ISO-IEC 14443 Type A&B summary

Posted 2022-03-19 scruffybear

• Summary
• ISO-IEC 14443-3 Type A
  • REQA and ATQA
  • UID and bit frame anticollision
  • FDT
• ISO-IEC 14443-3 Type B
  • REQBWUPB Command
  • ATQB Answer To Request command
  • ATTRIB command
• ISO-IEC 14443-4
  • R-block
  • I-Block
  • S-block
• Reference

Summary

ISO-IEC 14443 is the specification about contactless cards communication with the card reader, the most important part is Part 3: Initialization and anticollision. Recently worked on it, and a few summary points.

ISO-IEC 14443-3 Type A

REQA and ATQA

PCD (Card reader) send REQA (Request Command) or WUPA (Wake-UP Command), PICC (Card) send back ATQA (Answer To Request). ATQA has two bytes, b8 b7 means UID size, for example ATQA is 0403, b8b7 is 00, as single UID size

b8	b7	Meaning
0	0	UID size: single
0	1	UID size: double
1	0	UID size: triple
1	1	RFU

UID and bit frame anticollision

14443-3 Type A use UID (Unique Identifier) and bit frame to do the anticollision. Anticollsion means multiple CL cards existing in the RF field, card reader will use anticolission mechanism to choose one card.
PCD send anticollision command SEL, for example, 0x93 0x20
SEL is 0x93 (cascade level 1)
NVB is 0x20 (byte count = 2, bit count = 0)
PICC response Anticollision response, for example: 0xD0 0x01 0x64 0x81 0x10, UID0~UID3 = 0xD0 0x01 0x64 0x81, BCC = 0x10
At this point, anticolission happened, for anti-collision PCD sent: 0x 93, 0x52, 0xD0 0x01 0x64 0x03
The PICC transmitted anticollison frame 0x20 0x36(BCC), here 0x81 split into bit frame, PCD sent lowest two bit as 0x03 (bit 00000011), and 0x81 remove the lowest two bits, it is bit 100000, as 0x20. Below screenshot shows the anticollision procedure.
ProxiSPY capture:

UID:

Anticollision response:

FDT

FDT (Frame Delay Time) is the time interval between the frames, defined as the time between two frames transmitted in opposite directions.
FDT of PCD to PICC is more important, as PICC have to respect the timing of FDT after PCD finished transmitting.
Refer to the table in ISO14443-3 FDT formula,

FDT should be 86,03 - 86,83us(86.43 +- 0.4), if the last bit is 0; or 90,75-91.55us,if the last bit is 1
This Anticollision command FDT is 86.43 = 1172 / fc = 1172 / 13.56 = 86.43 us
As below screenshot shows, FDT between Anticollision and Anticollision response, value as 86.242 us.

ISO-IEC 14443-3 Type B

REQB/WUPB Command

For example: WUPB, 0x05 0x00 0x08 0x39 0x37
APf (Anticollision Prefix) = 0x05
AFI (Application Family Identifier) = 0x00, When AFI equals 0x00, all PICCs shall process the REQB/WUPB.
PARAM (REQB/WUPB Parameter) = 0x08, The number of slots N is 1, b3b2b1=000
CRC_B = 0x39 0x37

ATQB (Answer To Request) command

Example: 50FFFFFFFF000000007781E309D0
PUPI is 0xFF 0xFF 0xFF 0xFF
Application data field is 0x00000000
1st byte of Protocol Info is 0x77 (bit rate capability = 0x77), Different bit rates for each direction is supported, support 212/424/847 kbps bit rate from PCD to PICC.
2nd byte of Protocol Info is 0x81 (PICC maximum frame size code = 8, minimum TR2 coding = 0, protocol type = 1)
3rd byte of Protocol Info is 0xE3 (ADC = 0, FO = 3, FWI = 14)
CRC_B = 09D0

ATTRIB command

Example: 1DFFFFFFFF00A8010090E7
Identifier is 0xFF 0xFF 0xFF 0xFF
PARAM1 is 0x00 (minimum TR0 = 0, minimum TR1 = 0, EOF = 0, SOF = 0)
PARAM2 is 0xA8 (maximum PCD frame size code = 8, selected DRI = 2, selected DSI = 2), b6b5=10, PCD to PICC, bit rate is 424 kbps, b8b7=10, PICC to PCD, bit rate is 424 kbps
PARAM3 is 0x01 (protocol type = 1), PICC compliant with ISO/IEC 14443-4
PARAM4 is 0x00 (CID = 0)
CRC_B = 90E7

ISO-IEC 14443-4

After the ISO14443-3 processed, will pass the control to the higher layer protocol as ISO14443-4,

R-block

R-block is Receive ready block, example: BA0059C8
PCB (Protocol Control Byte), PCB is 0xBA (NAK, CID following, block number 0) CID is 0x00, The CID field is used to identify a specific PICC.
EDC (Error Detection Code), as 59C8

I-Block

I-Block is Information block.
example: PCD send to card: 0084000008
0A000084000008ED86
PCB is 0x0A (CID following, NAD not following, block number 0)
CID is 0x00
Information field (INF) contains 5 bytes: 0084000008
EDC is 0xB6ED
Card (PICC) return to PCD, 0A006A3180D92F270B91900030D7
PCB is 0x0A (CID following, NAD not following, block number 0)
CID is 0x00
Information field (INF) contains 10 bytes:6A3180D92F270B919000
EDC is 0x7D30

S-block

S-block is Supervisory block
example: CA009D38
PCB is 0xCA (type DESELECT, CID following)
CID is 0x00
EDC is 0x389D

Reference

Wiki ISO/IEC 14443

---