MIFARE Ultralight RFID Card

Q: What is MIFARE Ultralight®?
A: MIFARE Ultralight® is NXP Semiconductors’ series of passive, contactless RFID chips/cards compliant with ISO/IEC 14443 Type A.

Q: What is the memory size/capacity of MIFARE Ultralight® cards?
A: Memory varies by model:

• EV1: 48 or 128 bytes user memory.
• C & AES: Typically 144 bytes user memory.

Q: What is the operating frequency of MIFARE Ultralight® cards?
A: MIFARE Ultralight® cards operate at 13.56 MHz, a standard HF RFID frequency.

Q: What standards do MIFARE Ultralight® cards support?
A: They primarily support:

• ISO/IEC 14443 Type A
• NFC Forum Type 2 Tag

Q: What is the UID length/format of MIFARE Ultralight® cards?
A: Modern MIFARE Ultralight® cards (EV1, C, AES) typically feature a 7-byte Unique Identifier (UID).

Q: What is the read range of MIFARE Ultralight® cards?
A: The typical read range is up to 10 cm (approx. 4 inches), varying with reader performance, antenna design, and environment.

Q: Where can I download the datasheet/specification sheet for MIFARE Ultralight® cards?
A: Official datasheets are available on the NXP Semiconductors website. Search by chip model (e.g., MF0UL11, MF0ULC1) for the latest documents.

Q: Are MIFARE Ultralight® cards secure?
A: Security varies by model. EV1 offers basic protection. Ultralight C provides medium security (3DES), and Ultralight AES offers the highest (AES-128). Overall system design, including key management, is also crucial for security.

Q: What encryption method does MIFARE Ultralight® C use?
A: MIFARE Ultralight® C uses the 3DES (Triple Data Encryption Standard) algorithm for authentication to protect data access.

Q: How strong is the encryption in MIFARE Ultralight® AES?
A: MIFARE Ultralight® AES uses AES-128 (128-bit key) for authentication and data protection. AES is a globally recognized strong encryption standard. It also supports CMAC for data integrity and authenticity.

Q: How can MIFARE Ultralight® cards be protected against hacking?
A: Employ a multi-layered approach:

• Choose appropriate models (e.g., AES for high security).
• Implement secure key management.
• Utilize all available card security features (passwords, authentication, encryption, page locks).
• Validate data and transactions on backend systems.
• Conduct regular security audits.

Q: How is password protection set on MIFARE Ultralight® cards?
A: MIFARE Ultralight® EV1 supports a 32-bit password set via specific write commands, protecting designated memory pages. Access then requires successful authentication. Ultralight C and AES primarily use cryptographic authentication.

Q: If a MIFARE Ultralight® C card has no password set (or 3DES authentication is not actively used), are there other security measures to prevent cloning?
A: Without active 3DES authentication, Ultralight C’s cloning resistance is significantly reduced. While its UID is unique, data can be copied. True security relies on enforced 3DES and robust backend validation (e.g., blacklisting).

Q: What are the differences between MIFARE Ultralight® C, EV1, and AES models?
A: Key differences are in security and features:

• EV1: Basic model with optional 32-bit password protection; for cost-sensitive, low-security needs. Features OTP and lock bits.
• C: Adds 3DES cryptographic authentication for higher security than EV1.
• AES: Most secure, with AES-128 authentication and CMAC; Common Criteria EAL3+ certified.

Q: Which MIFARE Ultralight® model should I choose?
A: Select based on your application’s budget and security requirements:

• MIFARE Ultralight® EV1: For lowest cost and basic security needs (e.g., disposable tickets, simple promotions).
• MIFARE Ultralight® C: For moderate security (3DES) on a limited budget (e.g., multi-use transit cards, loyalty programs).
• MIFARE Ultralight® AES: For high-security applications requiring strong AES encryption (e.g., secure access control, micro-payments).

Q: Are MIFARE Ultralight® C cards secure enough for hotel key systems, and how do they compare to MIFARE Classic® 1K?
A: MIFARE Ultralight® C (3DES) suits low-to-medium security hotel keys. MIFARE Classic® 1K has more memory, but its CRYPTO1 security is outdated and vulnerable. For higher security, consider MIFARE DESFire® or MIFARE Ultralight® AES with robust system design. Ultralight C provides standard 3DES but has less memory than Classic 1K.

Q: Can MIFARE Ultralight® cards be copied/cloned?
A: It depends on the model and security used:

• EV1 (unprotected/password compromised): Data is relatively easy to clone. UID is fixed, but data can be copied to another EV1 or a “magic card.”
• C/AES (authentication unused/keys compromised): Data can be cloned.
• C/AES (authentication properly used): Cloning is difficult without keys.
• “Magic Cards”: Special non-official cards exist that allow UID and data cloning.

Q: What security features on MIFARE Ultralight® cards prevent cloning? Can password-protected cards be copied?
A:

• Nano/EV1: Rely on OTP bits and lockable pages. Clonable at data level without backend checks.
• C/AES: Use 3DES/AES-128 authentication. Difficult to clone if keys are secure.
• Password-protected cards: Data is hard to copy if password/key is secure. If compromised, data can be copied.

Q: Is it possible to change the UID of a MIFARE Ultralight® card?
A: Standard MIFARE Ultralight® cards have a fixed, unchangeable UID. However, “magic cards” (UID writable cards) exist that allow UID modification with special tools, though many systems can detect these.

Q: How can I set the UID of a MIFARE Ultralight® magic tag using libnfc and a PN532 reader?
A: Use libnfc command-line tools (e.g., `nfc-mfultralight` or variants) with a PN532 to write a new UID to a UID-writable “magic” tag. This typically involves special commands. Note: UID modification may violate system terms and modified UIDs may be blocked.

Q: Why can’t I clone a MIFARE Ultralight® tag using NFC Tools, even though it’s not password-protected?
A: NFC Tools might fail due to:

• Incompatible tag formats or write restrictions on the target tag.
• Limitations of the phone’s NFC reader for low-level operations.
• Backend system validation that detects cloned data.
• Functional limitations within NFC Tools itself.

Q: How do I read and write MIFARE Ultralight® cards?
A: Use an ISO/IEC 14443A compatible RFID reader/writer.

Q: What devices/readers can be used to read/write MIFARE Ultralight® cards?
A: Options include:

• USB Readers (e.g., ACR122U, PN532-based devices).
• Embedded Modules (e.g., RC522, PN532 for DIY projects).
• Some NFC-enabled Smartphones (can read as Type 2 tags, limited write via apps).
• Professional Handheld Terminals/Access Control Readers.

Q: How can I lock pages on a MIFARE Ultralight® card?
A: Use “Lock Bits.” Writing ‘1’ to a lock bit permanently makes corresponding memory pages or features read-only. This is irreversible.

Q: How can I copy data from one MIFARE Ultralight® card to another tag, and why might it fail?
A: Use an RFID writer to read from source and write to target. Failures can occur due to:

• Target tag incompatibility or insufficient memory.
• Source card protection (password/authentication) without correct keys.
• Target pages being locked read-only.
• Backend security blocking cloned data/UIDs.

Q: Where can MIFARE Ultralight® cards be used?
A: Common uses include:

• Public transport/event ticketing.
• Loyalty cards/membership programs.
• Amusement park passes.
• Simple library cards.
• Small-value prepaid applications.
• NFC tags for product ID/anti-counterfeiting.
• Low-security access control.

Q: Are MIFARE Ultralight® cards suitable for transit cards/tickets?
A: Yes, EV1 and C models are well-suited for low-cost, single or limited-use transit/event tickets due to fast transactions and sufficient memory for essential data.

Q: Can these cards be used for a mini-library system with student cards and book tags?
A: Yes, EV1 or C models suit mini-library systems for student IDs and book tracking, offering adequate memory and security for low-risk environments.

Q: Are these cards suitable for payment systems at events or on cruises?
A: Ultralight C (3DES) and AES (AES-128) can securely store credits/IDs for closed-loop payment systems. EV1/Nano have limited security for payment applications.

Q: Can I use a MIFARE Ultralight® card for underground parking access, like with a smartwatch?
A: Yes, EV1 or C models can work for low-security parking. Smartwatch compatibility depends on its NFC support and system protocols; direct emulation without specific apps is limited.

Q: What are MIFARE Ultralight® hotel key card solutions like?
A: Ultralight C or AES can be used. Systems involve:

• An encoder (front desk) to write room data (possibly encrypted).
• Door lock readers to verify card access.
• Management software for card administration.

AES version offers higher security.

Q: How are MIFARE Ultralight® cards used in access control systems?
A: Suitable for low-security access (internal areas, lockers). For higher security (main entrances), MIFARE DESFire® or properly implemented MIFARE Ultralight® AES with backend validation is better.

Q: Are MIFARE Ultralight® cards compatible with all NFC-enabled devices, like smartphones?
A: As NFC Forum Type 2 compliant tags, they are broadly compatible with NFC smartphones for reading/writing NDEF data. App and device NFC capabilities determine further compatibility.

Q: Can I use a MIFARE Ultralight® card as a replacement for a MIFARE Classic® card in a specific system?
A: Generally no, due to differences in memory, security, and protocols. Systems designed for MIFARE Classic® usually won’t work with Ultralight® without modification.

Q: Can I write a MIFARE Ultralight® UID onto a MIFARE Classic® card with a writable sector 0?
A: No, their different structures and protocols make direct UID transfer incompatible. System reconfiguration or emulation might be needed.

Q: Does the Flipper Zero support reading or cloning MIFARE Ultralight® C cards?
A: Yes, Flipper Zero can read/clone unprotected MIFARE Ultralight® C cards. Cloning authenticated cards requires the key; Flipper Zero might attempt brute-force on weak keys, but this is often impractical.

Q: What should I do if my MIFARE Ultralight® card cannot be read?
A: Check for:

• Correct card positioning and distance from the reader.
• Interference from metal or other RFID devices.
• Reader power, connection, and driver issues.
• Physical card damage (try another card).
• Reader compatibility with MIFARE Ultralight®.

Q: What causes read/write errors with MIFARE Ultralight® cards?
A: Common causes:

• Unstable communication (card moved too quickly).
• Incorrect data format or commands.
• Attempting to write to a locked (read-only) memory page.
• Authentication failure for protected pages (EV1 password, C/AES authentication).
• Card nearing end of write cycle life (rare).

Q: How can a locked MIFARE Ultralight® card be unlocked?
A:

• Memory Page Lock (via Lock Bits): Usually permanent and irreversible.
• Password/Key Lock: If password/key is forgotten and no backup exists, access is very difficult. Tools might brute-force weak passwords but success is not guaranteed. Professional services may be needed.