This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

Selecting ISO14443A card using TRF7970A

Other Parts Discussed in Thread: TRF7970A

I am using the TRF7970A EVM to Select a ISO14443A card. The procedure I follow is the below:

1. Set the protocol for ISO14443A in the TRF7970A

2. Do an anticollission sequence to get the UID of the card. In my case I get the 4 byte UID

3. Send this UID and do a SELECt command, with nvb 0x70. Here the card should respond with an SAK. Instead I get 3 bytes in the buffer which are 0x28, 0xB4, 0xFC

What are the above 3 bytes and which is the SAK byte?

After this I want to issue an RATS, so as to select the card and activate the application layer. I am stuck at the 3 bytes above which are issued.

  • Royston - 

    the 0xB4, 0xFC is the CRC16 of the byte 0x28 (which must be your SAK)

    the 0x28 indicates that the UID is now complete and the card is compliant to ISO14443-4, according to the ISO14443-3 standard. 

    if you want just the SAK, then right before you issue the SELECT command, change the ISO control register to 0x08 and then send out the command with 0x8F, 0x91, 0x3D, 0x00, 0x70, 0x93, 0x70, + UIDCLn

    then you can send your RATS command (ie 0xE0, 0x80)

  • Thank you Josh for your response. Indeed 0x28 is the SAK as I am using a JCOP card. However when I use the WinXP GUI for the EVM, the RATS command does not get highlighted even if the card is returning the SAK.

    I will now issue RATS 0xe0, 0x80 manually through the firmware.

    Could you point me to some information about the APDU communication, probably some commands to issue.

    I am a newbie with the smart card technology, but am conversant with TRF7970A. 

    Thank you once again for your support.

  • After RATS, you can issue ISO7816-4 Application Select APDU, then other APDUs if you have them

    one example (for MasterCard JCOP) - that works with a card i have here is: 

    02 00 A4 04 00 0E 32 50 41 59 2E 53 59 53 2E 44 44 46 30 31 00

  • Dear Josh,

    You have given an apdu as below:

    02 00 A4 04 00 0E 32 50 41 59 2E 53 59 53 2E 44 44 46 30 31 00

    As I understand 

    00 A4 04 00 0E 32 50 41 59 2E 53 59 53 2E 44 44 46 30 31 00 is the APDU

    What is the 0x02 byte at the beginning specify. I sometimes see this byte as 0x03 in some of the APDU commands on the net

     

    Thanks
    Royston

  • 0x02, 0x03, 0x0A, 0x0B...this is the Protocol Control Byte (called PCB), comes from ISO14443-4, in the Prologue field, indicates if the block is I, R or S, and if chaining is being used. 

  • Dear Josh,

    Thank you for all the support so far.

    I have received some information from the developer who issued these cards. He mentions the following:

    you don't need to select the Applet. The application installed on the Smart Card in your hand is default selected.

    You will find attached the source code of Android APDU applet.

    As I understand he mentions there is no special SELECT command to be issued and the applet is default selected. In the android app he has developed he is issuing the following command:

    00 88 00 04 08 11 22 33 44 11 22 33 44 (in hex)

    and the card replies the following

    af 57 e0 9c 64 fe fa 79 90 00 (in hex)8611.SourceCode_App_APDU.TXT

    I am also attaching the android source for reference if it helps. I need to send the APDU as above and get the response using the TRF7970AEVM. So far I have suceeded to get a reply to the RATS command. Any idea what is happening here and any suggested future steps

    Your help is highly appreciated.

    Thanks in advance

    Royston

    5340.SourceCode_App_APDU.TXT

  • this (the use of 0x88 as the INS), in the string 00 88 00 04 08 11 22 33 44 11 22 33 44 (in hex) must be from ISO7816-4, which lists this as INTERNAL AUTHENTICATE.

    so to send this out with the TRF7970A, the command would be formatted like so (below), and the PCB would be 0x02 if this was first command sequence issued after ATS response (which is end of selection process in ISO14443A)

    8F 91 3D 00 E0 02 00 88 00 04 08 11 22 33 44 11 22 33 44, where 

    8F ==> Reset FIFO

    91 ==> send with CRC

    3D ==> write cont. 

    00, E0  ==> 14 bytes going out)

    02 ==> PCB (could be 0x03 if this is not first layer 4 command)

    00 ==> CLA

    88 ==> INS

    00 04 ==> P1, P2

    08 ==> Lc

    11 22 33 44 11 22 33 44 ==> Data Field (most likely a default key of some type)

  • Dear Josh,

    Thank you for your response, but since I am expecting a response of data from the card, as shown in the app image above...Should the APDU command also consist of the Le field....(expected bytes)

    Sorry for my naive questions, but I am beginner on smart cards.

    Regards

    Royston

  • could be but you now know the form to use to get communication out and you can get a copy of ISO7816-4, too. 

    what kind of card is this? did you implement this already and get back a error code? do you have any further documentation on the card? this is what will give you the answers you need now. if you need help deciphering them - let us know. 

  • Hi Josh,

    I have the following setup working

    The card in use is the JCOP Card from NXP

    After getting the UID using the anticollision sequence I send a Select Command.

    Then I issue the
    RATS command: 8F,91,3D,00,20,E0,70
    Reply from Card recieved in buf: 0D,78,80,70,02,00,73,C8,40,00,00,90,00

    Then I issue
    SELECT MF apdu: 8F,91,3D,00,90,0A,00,00,A4,00,00,02,3F,00
    Reply from Card recieved in buf: 0A,00,6F,15,81,02,46,5E,82,01,10,83,02,3F,00,86,08,FF,00,00,00,FF,00,00,00,90,00

    Then I issue
    Internal Authenticate APDU: 8F,91,3D,00,F0,0A,00,00,88,00,04,08,05,EF,D1,E7,56,4F,70,A1

    For this command I receive no response, infact I don't receive any interrupt from TRF7970A after sending this command (I only get the TX interrupt signalling these bytes are transmitted) but no other interrupts after that

    Even if I redo an anticollision or RATS or SELECT MF again, I get no reply from the card i.e. no interrupt from the TRF7970A. If I remove the card from the antenna field and again present it to the reader, I get responses and the above step repeats and again the card stops responding after the select MF apdu.

    Any idea what could be happening here

    Thank you for your support

    Regards
    Royston
  • Royston - 

    toggling the PCB I think would be step one. you send 0x0A twice in a row...i would expect 0x02, then 0x03 or in your case 0x0A, then 0x0B there

    the card i have here responds to both commands you sent over (although the second one it gives me back ISO7816-4 error code, it still responds)

  • Dear Josh,

    Thanks, that worked just by changing the PCB.
    I now get the reply from Card after the

    internal authenticate command as: FA,00,01

    What is this. The expected response should have been

    XX, 00,6A,8A,15,DB,8F,1B,B4,35,90,00

    (I dont know what the XX should be, but the remaining byte should've been that)

    Thanks
    Royston
  • XX (if that is what is printed in a document you are looking at as an example) is probably the PCB of the card response, which should match the command sent...it would be listed as XX, since it could be a 0x02, a 0x03, 0x0A or 0x0B for example depending on what you have sent before that. Do you have a copy of ISO14443-4 and ISO7816-4? if not, with the level you are involved here,those docs would be highly recommended reading. :)

  • Dear Josh,

    To be honest, I do have the copy but have not read it in details. Its too big a specification to digest. Our entire product is stuck just at this last level of integration wherein after internal authenticate I just need to do a DES on the data recieved and thats it.

    I would be grateful if you could support just in this last leg of development, even if there is a way I can get commercial support from TI or one of your channel partners it would be great.

    The commands which I refer to are from a tool (M210-2G from Inside Contactless) being used to carry out transactions over a serial UART.

    I have the following sniffed data which I use for moving ahead

    SendCommandIsoOut = $80 $A4 $00 $08 $10
    $9000 : Command successful DataOut = $03$4F$36$2B$B9$00$00$00$00$00$00$00
    SendCommandIsoInOutReal = $80 $C2 $F7 $20 $02 DataIn = $E0$70 $9000 : Command successful DataOut = $0D$78$80$70$02$00$73$C8$40$00$00$90$00$A6$1F$00$00$00$00$00$00$00$00$00$00$00$00$00$00$00$00$00
    SendCommandIsoOut = $80 $C0 $00 $00 $20
    $9000 : Command successful DataOut =
    $0D$78$80$70$02$00$73$C8$40$00$00$90$00$A6$1F$00$00$00$00$00$00$00$00$00$00$00$00$00$00$00$00$00
    SendCommandIsoInOutReal = $80 $C2 $F7 $06 $09 DataIn = $0A$00$00$A4$00$00$02$3F$00 SendCommandIsoInOutReal = $80 $C2 $B7 $80 $02 DataIn = $BA$00 $9000 : Command successful DataOut = $0A$00$6F$15$81$02$46$5E$82$01$10$83$02$3F$00$86$08$FF$00$00$00$FF$00$00$00$90$00$98$D0

    Looking forward to receiving a favorable response

    Regards
    Royston
  • Royston -
    i was not suggesting that you read those docs and that be it....:) of course we will support you, but its not 100% clear what you need from us.

    if i take the $'s out of what you sent over i get this...looks incomplete - so just let me know what you are needing, i will try to help

    SendCommandIsoOut = 80A40008109000 : Command successful
    DataOut = 034F362BB900000000000000
    SendCommandIsoInOutReal = 80C2F72002
    DataIn = E0709000 : Command successful
    DataOut = 0D788070020073C84000009000A61F0000000000000000000000000000000000
    SendCommandIsoOut = 80C0000020
    $9000 : Command successful
    DataOut = 0D788070020073C84000009000A61F0000000000000000000000000000000000
    SendCommandIsoInOutReal = 80C2F70609
    DataIn = 0A0000A40000023F00
    SendCommandIsoInOutReal = 80C2B78002
    DataIn = BA009000 : Command successful
    DataOut = 0A006F158102465E82011083023F008608FF000000FF000000900098D0