AnsweredAssumed Answered

Password Authentication - Ntag213 + PN512

Question asked by Fernando H Coelho on Dec 1, 2016
Latest reply on Dec 14, 2016 by Jorge_Gonzalez

Hi everyone,

 

I'm having trouble to remove a password applied to a NTAG213. I set a password to a tag and I can't authenticate to write in tag again. Also, I can't remove the tag password either. Can someone help me?

 

Here are my code:

 

...

// already connect to tag

//Changing password in NTAG213 - sector 2B

uCla = 0xFF; 
uIns = 0xD6; //write command used by my reader
uP1 = 0x00; 
uP2 = 0x2B; //memory block to write
Data[0] = 0x40; //PWD data -- @ A B C
Data[1] = 0x41;
Data[2] = 0x42;
Data[3] = 0x43;
uLe = 0x04; //Return lenght expected 
uLc = 0x04; //Data size

response = piccClass.sendCommand(iCaseType, uCla, uIns, uP1, uP2, uLc, uLe, Data); //Everything looks fine

 

//Activate  (AUTH0)
uCla = 0xFF; 
uIns = 0xD6; // write command used by my reader
uP1 = 0x00; 
uP2 = 0x29; //memory block to write
Data[0] = 0x04; //Data filled with NTAG213 specs - Strong encript + protect block 04h and foward
Data[1] = 0x00;
Data[2] = 0x00;
Data[3] = 0x04;
uLe = 0x04; 
uLc = 0x04; 

response = piccClass.sendCommand(iCaseType, uCla, uIns, uP1, uP2, uLc, uLe, Data); //Everything looks fine

 

-- From now on, the tag is protected. With the NXP Writer APP I can unlock it with no problems. I didn't changed the PACK number, because this seems to lock the authentication.

Next step, I'll try to authenticate (AUTH_PWD) and write the sector 09h of the tag.

 

// already connect to tag

//Authenticate the tag

uCla = 0xFF;
uIns = 0x00;
uP1 = 0x00;
uP2 = 0x00;
uLc = 0x05; 
uLe = 0xFF;
Data[0] = 0x1B; //PWD_AUTH command in NTAG213 specs
Data[1] = 0x40; //PWD data - @ A B C
Data[2] = 0x41;
Data[3] = 0x42;
Data[4] = 0x43;

response = piccClass.sendCommand(iCaseType, uCla, uIns, uP1, uP2, uLc, uLe, Data); //Received response 00 00 90 00 - PACK (00 00) and ACK (90 00)

 

-- As said in NTAG21x docs, after an authentication I can send a write command to the tag and it will accept it. So I tried to write a memory sector:

 

//write NXP tag

uCla = 0xFF; 
uIns = 0xD6; // write command used by my reader
uP1 = 0x00; 
uP2 = 0x09; //memory block to write
Data[0] = 0x70; //random hex numbers
Data[1] = 0x71;
Data[2] = 0x72;
Data[3] = 0x73;
uLe = 0x04; //Return lenght expected 
uLc = 0x04; //Data size

response = piccClass.sendCommand(iCaseType, uCla, uIns, uP1, uP2, uLc, uLe, Data); //Return 99 00 - unknown error

 

-- I tried a lot of other commands, but with no luck. It seems I need to use PACK somewhere, but I don't know where.

 

I tried the NTAG213 spec commands of Write, It returns 90 00 but no data is written.

 

Thank for the help!!!

Fernando Coelho

 

Outcomes