Using external SAM (card) on POS SAM slot to authenticate/read DESFire EV2/EV3 with TapLinx v4.1.0

[musabeni]

Dear NXP TapLinx Support Team,

I am integrating TapLinx (v4.1.0) on an Android POS device and require guidance on the recommended approach to securely read/write data from MIFARE DESFire EV2/EV3 cards when using an external SAM (Secure Access Module) installed in the POS SAM slot.

Environment & hardware

• TapLinx SDK: v4.1.0

• POS device: Android POS (model available on request), Android 13

• NFC: working (TapLinx can detect card type on this POS via IsoDep/Android NFC)

• Card: MIFARE DESFire EV2 / EV3

• SAM: external SAM card/module available and the POS has a SAM slot; the POS vendor SDK exposes APIs to open the SAM channel and send/receive APDUs (e.g., exchangeApdu(...))

What we want to achieve
We want to use the external SAM (inserted in the POS SAM slot) to perform secure authentication for DESFire cards (so keys are never exposed in the application), and then use TapLinx to perform DESFire read/write operations once the card session is authenticated.

Questions / Request

1. Does TapLinx v4.1.0 provide any official or recommended integration pattern for using an external SAM (inserted into a POS SAM slot) to perform DESFire authentication while TapLinx handles DESFire protocol and file operations?

2. If such integration is supported or recommended, could you please provide:

   • Example code (or pseudo-code) demonstrating the SAM ↔ TapLinx relay flow for EV2/EV3 (AES preferred). Specifically:

     • How to call the TapLinx method that initiates the card challenge (e.g., authenticateEV2First or equivalent), capture the challenge data, send it to the SAM via APDU, and pass the SAM’s response back to TapLinx (e.g., authenticateEV2Next).

     • Any helper classes or methods in TapLinx that simplify bridging a SAM (for example, recommended APDU framing or expected byte formats).

   • The APDU format TapLinx expects for authentication exchanges, or mapping guidance between TapLinx methods and the APDUs you recommend for SAM operations.

3. If TapLinx does not directly provide SAM integration, what is the recommended secure flow (best practice) to:

   • Relay card challenges to the SAM (in POS SAM slot),

   • Use SAM to compute responses (cryptogram / MAC), and

   • Feed those results into TapLinx so the DESFire session is authenticated and ready for secure read/write.

4. Any sample projects, technical notes, or internal docs you can share that cover TapLinx + external SAM (POS) integration would be very helpful.

 Any example code or recommended patterns you can share will accelerate our integration and help ensure we implement a secure, maintainable solution.

[jimmychan]

We do not have any support for external SAMs in TapLinx yet, so unfortunately, we do not have a recommended way on how to do this.