AN10922

Symmetric key diversifications
Rev. 2.2 — 2 July 2019165322

Application note
COMPANY PUBLIC

Document information
Information

Content

Keywords

MIFARE Plus, MIFARE DESFire, MIFARE SAM AV3, Key diversification,
CMAC, TDEA, AES.

Abstract

This Application note describes CMAC based symmetric key diversification
algorithms supported by NXP’s MIFARE SAM AV3.

AN10922

NXP Semiconductors

Symmetric key diversifications
Revision history
Rev

Date

Description

2.2

20190702

Fixed the AES256 key diversification example

2.1

20190417

Update for MIFARE SAM AV3

2.0

20170208

General update

1.320100317

Re-organization, addition of examples

1.2

20100129

Addition of AES-192, 2TDEA, 3TDEA key diversification algorithms

1.1

20090813

Editorial changes, no content change

1.020081112

Preliminary version

AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

2 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

1

Introduction
Key diversification is a process of deriving the keys from a master (base) key using someunique input. Each card is getting a different value for each key, so that if one key isbroken somehow (maybe from the terminal). The vulnerability is limited to that key onthat card rather than the whole system being affected.
The diversified keys are generated and given (stored) to the PICC at its personalization
phase, so all cards get unique keys. In the validation process, the POS terminal gets theinformation to generate the unique key for that unique card which is presented. MIFARESAM AV3 can be an optimum secure solution for this key diversification process. The
master (base) key can be stored securely in the MIFARE SAM AV3 and can be used togenerate or use only the diversified keys.
MIFARE SAM AV3 supports two types of key diversification:• old method, based on classical encryption, and• new method, based on CMAC calculation
In this document, only the key diversification based on CMAC calculation is discussed, as
it is the recommended algorithm. AES (128 and 192-bit key length) and TDEA (2-key and3-key TDES) keys can be diversified using this CMAC-based key diversification method.
In this document, the algorithms are explained in a way that they can be implemented
easily in SW without SAM today, but tomorrow using SAM.
All keys in a card can be derived from one master key however it is also possible to use a
different master key for one set of keys versus another set of keys.

1.1 Abbreviations
Table 1. Abbreviations

AN10922

Application note
COMPANY PUBLIC

Abbreviations

Meaning

AES

Advanced Encryption Standard

AID

Application ID

CBC

Cipher Block Chaining

CMAC

Cipher based MAC

DES

Data Encryption StandardDF

DESFireIV

Init Vector

LSB

Lowest Significant Bit

MAC

Message Authentication Code

MSB

Most Significant Bit

PCD

Proximity Coupling Device (reader/ writer unit)

PICC

Proximity Integrated Circuit Card

POS

Point Of SalesSW

Software

TDEA

Triple Data Encryption Algorithm

UID

Unique Identification number
All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

3 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

1.2 Examples presented in this document
The following symbols have been used to mention the operations in the examples:= Preparation of data by SAM, PICC or host.
Please note, that the numerical data are used solely as examples. They appear in
the text, in order to clarify the commands and command data.
Any data, values, cryptograms are expressed as hex string format if not otherwise
mentioned e.g. 0x563412 in hex string format represented as “123456”. Byte [0] = 0x12,
Byte [1] = 0x34, Byte [2] = 0x56.

AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

4 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

2

Key Diversification
2.1 Construction
For diversification, the recommended way by NXP is to use the CMAC construction of anamount of data using a master key. See [CMAC].
The pre-requisite is that there is enough input “diversification data” in order to make it a
MAC. A MAC is used rather than encryption to make it a one-way function.

Figure 1. CMAC construction (2 cases: left without padding, right with padding)Fig 1 illustrates the standard CMAC constructions (see [CMAC]) in two possible padding
cases.
According to [CMAC], to avoid certain classes of attack (in the CMAC), the last blockis modified before ciphering by being XORed with one of two possible “sub key” values(denoted K1 or K2), derived from an encryption of the zero vector under the key in use;the choice of which sub key to use is determined by whether the last message blockcontains padding or not.
These computations can be abstracted by the function CMAC (K, D, padded). In thecontext of the key derivations described further in this document another primitive is usedbecause the padding is performed in a non-CMAC standard way. The corresponding
computations can be abstracted by the function CMAC (K, D, Padded), where K is the
key to be diversified, D the diversification input data and Padded is a Boolean flag thatsignals to the CMAC(.,.,.) function whether M had to be padded or not.
If the keys are to be diversified per card, it is recommended to use for the diversification
input at least the UID of the card concatenated with e.g.
• For MIFARE Plus family: the block number where the key is stored. Note however that
if multi-sector authentication is desired, all keys that need to be the same need to begenerated using same block number.
• For MIFARE DESFire family: key number concatenated with application number.
Note: In this implementation, always two blocks (two times 16-byte for AES and
two times 8-byte for TDEA) of message have been used.

2.2 AES-128 key
Input:
AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

5 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications• 1 to 31 bytes of diversification input (let’s name it “M”)
• 16 bytes AES 128 bits master key (let's name it “K”)
Output:• 16 bytes AES 128 bits diversified key.
Algorithm:
1. Calculate CMAC input D:
2. D 0x01 || M || Padding
3. Padding is chosen such that D always has a length of 32 bytes. Padding bytes areaccording to the CMAC padding, i.e. 80h followed by 00h bytes. So the length ofPadding is 0 to 30 bytes.
4. Calculate the Boolean flag ‘Padded’, which is true if M is less than 31 bytes long, false
otherwise. The Boolean argument “Padded” is needed because it must be known in
AES128CMAC which K1 or K2 is to be used in the last computation round.
5. Calculate output:
6. Diversified Key AES128CMAC (K, D, Padded)
Processing load:
One AES 128 key load, 3 AES 128 computations
Fig 2 shows the algorithm as a block diagram.

Figure 2. Diversification of 128-bit AES key

AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

6 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

2.2.1 AES-128 key diversification example
Master key (K) = 00112233445566778899AABBCCDDEEFF, which will be diversified.
Table 2. Example – AES 128 key diversification
step

Indication

Data/ Message

Comment

CMAC sub key generation
1

Master key (K)=001122334455667788
99AABBCCDDEEFF

The key, which is going to be
diversified

2

K0

=

FDE4FBAE4A09E020
EFF722969F83832B

CIPHK(0b), AES (K, 16-byte 0s).

3

K1

=

FBC9F75C9413C041D The first sub key, see in [CMAC].
FEE452D3F0706D1

4

K2

=

F793EEB928278083B
FDC8A5A7E0E0D25

The second sub key, see in [CMAC].

Diversified key generation

AN10922

Application note
COMPANY PUBLIC

5

UID

=

04782E21801D80

7-byte UID of PICC

6

Application ID=

3042F5

3- byte DESFire AID

7

System Identifier=

4E585020416275

ASCII of system identifier name8

Diversification input =(M)

04782E21801D803042 Data from step 5 to step 7. It
F54E585020416275
doesn’t matter how you make yourdiversification input, diversification
input must be unique for unique
PICC e.g. here the UID is uniqueand the same diversification input
must be used in personalization andvalidation of the PICC. Maximum
length of M is 31 bytes.

9

Add the Div
Constant 1 at the
beginning of M=

0104782E21801D8030 Div constant is fixed, must be 0x01
42F54E585020416275 for AES 128 keys.

10

Do I need Padding=

Yes

The algorithm always needs 32-byte
block for AES; so far we have 18
bytes (step 9).

11

Padding=

800000000000000000
0000000000

14-byte padding to make 32-byte
block.

12

CMAC input D=

0104782E21801D8030 32 bytes
42F54E585020416275
800000000000000000
0000000000

13

Last 16-byte is
XORed with K2=

0104782E21801D8030 As the padding is added the last
42F54E5850204195E6 block is XORed with K2, if padding is
6EB928278083BFDC8 not added, then XORed with K1.
A5A7E0E0D25

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

7 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications
step

Indication

Data/ Message

Comment

14

Encryption using K=

351DB989A47CCA648 Standard AES encryption with IV =4CCE346FD5AE767A 00s in CBC mode
8DD63A3B89D54B37
CA802473FDA9175

15

Diversified key=

A8DD63A3B89D54B37 Last 16-byte block. (CMAC)
CA802473FDA9175

If the length of M is more than 15 bytes, standard CMAC algorithm can be used, without
taking care of padding, XOR and encryption. The message for standard CMAC is thenthe data of step 9.

2.3 AES-192 key
Input:• 1 to 31 bytes of diversification input (let’s name it “M”).
• 24 bytes AES 192 bits master key (let's name it “K”).
Output:• 24 bytes AES 192 bits diversified key.
Algorithm:
1. Calculate CMAC input D1 and D2:
2. D1 0x11 || M || Padding
3. D2 0x12 || M || Padding
4. Padding is chosen such that D1 and D2 always have a length of 32 bytes. Padding
bytes are according to the CMAC padding, i.e. 80h followed by 00h bytes. So thelength of Padding is 0 to 30 bytes.
5. Calculate the Boolean flag ‘Padded’, which is true if M is less than 31 bytes long, false
otherwise. The Boolean argument “Padded” is needed because it must be known in
AES192CMAC which K1 or K2 is to be used in the last computation round.
6. Calculate output:
7. DerivedKeyA AES192CMAC(K, D1, Padded)
8. DerivedKeyB AES192CMAC(K, D2, Padded)
9. DiversifiedKey first 8 bytes of DerivedKeyA || (next 8 bytes of DerivedKeyA XOR first
8 bytes of DerivedKeyB) || next 8 bytes of DerivedKeyB
Processing load:
One AES 192 key load, 6 AES 192 computations
If the special CMAC keys K1 and/or K2 can be reused from one to the following
AES_CMAC operation, then we will need only 5 AES computations. But this depends on
the HW implementation of the CMAC operation.
Fig 3 shows the algorithm as a block diagram.

AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

8 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

Figure 3. Diversification of 192-bit AES key

2.3.1 AES-192 key diversification example
Master key (K) = 00112233445566778899AABBCCDDEEFF0102030405060708, which
will be diversified.
Table 3. Example – AES 192 key diversification
step

Indication

Data/ Message

Comment

CMAC sub key generation

AN10922

Application note
COMPANY PUBLIC

1Master key (K)=001122334455667788 The key, which is going to be
99AABBCCDDEEFF01 diversified
02030405060708

2

K0

=

52DB5AFE7B64EFFA
B1E92EEA983C5F73

CIPHK(0b), AES (K, 16-byte 0s).

3

K1

=

A5B6B5FCF6C9DFF5
63D25DD53078BEE6

The first sub key, see in [CMAC].

4

K2

=

4B6D6BF9ED93BFEA
C7A4BBAA60F17D4B

The second sub key, see in [CMAC].

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

9 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications
step

Indication

Data/ Message

Comment

Diversified key generation

AN10922

Application note
COMPANY PUBLIC

5

UID

=

04782E21801D80

7-byte UID of PICC

6

Application ID=

3042F5

3- byte DESFire AID

7

System Identifier=

4E585020416275

ASCII of system identifier name8

Diversification input =(M)

04782E21801D803042 Data from step 5 to step 7. It
F54E585020416275
doesn’t matter how you make yourdiversification input, diversification
input must be unique for unique
PICC e.g. here the UID is uniqueand the same diversification input
must be used in personalization andvalidation of the PICC. Maximum
length of M is 31 bytes.

9

Add the Div
Constant 2 at the
beginning of M=

1104782E21801D8030 Div constant 2 is fixed, must be 0x11
42F54E585020416275 for AES 192 keys.

10

Do I need Padding=

Yes

The algorithm always needs 32-byte
block for AES; so far we have 18
bytes.

11

Padding=

800000000000000000
0000000000

14-byte padding to make 32-byte
block.

12

CMAC input D1=

104782E21801D80304 32 bytes
2F54E5850204162758
000000000000000000
000000000

13

Last 16-byte is
XORed with K2=

1104782E21801D8030 As the padding is added the last
42F54E585020412918 block is XORed with K2, if padding is
EBF9ED93BFEAC7A4 not added, then XORed with K1.
BBAA60F17D4B

14

Encryption using K=

C09ADDAE085769A6 Standard AES encryption with IV =E25DE29E51DA3669C 00s in CBC mode
E39C8E1CD82D9A78
69FE6A2EF75725D

15

Diversified key A=

CE39C8E1CD82D9A7 Last 16-byte block. (CMAC)
869FE6A2EF75725D

16

Add the Div
Constant 3 at the
beginning of M=

1204782E21801D8030 Div Constant 3 is fixed, must be 0x12
42F54E585020416275 for AES 192 keys.

17

CMAC input D2=

1204782E21801D8030 Here the only difference is Div
42F54E585020416275 Constant 3, which is ‘12’ fixed for800000000000000000 AES 192.
0000000000

18

Last 16-byte is
XORed with K2=

1204782E21801D8030 As the padding is added the last
42F54E585020412918 block is XORed with K2, if padding is
EBF9ED93BFEAC7A4 not added, then XORed with K1.
BBAA60F17D4B

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

10 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications
step

Indication

Data/ Message

Comment

19

Encryption using K=

D052C22EA94BEFE1 Standard AES encryption with IV =F748A9F5A675188A3 00s in CBC mode
8440F75A580E97E176
755EE7586E12C

20

Derived key B=

38440F75A580E97E
176755EE7586E12C

21First 8-byte ofderived key A=

CE39C8E1CD82D9A7

22

Last 8-byte ofderived key A=

869FE6A2EF75725D

23

First 8-byte ofderived key B=

38440F75A580E97E

24

Step 22 XOR step
23=

BEDBE9D74AF59B23

25

Last 8-byte ofderived key B=

176755EE7586E12C

26

Diversified Key=

CE39C8E1CD82D9A7 Step 21 + Step 24 + step 25
BEDBE9D74AF59B23
176755EE7586E12C

Last 16-byte block. (CMAC)

If the length of M is more than 15 bytes, standard CMAC algorithm can be used, without
taking care of padding, XOR and encryption. The message for standard CMAC is thenthe data of step 9 and data of step 16.

2.4 AES-256 key
Input:• 1 to 31 bytes of diversification input (let’s name it “M”).
• 32 bytes AES 256 bits master key (let's name it “K”).
Output:• 32 bytes AES 256 bits diversified key.
Algorithm:
1. Calculate CMAC input D1 and D2:
2. D1 0x41 || M || Padding
3. D2 0x42 || M || Padding
4. Padding is chosen such that D1 and D2 always have a length of 32 bytes. Padding
bytes are according to the CMAC padding, i.e. 80h followed by 00h bytes. So thelength of Padding is 0 to 30 bytes.
5. Calculate the Boolean flag ‘Padded’, which is true if M is less than 31 bytes long, false
otherwise. The Boolean argument “Padded” is needed because it must be known in
AES256CMAC which K1 or K2 is to be used in the last computation round.
6. Calculate output:
7. DerivedKeyA AES256CMAC(K, D1, Padded)
8. DerivedKeyB AES256CMAC(K, D2, Padded)
9. DiversifiedKey DerivedKeyA || DerivedKeyB
Processing load:
AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

11 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications
One AES 256 key load, 6 AES 256 computations
If the special CMAC keys K1 and/or K2 can be reused from one to the following
AES_CMAC operation, then we will need only 5 AES computations. But this depends on
the HW implementation of the CMAC operation.
Fig 3 shows the algorithm as a block diagram.

Figure 4. Diversification of 256-bit AES key

2.4.1 AES-256 key diversification example
Master key (K) =00112233445566778899AABBCCDDEEFF0102030405060708090A0B0C0D0E0F00,
which will be diversified.
Table 4. Example – AES 256 key diversification
step

Indication

Data/ Message

Comment

CMAC sub key generation

AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

12 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications
step

Indication

Data/ Message

Comment1

Master key (K)=001122334455667788 The key, which is going to be
99AABBCCDDEEFF01 diversified
02030405060708090A
0B0C0D0E0F00

2

K0

=

07FFEC1BEDF68CE6
D3D1BAE8512F9813

3

K1

=

0FFFD837DBED19CD The first sub key, see in [CMAC].
A7A375D0A25F3026

4

K2

=

1FFFB06FB7DA339B4 The second sub key, see in [CMAC].
F46EBA144BE604C

CIPHK(0b), AES (K, 16-byte 0s).

Diversified key generation

AN10922

Application note
COMPANY PUBLIC

5

UID

=

04782E21801D80

7-byte UID of PICC

6

Application ID=

3042F5

3- byte DESFire AID

7

System Identifier=

4E585020416275

ASCII of system identifier name8

Diversification input =(M)

04782E21801D803042 Data from step 5 to step 7. It
F54E585020416275
doesn’t matter how you make yourdiversification input, diversification
input must be unique for unique
PICC e.g. here the UID is uniqueand the same diversification input
must be used in personalization andvalidation of the PICC. Maximum
length of M is 31 bytes.

9

Add the Div
Constant 2 at the
beginning of M=

4104782E21801D8030 Div constant 2 is fixed, must be 0x41
42F54E585020416275 for AES 256 keys.

10

Do I need Padding=

Yes

The algorithm always needs 32-byte
block for AES; so far we have 18
bytes.

11

Padding=

800000000000000000
0000000000

14-byte padding to make 32-byte
block.

12

CMAC input D1=

4104782E21801D8030 32 bytes
42F54E585020416275
800000000000000000
0000000000

13

Last 16-byte is
XORed with K2=

4104782E21801D8030 As the padding is added the last
42F54E585020417D8 block is XORed with K2, if padding is
A306FB7DA339B4F46 not added, then XORed with K1.
EBA144BE604C

14

Encryption using K=

05FC00C95DD7AEFF Standard AES encryption with IV =203CCF3006839F204 00s in CBC mode
FC6EEC820B4C54314
990B8611662DB6

15

Derived key A=

4FC6EEC820B4C5431 Last 16-byte block. (CMAC)
4990B8611662DB6

16

Add the Div
Constant 3 at the
beginning of M=

4204782E21801D8030 Div Constant 3 is fixed, must be 0x42
42F54E585020416275 for AES 256 keys.

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

13 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications
step

Indication

Data/ Message

Comment

17

CMAC input D2=

4204782E21801D8030 Here the only difference is Div
42F54E585020416275 Constant 3, which is ‘12’ fixed for800000000000000000 AES 256.
0000000000

18

Last 16-byte is
XORed with K2=

4204782E21801D8030 As the padding is added the last
42F54E585020417D8 block is XORed with K2, if padding is
A306FB7DA339B4F46 not added, then XORed with K1.
EBA144BE604C

19

Encryption using K=

3EC9D8E4279BBC0B Standard AES encryption with IV =652E903618A41EFA9 00s in CBC mode
5E7880982C0001E606
7488346100AED

20

Derived key B=

95E7880982C0001E60 Last 16-byte block. (CMAC)
67488346100AED

21

Diversified Key=

4FC6EEC820B4C5431 Derived Key A || Derived Key B
4990B8611662DB695
E7880982C0001E6067
488346100AED

If the length of M is more than 15 bytes, standard CMAC algorithm can be used, without
taking care of padding, XOR and encryption. The message for standard CMAC is thenthe data of step 9 and data of step 16.

2.5 2TDEA key
Input:• 1 to 15 bytes of diversification input (let’s name it “M”)
• 16 bytes 2TDEA master key (let's name it “K”)
Output:• 16 bytes 2TDEA diversified key.
Algorithm:
1. Calculate CMAC input D1 and D2:
2. D1 0x21 || M || Padding
3. D2 0x22 || M || Padding
4. Padding is chosen such that D1 and D2 always have a length of 16 bytes. Padding
bytes are according to the CMAC padding, i.e. 80h followed by 00h bytes. So thelength of Padding is 0 to 14 bytes.
5. Calculate the boolean flag ‘Padded’, which is true if M is less than 15 bytes long, false
otherwise. The Boolean argument “Padded” is needed because it must be known in
TDEACMAC which K1 or K2 is to be used in the last computation round.
6. Calculate output:• DerivedKey1 = TDEACMAC(K, D1, Padded)• DerivedKey2 = TDEACMAC(K, D2, Padded)• 16-byte diversified key = DerivedKey1 || DerivedKey2.
Processing load: one 2TDEA key load, 6 2TDEA computations
We can reduce the TDEA operations to 5 if the CMAC K1 and/or K2 can be reused.
AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

14 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications
The Boolean argument “Padded” is needed because it must be known in TDEACMAC
which K1 or K2 is to be used in the last computation round.
Remark: The master key can only be used about 1 million times if one wants to comply
with SP 800-38B. This means that the construction suggested here can be used for500000 cards. If more than 500000 cards are needed, and if duplicate keys are notacceptable for the application, a two level key diversification mechanism could be used.
Fig 5 shows the algorithm as a block diagram.

Figure 5. Diversification of 2TDEA key

MIFARE DESFire products store key version information in the lowest significant bits ofthe first 8 bytes 2TDEA key. If this versioning information is to be preserved, it is to becopied from the master key into the diversified key.

2.5.1 2TDEA key diversification example
Master key (K) = 00112233445566778899AABBCCDDEEFF, which will be diversified.
Table 5. Example – 2TDEA key diversification
step

Indication

Data/ Message

Comment

001122334455667788
99AABBCCDDEEFF

The key, which is going to be
diversified

CMAC sub key generation
1

AN10922

Application note
COMPANY PUBLIC

Master key (K)=All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

15 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications
step

Indication

Data/ Message

Comment

2

K0=

FB09759972301AF4

CIPHK(0b), 2DEA (K, 8-byte 0s).

3

K1

=

F612EB32E46035F3

The first sub key, see in [CMAC].

4

K2

=

EC25D665C8C06BFD

The second sub key, see in [CMAC].

Diversified key generation

AN10922

Application note
COMPANY PUBLIC

5

UID

=

04782E21801D80

7-byte UID of PICC

6

Application ID=

3042F5

3- byte DESFire AID

7

System Identifier=

4E58502041

ASCII of system identifier name8

Diversification input =(M)

04782E21801D803042 Data from step 5 to step 7. It
F54E58502041
doesn’t matter how you specify yourdiversification input, the main thing,
Diversification input must be uniquefor unique PICC e.g. here the UID is
unique and the same diversification
input must be used in personalizationand validation of the PICC. This has
to be up to 16 bytes.

9

Add the TDEA Div
Constant 1 at the
beginning of M=

2104782E21801D8030 It is fixed, must be ‘21’ for 2TDEA
42F54E58502041
keys.

10

Do I need Padding

=

No

11

CMAC input D1=

2104782E21801D8030 16 bytes
42F54E58502041

12

Last 16-byte is
XORed with K1=

2104782E21801D80C
6501E7CBC3015B2

13

Encryption using K=

5B7B81DCDE98A6BE Standard TDEA encryption with IV =16F8597C9E8910C800s in CBC mode

14

Derived Key 1=

16F8597C9E8910C8

15

Add the TDEA Div
Constant 2 at the
beginning of M=

2204782E21801D8030
42F54E58502041

16

Do I need Padding

=

No

17

CMAC input D1=

2204782E21801D8030 16 bytes
42F54E58502041

18

Last 8-byte is
XORed with K1=

2204782E21801D80C
6501E7CBC3015B2

As the padding is NOT added thelast block is XORed with K1, if
padding is added, then XOR with K2.

19

Encryption using K=

D2292CCE0B8106CE
6B9648D006107DD7

Standard TDEA encryption with IV =00s in CBC mode

20

Derived Key 2=

6B9648D006107DD7

CMAC

21

2TDEA diversified
key (without
restoring the key
version)=

16F8597C9E8910C86
B9648D006107DD7

Step 15 + step 20

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322

The algorithm always needs 16-byte
block for TDEA, Here message is 16
bytes.

As the padding is NOT added thelast block is XORed with K1, if
padding is added, then XOR with K2.

CMAC© NXP B.V. 2019. All rights reserved.

16 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications
step

Indication

Data/ Message

Comment

The lowest significant bit of every key byte is not used in DES calculation. MIFARE DESFire andSAMs use the lowest significant bit of first eight bytes key as the key version. In this example
the version of master key = 0x55 (01010101b). These version bits are required to insert in thediversified key as well, to make the same key version for master key and diversified keys.
22

2TDEA diversified
key(after inserting the
key version)=

16F9587D9E8910C9
6B9648D006107DD7

If the length of M is more than 7 bytes, standard CMAC algorithm can be used, without
taking care of padding, XOR and encryption. The message for standard CMAC is thenthe data of step 9 and data of step 15.

2.6 3TDEA key
Input:• 1 to 15 bytes of diversification input (let’s name it “M”)
• 24 bytes 3TDEA master key (let's name it “K”)
Output:• 24 bytes 3TDEA diversified key.
Algorithm:
1. Calculate CMAC input D1, D2 and D3:
2. D1 0x31 || M || Padding
3. D2 0x32 || M || Padding
4. D3 0x33 || M || Padding
5. Padding is chosen such that D1, D2 and D3 always have a length of 16 bytes.
Padding bytes are according to the CMAC padding, i.e. 80h followed by 00h bytes. So
the length of Padding is 0 to 14 bytes.
6. Calculate the Boolean flag ‘Padded’, which is true if M is less than 15 bytes long, false
otherwise. The Boolean argument “Padded” is needed because it must be known in
TDEACMAC which K1 or K2 is to be used in the last computation round.
7. Calculate output:• DerivedKey1 = TDEACMAC(K, D1, Padded)• DerivedKey2 = TDEACMAC(K, D2, Padded)• DerivedKey3 = TDEACMAC(K, D3, Padded)• 16-byte diversified key = DerivedKey1 || DerivedKey2 || DerivedKey3.
Processing load: one 3TDEA key load, 9 3TDEA computations
Remark: The master key can only be used about 1 million times if one wants to comply
to SP 800-38B. This means that the construction suggested here can be used for about
330000 cards. If more than 330000 cards are needed, and if duplicate keys are notacceptable for the application, a two level key diversification mechanism is used.
The Boolean argument “Padded” is needed because it must be known in TDEACMAC
which K1 or K2 is to be used in the last computation round.
Fig 6 shows the algorithm as a block diagram.

AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

17 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

Figure 6. Diversification of 3TDEA key

MIFARE DESFire products store key version information in the lowest significant bits ofthe first 8 bytes 3TDEA key. If this versioning information is to be preserved, it is to becopied from the master key into the diversified key.

2.6.1 3TDEA key diversification example
Master key (K) = 00112233445566778899AABBCCDDEEFF0102030405060708, which
will be diversified.
Table 6. Example – 3TDEA key diversification
step

Indication

Data/ Message

Comment

CMAC sub key generation
1

Master key=

001122334455667788 The key, which is going to be
99AABBCCDDEEFF01 diversified
02030405060708

2

K0

=

51F6AC7C734A0DE5

CIPHK(0b), 2DEA (K, 8-byte 0s).

3

K1

=

A3ED58F8E6941BCA

The first sub key, see in [CMAC].

4

K2

=

47DAB1F1CD28378F

The second sub key, see in [CMAC].

Diversified key generation
AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

18 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

AN10922

Application note
COMPANY PUBLIC

step

Indication

Data/ Message

Comment

5

UID=

04782E21801D80

7-byte UID of PICC

6

Application ID=

3042F5

3- byte DESFire AID

7

System Identifier=

4E5850ASCII of system identifier name8

Diversification input =(M)

04782E21801D803042 Data from step 5 to step 7. It
F54E5850
doesn’t matter how you specify yourdiversification input, the main thing,
Diversification input must be uniquefor unique PICC e.g. here the UID is
unique and the same diversification
input must be used in personalizationand validation of the PICC. This has
to be up to 16 bytes.

9

After inserting
TDEA Div constant
3=3104782E21801D8030 It is fixed, must be ‘31’ for 3TDEA
42F54E5850
keys.

10

Do I need Padding

=

Yes

11

CMAC input D1=

3104782E21801D8030 8000 padding added
42F54E58508000

12

Last 8-byte is
XORed with K2=

3104782E21801D8077 As the padding is added the last
9844BF9578B78F
block is XORed with K2, if padding is
NOT added, then XOR with K1.

13

Encryption using K=

4C294A83A6829EC12 Standard TDEA encryption with IV =F0DD03675D3FB9A
00s in CBC mode

14

Derived Key 1=

2F0DD03675D3FB9A

15

After inserting
TDEA Div constant
4 in M=

3204782E21801D8030 It is fixed, must be ‘32’ for 3TDEA
42F54E5850
keys.

16

Do I need Padding

=

Yes

17

CMAC input D2=

3204782E21801D8030 8000 padding added
42F54E58508000

18

Last 8-byte is
XORed with K2=

3204782E21801D8077 Diversification constant and
9844BF9578B78F
diversification input. Here theconstant must be ‘32’

19

Encryption using K=

41A9459AB5B209905
705AB0BDA91CA0B

Standard TDEA encryption with IV =00s in CBC mode

20

Derived Key 2=

5705AB0BDA91CA0B

CMAC

21

After inserting
TDEA Div constant
5 in M=

3304782E21801D8030 It is fixed, must be ‘33’ for 3TDEA
42F54E5850
keys.

22

Do I need Padding=

Yes

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322

The algorithm always needs 16-byte
block for TDEA, here message is 14
bytes.

CMAC

The algorithm always needs 16-byte
block for TDEA, here message is 14
bytes.

The algorithm always needs 16-byte
block for TDEA, here message is 14
bytes© NXP B.V. 2019. All rights reserved.

19 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications
step

Indication

Data/ Message

Comment

23

CMAC input D3=

3304782E21801D8030 8000 padding added
42F54E58508000

24

Last 8-byte is
XORed with K2=

3304782E21801D8077 Diversification constant and
9844BF9578B78F
diversification input. Here theconstant must be ‘33’

25

Encryption using K=

7FABF1B71419AF155 Standard TDEA encryption with IV =5B8E07FCDBF10EC
00s in CBC mode

26

Derived Key 3=

55B8E07FCDBF10EC

27

Diversified 3TDEA
key (without
restoring the key
version)=

2F0DD03675D3FB9A5 24-byte 3TDEA key. (Step 14 + step
705AB0BDA91CA0B5 20 + step 26).
5B8E07FCDBF10EC

CMAC

The lowest significant bit of every key byte is not used in DES calculation. MIFARE DESFire andSAMs use the lowest significant bit of first eight bytes key as the key version. In this example
the version of master key = 0x55 (01010101b). These version bits are required to insert in thediversified key as well, to make the same key version for master key and diversified keys.
28

Diversified 3TDEA
key(after restoring the
key version)=

2E0DD03774D3FA9B5
705AB0BDA91CA0B5
5B8E07FCDBF10EC

If the length of M is more than 7 bytes, standard CMAC algorithm can be used, without
taking care of padding, XOR and encryption. The message for standard CMAC is thenthe data of step 9, step 15 and step 21.

AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

20 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

3

Conclusion
The master keys must be stored securely if the algorithms are implemented insoftware. MIFARE SAM AV3 offers secure storage of the master keys and dynamic
diversifications. For the optimum security, using MIFARE SAM AV3 can be the bestsolution. The user shall take care for defining his master keys, shall avoid the weakkeys whenever necessary. Neither the SAM nor the algorithms analyze the keys. NXP
recommends using AES instead of TDEA.

AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

21 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

4

References
1. CMAC specification: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/
NIST.SP.800-38b.pdf

AN10922

Application note
COMPANY PUBLIC

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

22 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

5

Legal information

5.1 Definitions
Draft — The document is a draft version only. The content is still underinternal review and subject to formal approval, which may result in
modifications or additions. NXP Semiconductors does not give any
representations or warranties as to the accuracy or completeness of
information included herein and shall have no liability for the consequencesof use of such information.

5.2 Disclaimers
Limited warranty and liability — Information in this document is believed
to be accurate and reliable. However, NXP Semiconductors does notgive any representations or warranties, expressed or implied, as to theaccuracy or completeness of such information and shall have no liability
for the consequences of use of such information. NXP Semiconductors
takes no responsibility for the content in this document if provided by an
information source outside of NXP Semiconductors. In no event shall NXP
Semiconductors be liable for any indirect, incidental, punitive, special orconsequential damages (including - without limitation - lost profits, lostsavings, business interruption, costs related to the removal or replacementof any products or rework charges) whether or not such damages are based
on tort (including negligence), warranty, breach of contract or any otherlegal theory. Notwithstanding any damages that customer might incur for
any reason whatsoever, NXP Semiconductors’ aggregate and cumulative
liability towards customer for the products described herein shall be limitedin accordance with the Terms and conditions of commercial sale of NXP
Semiconductors.
Right to make changes — NXP Semiconductors reserves the right tomake changes to information published in this document, including without
limitation specifications and product descriptions, at any time and without
notice. This document supersedes and replaces all information supplied prior
to the publication hereof.
Suitability for use — NXP Semiconductors products are not designed,
authorized or warranted to be suitable for use in life support, life-critical orsafety-critical systems or equipment, nor in applications where failure or
malfunction of an NXP Semiconductors product can reasonably be expected
to result in personal injury, death or severe property or environmental
damage. NXP Semiconductors and its suppliers accept no liability forinclusion and/or use of NXP Semiconductors products in such equipment orapplications and therefore such inclusion and/or use is at the customer’s own
risk.
Applications — Applications that are described herein for any of theseproducts are for illustrative purposes only. NXP Semiconductors makes
no representation or warranty that such applications will be suitable
for the specified use without further testing or modification. Customers
are responsible for the design and operation of their applications andproducts using NXP Semiconductors products, and NXP Semiconductors
accepts no liability for any assistance with applications or customer productdesign. It is customer’s sole responsibility to determine whether the NXP

AN10922

Application note
COMPANY PUBLIC

Semiconductors product is suitable and fit for the customer’s applications
and products planned, as well as for the planned application and use ofcustomer’s third party customer(s). Customers should provide appropriate
design and operating safeguards to minimize the risks associated with
their applications and products. NXP Semiconductors does not accept any
liability related to any default, damage, costs or problem which is basedon any weakness or default in the customer’s applications or products, orthe application or use by customer’s third party customer(s). Customer is
responsible for doing all necessary testing for the customer’s applications
and products using NXP Semiconductors products in order to avoid adefault of the applications and the products or of the application or use bycustomer’s third party customer(s). NXP does not accept any liability in thisrespect.
Export control — This document as well as the item(s) described herein
may be subject to export control regulations. Export might require a priorauthorization from competent authorities.
Evaluation products — This product is provided on an “as is” and “with all
faults” basis for evaluation purposes only. NXP Semiconductors, its affiliates
and their suppliers expressly disclaim all warranties, whether express,
implied or statutory, including but not limited to the implied warranties of
non-infringement, merchantability and fitness for a particular purpose. The
entire risk as to the quality, or arising out of the use or performance, of thisproduct remains with customer. In no event shall NXP Semiconductors, itsaffiliates or their suppliers be liable to customer for any special, indirect,
consequential, punitive or incidental damages (including without limitation
damages for loss of business, business interruption, loss of use, loss ofdata or information, and the like) arising out the use of or inability to use
the product, whether or not based on tort (including negligence), strict
liability, breach of contract, breach of warranty or any other theory, even if
advised of the possibility of such damages. Notwithstanding any damages
that customer might incur for any reason whatsoever (including without
limitation, all damages referenced above and all direct or general damages),
the entire liability of NXP Semiconductors, its affiliates and their suppliersand customer’s exclusive remedy for all of the foregoing shall be limited toactual damages incurred by customer based on reasonable reliance up to
the greater of the amount actually paid by customer for the product or five
dollars (US$5.00). The foregoing limitations, exclusions and disclaimers
shall apply to the maximum extent permitted by applicable law, even if any
remedy fails of its essential purpose.
Translations — A non-English (translated) version of a document is forreference only. The English version shall prevail in case of any discrepancy
between the translated and English versions.

5.3 Trademarks
Notice: All referenced brands, product names, service names andtrademarks are the property of their respective owners.
MIFARE — is a trademark of NXP B.V.
DESFire — is a trademark of NXP B.V.
MIFARE Plus — is a trademark of NXP B.V.

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

23 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

TablesTab. 1.
Tab. 2.
Tab. 3.

Abbreviations .....................................................3
Example – AES 128 key diversification .............7
Example – AES 192 key diversification .............9AN10922

Application note
COMPANY PUBLIC

Tab. 4.
Tab. 5.
Tab. 6.

Example – AES 256 key diversification ........... 12
Example – 2TDEA key diversification ............. 15
Example – 3TDEA key diversification ............. 18

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

24 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

FiguresFig. 1.
Fig. 2.
Fig. 3.

CMAC construction (2 cases: left without
padding, right with padding) .............................. 5
Diversification of 128-bit AES key ..................... 6
Diversification of 192-bit AES key ..................... 9

AN10922

Application note
COMPANY PUBLIC

Fig. 4.
Fig. 5.
Fig. 6.

Diversification of 256-bit AES key ................... 12
Diversification of 2TDEA key ...........................15
Diversification of 3TDEA key ...........................18

All information provided in this document is subject to legal disclaimers.

Rev. 2.2 — 2 July 2019165322© NXP B.V. 2019. All rights reserved.

25 / 26

AN10922

NXP Semiconductors

Symmetric key diversifications

Contents
1
1.1
1.2
2
2.1
2.2
2.2.1
2.3
2.3.1
2.4
2.4.1
2.5
2.5.1
2.6
2.6.1
3
4
5

Introduction ......................................................... 3
Abbreviations ..................................................... 3
Examples presented in this document ...............4
Key Diversification ..............................................5
Construction .......................................................5
AES-128 key ......................................................5
AES-128 key diversification example ................ 7
AES-192 key ......................................................8
AES-192 key diversification example ................ 9
AES-256 key ....................................................11
AES-256 key diversification example ...............12
2TDEA key ...................................................... 14
2TDEA key diversification example ................. 15
3TDEA key ...................................................... 17
3TDEA key diversification example ................. 18
Conclusion .........................................................21
References ......................................................... 22
Legal information .............................................. 23

Please be aware that important notices concerning this document and the product(s)described herein, have been included in section 'Legal information'.

© NXP B.V. 2019.

All rights reserved.

For more information, please visit: http://www.nxp.com
For sales office addresses, please send an email to: salesaddresses@nxp.com
Date of release: 2 July 2019
Document identifier: AN10922
Document number: 165322