# AccessGrid DESFire application structures

## Overview

The goal of this guide is to show you how the AccessGrid DESFire application structure's work. We will go over two different structures that are available to all AccessGrid customers:

1. Simple structure

2. Key diversified structure

Both structures have some common info, as follows. For our sample passes, you must use the terminal capabilities identifier `020000`. The value of the AID (app id) depends on if you need a big endian or little endian value.

If you are a firmware developer, we **highly** recommend that you allow the TCI, AID and encryption keys be set via some configuration mechanism, perhaps OSDP, simple config files, config app or BLE app.

## Simple Structure application key sets and file info

The application ID is F56401 or 0164F5.

We have 2 static keys, master (id: 00), and read (id: 01). We use a single standard file (id: 00) of default size 32 bytes, but up to 64 bytes that uses encrypted communication with MACing for reads and can be read ideally by the read key (but also the master key).

The master key (id: 00) for sample keys is:

`1869e1e47af074f4fcf76a4ba9cf0709`

The read key (id: 01) for sample keys is:

`6e369e1a479c14601d2ed20a4121a67d`

Sample file (id: 00) payload:

`0000000000002A303D0000000000000000000000000000000000000000000000`

## Key diversified structure application key sets and file info

The application ID is ACCE55 or 55CEAC.

For key diversification we have 3 static keys, master (id: 00), read (id: 01), and privacy (id: 02). We use a single standard file (id: 00) of max size 4096 bytes that uses encrypted communication with MACing for reads and can be read by using [NXP’s AN10922 standard for key diversification](https://www.nxp.com/docs/en/application-note/AN10922.pdf). For the sample passes we’ve issued, the keys are as follows:

The master key (00) is:

`a9f212b7a5c5e04d73af90524a437b39`

The read key (01) is:

`[to be diversified]`

The privacy key (02) is:

`fc26aab3c926c0028ce4c47c8a1b4afb`

Sample file (00) payload:

`0000000000002A303D0000000000000000000000000000000000000000000000`

One other very important thing to note is that we use the UID and the privacy key for key diversification, if you're trying to implement this, you can find the (real) UID in the `tag_id` field of a access pass created with key diversification. We use the privacy key to read the tag_id AND as the source key for key diversification.

As just mentioned, you will need to authenticate with the privacy key (id: 02) within the DESFire application to access the card’s real UID. The UID should be 7 bytes or 14 chars.

Once you have your UID, here's a high level of what you can try to get your diversified key:

`DiversifiedKey = AES128CMAC(
    PrivacyKey,
    0x01 || UID || AID || SystemIdentifier (returned on creation of access pass) || Padding
)`

If you are using a sample pass, please send us a message to get the UID of the pass for key diversification.

## Payload when site_code / card_number are used

If you are using our API and making use of the `site_code` AND `card_number` properties for DESFire, then the payload will contain a value that follows this format:

1. First 3 bytes: 0’s (ex: 00 00 00)

2. Next byte static value 00

3. Next byte static value 00

4. Next byte is number of bits in card data (ex: 00)

5. Everything after is card data (ex: 2A303D )

6. The rest is padding to reach expected file size (see below)

All together:

`0000000000002A303D0000000000000000000000000000000000000000000000`

## Payload structure when file_data is used

If you are using our API and making use of the `file_data` properties for DESFire, then the payload will be determined by whoever issued the pass, and will be up to 64 hex characters (32 bytes) of whatever format they choose. For example they may send in a 37 bit credential (card number 8678015114, no facility code):

`20540008A0000000000000000000000000000000000000000000000000000000`

## Conclusion

Congrats, now you understand the AccessGrid DESFire application structure. Hopefully you can use [AccessGrid.com](/content/site-root.html) to make your life easier and issue mobile credentials. If you need any help getting started, just use the chat or email ab@accessgrid.com.