Trouble reading AES encrypted data from EV3 card

[GeirB]

Hi!

Have successfully created auth/sess keys using read-only key 1, (also tested on e.g. Get CardUID/0x51), but when I try to read data in file 1, I get a 91 1E. Have followed the AN12343 minutely. Log below.

Any hints to what I do wrong?

BR Geir

#MIFARE_EV3

C-APDU: 90 6A 00 00 00 -> 91 00
List of applications: 2E AE BC 21 AF BD 91 00

C-APDU: 90 5A 00 00 03 21 AF BD 00 -> 91 00
Selecting Application: 91 00

C-APDU: 90 F5 00 00 01 01 00 -> 91 00
FileSettings: 00 03 00 10 40 00 00 91 00

Creating session & keys
C-APDU: 90 71 00 00 02 01 00 00 -> 91 AF
RndB_enc: 65 EA A0 7D EC 05 C0 68 10 D2 CF 58 3B BB FF C4
RndB: 8F 38 D0 E4 FB 05 3E EF 0A 7B E8 98 21 26 27 82
RndB’: 38 D0 E4 FB 05 3E EF 0A 7B E8 98 21 26 27 82 8F
RndA: 9F 20 F5 BA 0F D0 E9 CC 19 97 9D E7 1F 6E CF 26
RndA’: 20 F5 BA 0F D0 E9 CC 19 97 9D E7 1F 6E CF 26 9F
RndAB_rot: 9F 20 F5 BA 0F D0 E9 CC 19 97 9D E7 1F 6E CF 26 38 D0 E4 FB 05 3E EF 0A 7B E8 98 21 26 27 82 8F
RndAB_rot_enc: 9B F9 CE 79 5A 2C 3B 03 DC 51 0B 88 20 1A 65 DC 91 93 FD 16 B0 98 2E DE 3D A0 3A AA 9D 63 A7 7C
C-APDU: 90 AF 00 00 20 9B F9 CE 79 5A 2C 3B 03 DC 51 0B 88 20 1A 65 DC 91 93 FD 16 B0 98 2E DE 3D A0 3A AA 9D 63 A7 7C 00 -> 91 00
EncArr: 5C DF 2B B3 C4 49 27 8F 46 D9 32 27 2C EA 67 4B D0 25 66 00 02 73 3A 5F 78 5E D5 BA 7B DB C0 57
DecArr: B6 64 8E 41 20 F5 BA 0F D0 E9 CC 19 97 9D E7 1F 6E CF 26 9F 00 00 00 00 00 00 00 00 00 00 00 00
R RndA: 20 F5 BA 0F D0 E9 CC 19 97 9D E7 1F 6E CF 26 9F
RndA' and RndA compares ok
CMACContext: A5 5A 00 01 00 80 9F 20 7A 82 DF 34 12 C9 3E EF 0A 7B E8 98 21 26 27 82 19 97 9D E7 1F 6E CF 26
Session & keys created successfully
TI: B6 64 8E 41
SessAuthENCKey: 7B CE D6 00 DC BE 7E 01 13 B8 98 EC F8 83 20 5A
SessAuthMACKey: A5 D7 C0 01 94 B0 16 75 8F 37 CE 19 92 94 38 E3

Open file 1, offset 0
CmdHeader: 01 00 00 00 40 00 00
MAC_Input: AD 01 00 B6 64 8E 41 01 00 00 00 40 00 00
CMAC: 8F 99 EB B3 FE 72 ED 53
C-APDU: 90 AD 00 00 0F 01 00 00 00 40 00 00 8F 99 EB B3 FE 72 ED 53 00 -> 91 1E

[EduardoZamora]

Hello @GeirB

Hope you are doing well.

91 1E should indicate that CRC or MAC does not match data.

[AN12343] corresponds to MIFARE DESFire Light products. For MIFARE DESFire EV3, as some of the information is secured under NDA (Non-Disclosure Agreement), and therefor this information is not public, please consult the Non-Disclosure Agreement FAQs. You can try requesting an NDA directly from the NDA online form; after your request is processed, you should be contacted by the NXP NDA team.

Once you have a valid NDA with NXP you would need to request access to the documentation through Secure Access Rights.

For this, you could follow the instructions from this page: Secure Access Rights | NXP Semiconductors. Also, I would recommend checking the Secure Access Rights FAQs | NXP Semiconductors.

Regards,
Eduardo.