jekkos / android-hce-desfire Goto Github PK

Looking over your StackOverflow question, it is mentioned the major issue for emulating DESfire is the three flavours of the protocol: "native", "wrapped native" and "pure ISO7816", and that in order for an existing DESfire deployment to work, you'd need to talk one of the latter two protocols and send an ISO7816 SELECT APPLICATION first.

Since your post, there now are a small number of organisations which have rolled out support for DESFire on Android HCE using an SDK called "MIFARE 2GO". This finally gives an opportunity to discover what a real-world DESfire+HCE deployment looks like.

It looks like that these implementations have ISO7816 AIDs prefixed with A000000396 by convention.

There's two ways to get the "correct" AIDs for a particular deployment:

1. Log / sniff the SELECT APPLICATION commands from a "legitimate" reader, or,

2. Pull the Android manifest from a HCE application, and look for the AIDs in the manifest.

Once you've sent a SELECT APPLICATION, it appears that you can talk ISO7816-wrapped DESfire commands just fine.

If I understand the status of things correctly, this should mean that it's possible for this project to actually work, and emulate a card in the DESfire-recommended way.

It should also be possible to proxy card communication using two Android devices, provided that the reader unit supports connection with the ISO7816 SELECT APPLICATION command, one of your Android devices does HCE, and then just plumb the commands over the network.

I have been digging through DESFire specs and documentation (that which is descriptive and I can find publicly online). It appears that there are a couple of newer Authenticate commands that are at least supported by the DESFire light tag versions (see NXP application note):

CMD_AUTHENTICATE_EV2_FIRST = 0x71,          /* See page 32 of AN12343.pdf */
CMD_AUTHENTICATE_EV2_NONFIRST = 0x77,  /* See page 32 of AN12343.pdf */

I am trying to use Android's NFC stack built-ins to perform some testing with DESFire tags. I'm not sure if your HCE implementation works this in yet, but there is also some support of ISO7816-4 commands. These are documented near the end of the data sheet I "discovered" in issue #1.

@jekkos One thing you could help me with is to understand where the communication modes for transfer of data get encoded? I cannot seem to find a solid reference for where this assumption is made. Historically, there should be three (plaintext, 2KTDEA, 3KTDEA) and more recently there are AES communication modes in key sizes of 128/192/256. One possibility is to just attach the current communication mode to whatever the most recent Authenticate instruction uses, but that is probably not up to standard, and is somewhat arbitrary. How did you handle this in your HCE emulation?

Have a look at page 17 of this document. I think you might have missed an error code or two. Your site is great BTW! I'm using some of the compiled codes in your java files to try to do rudimentary apdu recognition in my app for the Chameleon Mini.

Keep up the good work!