write NXP tag

uCla = 0xFF;
uIns = 0xD6; // write command used by my reader
uP1 = 0x00;
uP2 = 0x09; //memory block to write
Data[0] = 0x70; //random hex numbers
Data[1] = 0x71;
Data[2] = 0x72;
Data[3] = 0x73;
uLe = 0x04; //Return lenght expected
uLc = 0x04; //Data size

response = piccClass.sendCommand(iCaseType, uCla, uIns, uP1, uP2, uLc, uLe, Data); //Return 99 00 - unknown error

-- I tried a lot of other commands, but with no luck. It seems I need to use PACK somewhere, but I don't know where.

I tried the NTAG213 spec commands of Write, It returns 90 00 but no data is written.

Thank for the help!!!

Fernando Coelho

Re: Password Authentication - Ntag213 + PN512

Jorge_Gonzalez — Thu, 15 Dec 2016 01:01:24 GMT

Hello Fernando H Cohelo,

I am not familiar with the reader code you use, but from NTAG213 perspective the commands seem correct. PACK is not required for subsequent commands after authentication.

Please also check that the sector 9 is not locked (read-only) by the static-lock bytes, otherwise it cannot be written.

Regards!

Jorge Gonzalez

topic Password Authentication - Ntag213 + PN512 in NFC

Password Authentication - Ntag213 + PN512

Re: Password Authentication - Ntag213 + PN512