Proxmark3 community

rf_hack

Contributor

Registered: 2008-08-20

Posts: 16

Mifare chip random number

I saw in many published papers that the first reader command is "60 xx crc crc" and the chip reply is "aa bb cc dd"

In another paper this is explained that ID is XORed with RND before entering the LFSR

ID is 4 bytes long + 1 LRC

Does the RND from the chip is "aa bb" and the CRC is "cc dd" or the RND is "aa bb cc dd" ???

To perform the XOR this is more logic to have "aa bb cc dd" otherwise I don't see how this XOR is done (perhaps only on the 2 LSBytes of the ID).

From a chip design point of view this is logic to have "aa bb" and CRC "cc dd" ...

Could someone explain ?

thanks

rf_hack

Contributor

Registered: 2008-08-20

Posts: 16

Re: Mifare chip random number

Great!