What The Access Bits In The MIFARE Classic Card Mean
Source: http://cache.nxp.com/documents/data_sheet/MF1S50YYX_V1.pdf
Example: SwissPass AC are set to 7F 07 88 00 for all sectors.
As bits:
| hex | binary |
|---|---|
| 7F | 0b01111111 |
| 07 | 0b00000111 |
| 88 | 0b10001000 |
The subscripts in the following table stand for which block they regard.
| C from byte6 | value |
|---|---|
| 1 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 | |
| 0 |
| C from the first half of byte8 | value |
|---|---|
| 1 | |
| 0 | |
| 0 | |
| 0 |
The other bits are redundant.
Sorted by blocks, we get this:
| Block | |||
|---|---|---|---|
| 0 | 0 | 0 | 1 |
| 1 | 0 | 0 | 0 |
| 2 | 0 | 0 | 0 |
| 3 (sector trailer) | 0 | 1 | 1 |
Manufacturer block: the read-only condition is not affected by the access bits setting!
So for the first sector, block 0 is read-only. For the other sectors, it can be read by both keys and not written to, but it can be decremented.
Blocks 1 and 2 can be read to and written to with both keys.
The sector trailer (block 3) has its own table:
So the keyA can be written by keyB. KeyB can also be written by keyB.
Reading the keys is officially not possible, but there are attacks available for that.
The Access Conditions can be read with both keys but can be modified only with keyB.