Identification of Random ID

[janulo]

Hi, is it possible to clearly distinguish a card with random ID (RID) from fixed UID card? According to AN10927, RID is identified by UID0 = 0x08, as well as RID is always 4bytes long. Mifare Plus SL3 cards we have, provides 4-bytes RID starting with 0x08 - that's correct. Problem is, that DESFire cards with enabled RID returns 4-byte RID starting with 0x80. So my question is - is it enough to identify RID as ID fulfilling following condition:

• 4-bytes long ID, first byte 0x08 OR
• 4-bytes long ID, first byte 0x80

or there are other possible first byte values for RID?

Is it possible to have 7-bytes long RID?

I understand that using card's UID is very insecure and we encourage our users to use encrypted data instead (classic sectors or desfire files), but some of them still have to use UID because of old infrastructure. In such case, we would like to distinguish between RID and UID, so we can block RID cards as there is no reason to accept it unless the reader is set to read smart data.

We would like also to prevent case when user ads RID card to access system by reading that card, but that card will be not working, as the RID will be different next time.

Thank you for any comments!

Jan

[dharmikm91]

@janulo , I know this was a few years ago, but do you remember if you were able to get anywhere with this? I came accross the same issue. I have DESFire EV1 cards whose RID starts with 0x80. But the document suggests using 0x08. So we are expecting it to be 0x08. Is there a way to get the RID start from 0x08 on EV1 cards?

Or is my only option to use EV2 cards?

[Kan_Li]

For random id，it always follow UID0=0x08. Please refer to AN10927 for details.

Have a great day,
Kan

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[janulo]

Dear Kan,

I see that this answer is assumed as answered, but I don't think this answer is answered completely. Could you please take a look on specific case when Mifare Desfire with random id returns id starting with 0x80? Thank you in advance.

Kind regards

Jan

[Kan_Li · Accepted solution]

Hi Jan,

Sorry for the late reply! I just was told for Mifare Desfire EV1 with random id enabled UID0 is 0x80, while for EV2 UID0 is still 0x08. so I suspected that cards on your hand are Mifare Desfire EV1.

Hope that makes sense,

Have a great day,
Kan

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[janulo]

Hi Kan,

thanks for your response.

Are there any other UID0 values identifying random ID (besides 0x08 and 0x80)?

Btw, yes, my card is DESFire ev1.

Jan

[Kan_Li]

No other UID0 values identifies random ID.

Have a great day,
Kan

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[janulo]

Hi Kan,

thank you for your response.

I understand AN10927 and definition of random id starting with UID0=0x08. Problem is, that DESFire random ID cards returns ID starting with UID0=0x80 - this is with collision with AN10927 section 2.1.1. If I will follow AN10927, I will detect DESFire radnom ID cards improperly. 

According to AN10927, table 1, row 2 (x0 .. x7), ID0=0x80 may belong to "Proprietary use (e.g. used for MIFARE products)". Is there any additional info about this?

Regards

Jan