Understanding smart card technology, what separates a secure credential from a compromised one, and why MIFARE DESFire® is the specification that matters.
Published by PPC ID Solutions – Technology & Security
If your access control system is not running on DESFire®, this article explains why that should change and what the risks of the alternatives really are.
Walk into almost any security integrator, card bureau, or ID supplier and you will see MIFARE® listed on the spec sheet. It has become shorthand for contactless smart card technology. However, this is what that label alone does not tell you: MIFARE® is a chip technology, not a card. More importantly, within that family, there is a profound difference between the legacy platforms still widely sold and the modern, cryptographically robust specification your systems should be running.
This article explains how MIFARE® technology actually works, who makes what, why MIFARE DESFire® represents a fundamentally different level of security, and why the manufacturing process behind the card body matters just as much as the chip inside it.
MIFARE® is a registered trademark of NXP Semiconductors, one of the world’s leading producers of secure identification chips.[1] NXP designs and manufactures the integrated circuit — the chip — at the heart of every genuine MIFARE® credential. NXP does not manufacture finished cards. Card manufacturers source NXP chips and build the complete credential around them.
MIFARE Classic® uses a proprietary security mechanism called Crypto-1. Since 2008, researchers have publicly broken Crypto-1, documenting the attacks in peer-reviewed academic literature and releasing exploit tools.
MIFARE Classic® credentials can be cloned in seconds using widely available, low-cost equipment. Systems relying solely on MIFARE Classic® UID-based authentication provide no meaningful cryptographic security. NXP recommends migration to DESFire® for any application requiring genuine access control security.
MIFARE DESFire® is NXP’s advanced credential platform, engineered from the ground up for environments where security cannot be an afterthought. EV3 uses AES-128 encryption, implements full mutual authentication, and incorporates hardware-backed originality checking — a cryptographic signature that proves the device is a genuine NXP product. A counterfeit chip cannot replicate this signature.
Encryption Standard
Common Criteria
Per-Application
Hardware Verified
Tamper Detection
| Feature | MIFARE Classic® | MIFARE DESFire® EV3 ✓ |
|---|---|---|
| Security Algorithm | Crypto-1 (broken) | AES-128 / 3DES |
| Card Cloning Risk | High - trivially cloned | Negligible with mutual auth |
| Originality Verification | None | Hardware-backed signature |
| Mutual Authentication | None | Full, per-application |
| Common Criteria Cert. | None | EAL5+ |
| Recommended for New Installs | No - Legacy Only | Yes |
“Specifying MIFARE® without specifying DESFire® is like specifying a lock without specifying whether it can actually be picked. The brand name alone tells you almost nothing about the security you are getting.”
Even with a genuine NXP DESFire® chip inside, a poorly manufactured card is still a poorly manufactured card. The chip is only one of three critical components. The others — the card substrate and the antenna — are selected and assembled entirely by the card manufacturer.
NXP does not design or supply the antenna in your card. The coil is sourced, engineered, and attached by the card manufacturer. Their choices about coil geometry, wire specification, and connection method directly determine read range, reliability, and service life. A manufacturer targeting the lowest price point will make compromises on the antenna that reveal themselves over time as inconsistent reads, intermittent failures, and early card retirement.
NXP’s TagInfo app — free for Android and iOS — allows any NFC-equipped smartphone to interrogate a contactless card and report chip identity, manufacturer details, and for DESFire® EV3, originality signature status. A genuine card, whether from NXP or a licensed manufacturer, will be correctly identified. An unlicensed counterfeit will not.
IC Manufacturer: Unknown Manufacturer ·
IC Type: Unknown MIFARE Classic IC, possibly cloned
Scanned with NXP TagInfo (free for Android & iOS). The app’s own words: “Unknown Manufacturer / possibly cloned.”
For best results use an Android Phon for NXP TagInfo (Results may vary on IOS)
HID Global’s DBond™ technology is a proprietary bonding and controlled-release process that permanently encapsulates the antenna inlay and chip module within the card substrate using fully automated, precision-controlled production.[8] Unlike conventional lamination — which introduces mechanical stress and delamination risk — DBond™ maintains tight control over antenna geometry and chip positioning throughout manufacture.
PPC ID Solutions supplies MIFARE Classic 1K cards manufactured using HID’s DBond™ technology — combining NXP’s most advanced chip platform with one of the highest-quality card construction processes available.
Talk to PPC ID Solutions about MIFARE Classic 1K credentials manufactured with HID DBond™ technology.
MIFARE® and DESFire® are registered trademarks of NXP Semiconductors N.V. HID and DBond™ are trademarks of HID Global Corporation. PPC ID Solutions is an independent authorised supplier and is not affiliated with NXP Semiconductors or HID Global.
