MIFARE DESFire Explained: Essential Concepts for Secure Contactless Applications

Michael Pichardo

September 15, 2025

Overview

MIFARE DESFire is a powerful contactless smart card technology that supports multiple applications on a single card. In this guide, you'll learn the core concepts behind MIFARE DESFire technology, including its three-tier hierarchical system (cards, applications, files), essential command operations, sample card structure, and known security vulnerabilities and attacks. The MIFARE DESFire family has three evolutions (EV1, EV2, and EV3) and this guide applies to all three of them.

By the end of this tutorial, you'll have an understanding of the DESFire card structure that can be expanded for physical access control, payment systems, transit applications, hospitality services, or other secure NFC applications. It's a bit technical, especially if you're new to smart card operations, but following along will give you a solid foundation for more advanced DESFire implementations and security assessments.

MIFARE DESFire's Hierarchical Architecture

Let's get started. To understand MIFARE DESFire, you have to know that each DESFire card operates on a three-tier hierarchical system that functions like a secure filing cabinet with multiple levels of access control.

On a high level, this is the hierarchy:

• Card Level
• Master Application Level
• Custom Application Level

Tier 1: PICC Level (The Card level)

The PICC (Proximity Integrated Circuit Card) is the physical card and represents the highest level of the hierarchy. Think of this as the building that contains all the offices.

What lives at the PICC level:

• Card-wide settings: For EV1, the maximum number of applications (28); for EV2 and EV3, there are an unlimited amount of applications.
• Global security policies: Policies that dictate whether applications can be created without master authentication.
• Manufacturing data: Production batch, hardware/software versions, UID, or any data that the manufacturer would like to include.
• Memory management: Total available memory space and the tracking of how the categories of memory are being allocated.

The PICC has exactly one key - the PICC Master Key (which is always Key #0). So at this level, the Master Key governs the following:

• Creating new applications anywhere on the card.
• Deleting any application (with proper authentication).
• Formatting the entire card (nuclear option - wipes everything).
• Changing card-wide security settings.

Tier 2: Master Application Level

Every DESFire card has exactly one Master Application with the reserved AID or Application Identifier of 000000. This is a special application that acts as the gateway to card-level operations.

Operations that require Master Application access:

• Listing all applications on the card (Get Application IDs).
• Creating new applications (Create Application).
• Deleting applications (Delete Application).
• Changing the PICC Master Key.
• Formatting the card.

Tier 3: Custom Application level (Custom AIDs)

These are the actual functional applications that store your business data. Each application is isolated from the others.

AID Rules:

• Must be exactly 3 bytes (24 bits).
• Must be unique across the card.
• Cannot use 000000 (reserved for Master Application).
• Can be any value from 000001 to FFFFFF.

Keys: The Security System

Think of keys like physical keys to a filing cabinet system. Each application can have up to 14 keys (numbered 0-13).

Key #0: The Office Manager's Key

This is the master key that governs the following operations:

• Add or remove entire drawers (create/delete files).
• Cut new keys and change locks (modify key permissions).
• Reorganize the whole cabinet (security settings).

Keys 1-13: Desk Keys

These specific keys grant:

• Reading rights to certain folders.
• Writing privileges for specific document.
• Ledger access for adding/subtracting values.

Files: The Storage Containers

Each application can hold up to 32 files (numbered 0-31).

Here are the various types of files:

• Standard Files: Basic storage.
• Backup Files: Extra-safe storage.
• Value Files: For numbers that you can add to or subtract from.
• Linear Record Files: Stores entries in order by date.
• Cyclic Record Files: Replaces oldest entries when full.

Access Rights: The Locks on Each Container

Each file has its own set of locks that specify which keys can perform which actions.

When creating a file, you assign:

• Read Access: Which key number can view contents.
• Write Access: Which key number can modify contents.
• Change Rights Access: Which key number can change the locks.

Communication Mode

Plain: Human-readable data.

MAC'ed: Message Authentication Code to verify message integrity.

Encrypted: Scrambles all data for privacy.

Authentication Method

DES: An older encryption method.

3DES: Triple Data Encryption Standard.

AES (128-bit): Widely adopted strong encryption method.

Essential commands you'll need to interact with

Tier 1: PICC Level Commands

These commands operate at the card level:

• GetVersion: Retrieves manufacturing data.
• FreeMemory: How much memory storage is available.

Tier 2: Master Application Level Commands (AID 000000)

These commands manage applications:

• SelectApplication: Must select Master Application.
• GetApplicationIDs: Lists all applications.
• CreateApplication: Creates new applications.
• DeleteApplication: Removes applications.

Tier 3: Custom Application Level Commands (AIDs 000001-FFFFFF)

Commands for file operations include:

• GetFileIDs: Lists all files in the selected application.
• CreateStdDataFile: Creates standard files.
• ReadData: Reads from standard and backup files.

Sample MIFARE DESFire Application Structure

This is a simple example structure for a MIFARE DESFire card implementation.

Custom Application

Application 1: Access Control System

• Application ID (AID): F5 64 01
• Purpose: Physical door access for employees.
• Keys:
  • Key 00 (Master): Can create/delete files.
  • Key 1 (Write Access): Held by HR department.
  • Key 2 (Read Access): Held by door reader units.

Communication Settings

• Security Level: Encrypted communication with MACing.

Quick primer on Key Diversification

Key diversification protects against card cloning. This technique creates different keys for each DESFire card, making it impossible for attackers to derive every possible key.

Conclusion

Congrats! You have successfully learned the key concepts of MIFARE DESFire.