Mifare 1K Authentication Keys

Question

I have a MIFARE 1K tag. Some blocks can be written / read using authentication key A, while another block can be written using authentication key B. Why? How can I change all the blocks for writing / reading, for example, using the A key?

For example, I can write key block 07 using the A key, and I can also change the A key for this key block, but I cannot write on it with the B key, and I cannot change the B key for this key block.

Why should I write / read with the A key instead of the B key? Who cares?

Answer 1

Each sector of the MIFARE Classic card has two authentication keys: key A and key B. These two keys along with the access conditions are stored in the last block of each sector (the so-called sector trailer). The sector trailer is as follows:

+-----------------------------+--------------+----+-----------------------------+ | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | +-----------------------------+--------------+----+-----------------------------+ | Key A | Access Conditions | Key B | | (6 bytes) | (4 bytes) | (6 bytes) | +-----------------------------+--------------+----+-----------------------------+ 

Access conditions determine how to access blocks in the sector:

• commands that you can execute after authentication with key A (read, write, lock values),
• commands that you can execute after authentication with key B (read, write, block of values),
• if key B is generally used as an authentication key.

Typical scenarios:

• Authentication is only possible with key A. Key A has read-only access.
• Authentication is only possible with key A. Key A has read / write access.
• Authentication is possible with both keys. Key A has read-only access. Key B has read / write access.
• Authentication is possible with both keys. Keys A and B have read-only access.

A detailed description of the possible access conditions can be found in the MIFARE data file .