MIFARE Classic Card

MIFARE Classic in brief

• Two memory sizes: 1K (S50, 16 sectors), the usual door, hotel and membership credential, is detailed on this page; 4K (S70, 40 sectors) is covered on the MIFARE Classic 4K card page.
• Current generation: Classic EV1, in both sizes. NXP marks it not recommended for new designs.
• Security: Crypto-1 is broken, and EV1 does not change that. Use Classic to match an installed system or as a convenience credential; for a new secure system choose MIFARE DESFire or MIFARE Plus.
• What we make: cards, key fobs, wristbands and stickers on genuine NXP MIFARE Classic EV1 chips (MF1S50 for 1K, MF1S70 for 4K), printed and delivered blank or encoded.

MIFARE Classic card specification

Chip figures come from NXP’s MIFARE Classic EV1 datasheets. Card material, printing and read distance are confirmed for your order and checked on a sample with your reader.

What a MIFARE Classic card is

A MIFARE Classic chip uses the ISO/IEC 14443 Type A air interface, parts 1 to 3, with its own Classic command set and Crypto-1 authentication instead of the ISO/IEC 14443-4 protocol layer that DESFire uses. Memory is a fixed grid of sectors and blocks, and each sector has its own pair of keys, so several applications can share one card under separate keys. Access-control, hotel and ticketing systems built on Classic accept a card only when the reader, its firmware and the card format all match, so confirm support for the exact system, not the frequency alone.

1K or 4K: how the two sizes compare

Commands, keys, Crypto-1 and the UID options are the same in both sizes, but a system may accept only the size it was built for. A door or hotel credential needs only a few blocks, so 1K is the usual order. When several applications or on-card records need more sectors, see when 4K memory is needed.

MIFARE Classic EV1 in 1K and 4K

NXP’s current Classic chips are the EV1 generation: MF1S50 for 1K and MF1S70 for 4K. They keep the Classic memory map and command set, so they work in existing Classic systems. NXP calls EV1 the highest evolution of the family, succeeding all previous versions, and credits it with great ESD robustness and highly efficient RF performance. Compared with NXP’s 2011 datasheets for the earlier MF1S50yyX and MF1S70yyX, EV1 adds three things:

• Hardened against the early card-only attacks. EV1 generates a truly random card nonce and no longer leaks keystream through an encrypted error code after a failed authentication, the two flaws behind the nested and darkside attacks. The cipher is unchanged, so the 2015 hardnested attack still recovers its keys (see the security section below).
• Load-modulation option. The card’s load-modulation strength can be switched from strong (the default) to normal where a reader system needs it.
• Originality check. The 1K EV1 supports NXP’s originality check; the 4K EV1 does not.

Carried over unchanged from the earlier chips: the choice of a 7-byte UID or a 4-byte NUID, with random ID and one-time UID personalisation on the 7-byte versions (explained in the next section), 200,000 write cycles typical (100,000 minimum), at least 10 years of data retention and an operating distance of up to 100 mm. NXP marks Classic EV1 as not recommended for new designs and names MIFARE DESFire Light as the alternative.

4-byte NUID or 7-byte UID

The identifier sits in block 0 of sector 0, the manufacturer block, which NXP programs and write-protects in production. Classic EV1 is ordered in one of two variants, and the choice matters to any system that enrols or looks up cards by their ID.

A 7-byte UID can surprise older software. In the first cascade level the card returns the cascade tag 88h and only the first three UID bytes, so a controller that stores only that first answer records a different number from the full UID. The 7-byte versions can instead be personalised to answer with a single-size random ID, or with a 4-byte NUID calculated from the 7-byte UID. The Personalize UID Usage command sets this once and then locks it, and NXP recommends sending it during personalisation even when the default is kept. Tell us which ID the system was built for, or send a working card, and test a sample in the real readers before a large order.

1K memory map: sectors, blocks and the sector trailer

A 1K chip is 16 sectors, each of 4 blocks of 16 bytes: 1024 bytes. The last block of every sector (block 3) is the sector trailer; the others hold data. Sector 0, block 0 is the manufacturer block with the UID and NXP data, programmed and write-protected in production. That leaves 47 data blocks, about 752 bytes. The 4K layout, with its eight large sectors, is set out on the MIFARE Classic 4K card page.

Two keys guard every sector: Key A and Key B, held in the trailer with the access bits (table below). The access bits decide, block by block, which key may read, write, increment or decrement. A common pattern gives field readers Key A for reading and keeps Key B, which can write, at the issuing station. Key A always reads back as zeros, and so does Key B unless the access bits make it readable, in which case it serves as data rather than a key. At delivery every key is FFFFFFFFFFFF and the access bytes are FF0780, the transport configuration; Key B is readable in that state, so a new card is authenticated with Key A. The chip checks the access-bit format on every access and irreversibly blocks the whole sector if the format is wrong, so write trailers with a tested script.

A value block holds a signed 4-byte value in a redundant format that allows error detection and backup management, and supports increment, decrement, restore and transfer. That is how closed-loop purses and counters were built on Classic. None of this structure is secret: the protection rests entirely on the sector keys and the cipher.

Security: Crypto-1 is broken, including on EV1

Classic protects its sectors with Crypto-1, a proprietary stream cipher with 48-bit keys, run in a three-pass mutual authentication before any block can be read or written. NXP never published it. In December 2007 Karsten Nohl and Henryk Plötz presented a partial reverse-engineering from the silicon, and in 2008 researchers at Radboud University Nijmegen completed it and published practical key-recovery attacks. The card-only attacks that followed, nested and darkside, used two implementation flaws: a predictable card nonce and an encrypted error code after a failed authentication.

Classic EV1 and other “hardened” cards remove those two flaws without breaking compatibility with Classic readers. They do not change the cipher. In 2015 Carlo Meijer and Roel Verdult published the hardnested attack, which uses a parity-bit leak built into the Classic protocol, needs one known key (unused sectors often keep a default key) and recovered a key from a hardened card in about five minutes on one laptop core, with consumer-grade hardware. Their conclusion: every Classic-compatible card should be treated as a plain memory card.

The consequence is permanent. Once one sector key is known, which Meijer and Verdult found is almost always the case in practice, anyone with a few minutes of access to a Classic card, EV1 included, can recover its other sector keys, read it in full and copy its contents, and no firmware change fixes Crypto-1. Treat MIFARE Classic, EV1 included, as a convenience credential, not a security one: fine when the card only identifies a holder that a back-end checks, not suitable as the only protection for stored value, doors that must resist cloning, or personal data. For security-relevant applications NXP itself refers customers to MIFARE DESFire and MIFARE Plus.

Where an installed base keeps a system on Classic for now, these measures limit the damage without making the card secure:

• Diversify keys per card. Derive each card's sector keys from its UID and a master key held in a secure module, so a recovered key unlocks one card rather than the whole fleet.
• Verify at the back-end, not on the card. Treat the card as an identifier and check entitlements, validity and location server-side; a UID or sector value on its own proves nothing because UID-writable clone cards exist.
• Watch for anomalies. Flag the same identifier appearing in two places within an impossible travel window, or repeated authentication failures, to turn unlimited cloning into a handful of detectable incidents.
• Plan the migration. Move to MIFARE Plus, which can run in today's Classic readers in security level 1 and switch to AES in security level 3 as the readers are upgraded (in SL1 it still uses Crypto-1, so the security gain comes with SL3), or to MIFARE DESFire for a new secure system.

Classic remains the right order when the installed readers and locks are Classic-only, or when the card only carries an identifier that the back-end verifies and cloning risk is low: most hotel keys, gym memberships, visitor badges and event credentials.

“MIFARE-compatible” chips, and why we use NXP EV1

MIFARE Classic is an NXP product, but compatible chips from other makers, most commonly Fudan’s FM11RF08 family, implement the ISO/IEC 14443-3A layer and the Crypto-1 commands closely enough to work in many Classic readers, and a reader that checks only the ATQA and SAK may not tell them apart. They are not the same chip. In August 2024 Philippe Teuwen of Quarkslab published a hardware backdoor key in the Fudan FM11RF08S, and an older backdoor key shared by Fudan FM11RF08 and FM11RF32 chips and by old Philips (now NXP) MF1ICS5003 and MF1ICS5004 chips made around 1998 to 2001 and Infineon SLE66R35 cards. With such a key, all sector keys can be recovered in minutes even when they are diversified. He found the Fudan cards in hotels in the US, Europe and India; the NXP Classic EV1 samples he tested rejected the undocumented commands.

This research is one reason we build every MIFARE Classic card, fob, wristband and sticker on a genuine NXP MIFARE Classic EV1 chip, MF1S50 or MF1S70, and do not offer a Fudan or other “MIFARE-compatible” chip as a Classic option. Wherever you buy, specify the exact chip on the purchase order, for example “NXP MIFARE Classic EV1 1K, MF1S50, 7-byte UID” rather than “MIFARE-compatible 1K”, and test a sample in the actual readers and locks before a bulk order. A part that authenticates in a bench reader can still be rejected by an access system that fingerprints its cards, and a UID-writable clone must be treated as a cloning threat by any system that whitelists cards by UID. Specifying NXP EV1 avoids the chip families in which these backdoor keys were found; it does not fix the Crypto-1 weakness described above.

The MIFARE family at a glance

MIFARE is a family of chips, not one product, and “MIFARE” on a specification does not tell a reader which member is meant. The table sets Classic against its relatives so you can match the card to what the system actually needs; a chip named in your integrator’s specification always wins over this summary.

Reading Classic cards with phones and readers

• Access readers and locks: look for explicit MIFARE Classic support, the required UID length and the system's encoding format. ‘MIFARE’ names a family and does not by itself confirm Classic support. Reading a UID and authenticating to sector data are different capabilities.
• Android phones: MifareClassic support is hardware-dependent and optional. Check the exact phone and app, and provide the correct sector keys for protected data operations.
• iPhones: do not choose Classic for an application that needs to read or write sector data through Core NFC. For phone-facing NDEF content, consider an NFC Forum tag such as those in our NFC stickers and test the intended phone and app.
• Desktop reader/writers: the ACR122U lists MIFARE Classic support through PC/SC commands; the µFR Classic CS offers Classic operations through its SDK. PC/SC is a host interface, so check card-specific commands and software support as well as the reader model.

Card formats and materials

• Standard ID-1 card: 85.6 × 54 mm, 0.76 to 0.84 mm thick, in PVC, recycled PVC, PET-G or polycarbonate; the format for staff badges, membership and hotel keys.
• Thin and paper cards: 0.3 to 0.5 mm PVC or coated paper for disposable tickets and event passes; see our RFID paper card.
• Wood and bamboo cards: a wood or bamboo body in place of PVC; see the wooden RFID card.
• Key fobs, wristbands and stickers: the same S50 or S70 chip in ABS fobs, silicone or fabric wristbands and MIFARE stickers.
• Combi cards: a Classic chip and a 125 kHz or UHF chip in one card body, each read by its own system; see the combi card. A dual-interface card is a different product: one chip reached through both a contact pad and an antenna.

Printing and personalisation

• Printing: offset CMYK, Pantone spot colours, silk-screen, UV and digital printing on both sides; matte, glossy or frosted finish; metallic and holographic backgrounds.
• Variable data: printed or laser-engraved numbering, barcodes, QR codes, names and photo ID from your data file. When the UID or an assigned number is printed on each card, you receive an Excel, CSV or XML file that pairs every card's UID with its printed number.
• Additional features: HiCo or LoCo magnetic stripe, signature panel, scratch-off panel, slot punch, embossing.
• Encoding: blank in the transport configuration, or written with your sector data through our RFID encoding service. Each card we encode is read back afterwards, and a data report is shipped with every encoded order. Loading your own sector keys is confirmed in the quotation: agree any key handover separately and never send keys in an enquiry. Encoding is done only for the organisation that administers the system.

Where MIFARE Classic cards are used

• Access control: staff and resident badges for offices, apartments and car parks; see RFID key fobs for access control.
• Hotels: hotel key cards for the many lock systems built on Classic 1K; guide at hotel key cards.
• Membership and loyalty: gyms, clubs, libraries and campus cards.
• Transport and events: single-ride and season tickets, event passes and cashless festival wristbands.
• Payment and canteen: closed-loop purses on Classic value blocks in older systems; plan new ones on MIFARE Plus or DESFire.

Before you order

1. Chip: 1K (S50) or 4K (S70), and 4-byte NUID or 7-byte UID, as stated by your integrator or lock vendor; send a working card if the specification is unclear.
2. Format and material: standard PVC card, thin card, wood, fob, wristband or sticker.
3. Artwork, finish and any variable data, magnetic stripe or signature panel.
4. Encoding and numbering: blank, printed with the UID or a number, or written with your sector data (loading your own keys is confirmed in the quotation).
5. Quantity and delivery date; samples are available for reader and lock testing.

What Proud Tek manufactures

We manufacture MIFARE Classic cards, fobs, wristbands and stickers with genuine NXP MIFARE Classic EV1 chips, printed and personalised to your specification. We do not supply access-control readers, locks or software, and we do not duplicate cards from systems the buyer does not administer. If your system is due for a security upgrade, compare the MIFARE Plus card and MIFARE DESFire cards, or see all our RFID cards.

Technical reference: NXP MIFARE Classic EV1 1K datasheet and MIFARE Classic product page. Chip documentation describes IC capabilities; it does not establish stock or a finished card’s compatibility with your system.