1 General description
The NXP MIFARE SAM AV3 secure hardware solution is the ideal add-on for reader devices offering additional
security services. Supporting DES, TDEA, AES and RSA capabilities, it offers secure storage and secure
communication in various infrastructures.
Unlike other products in the field, MIFARE SAM AV3 has proven interoperability with all broad card and RFID
product portfolio of NXP, (MIFARE, NTAG DNA, ICODE DNA, UCODE DNA and SmartMX product families),
making it the most versatile and secure SAM solution on the market today.
The MIFARE SAM AV3 is built on the SmartMX2 P60 secure smart card controller with CC EAL6+ certification
of NXP. Its software implementation is evaluated and composite certified by the MIFARE Security Evaluation
Scheme. Similar to the hardware CC evaluation, the MIFARE Scheme also evaluates against high attack
potential. Hence, systems using MIFARE SAM AV3 are reassured with the state-of-the-art security measures
adopted by the industry.
Programmable Logic
The MIFARE SAM AV3 is equipped with a new Programmable Logic functionality which allows customers to
flexibly create their business logic on the SAM. This new functionality opens up many new possibilities with the
creation of project-specific customization such as a new key diversification algorithm, a new secure messaging,
or a new secure storage.
X-mode communication
When used in combination with a reader IC supporting innovative "X" features, MIFARE SAM AV3 provides a
significant boost in performance to the reader along with faster communication between reader and module.
The "X" feature is a new way to use the SAM in a system, with SAM connected to the microcontroller and the
reader IC simultaneously.
Secured communication
The connection between the SAM and the reader is performed using security protocols based on either AES
symmetric cryptography or PKI RSA asymmetric cryptography. The protocols comply with the state-of-art
standards and thereby ensure data confidentiality and integrity.

2 Features and benefits
2.1 Cryptography
• Supports MIFARE Crypto1, DES, TDEA (112 bits and 168 bits), AES (128 bits, 192 bits and 256 bits), RSA
(up to 2048 bits) and ECC (up to 256 bits) cryptography
• Supported NXP products:
– MIFARE DESFire EV3, EV2, EV1, and Light
– MIFARE Plus EV2, EV1, X, S, and SE
– MIFARE Classic EV1
– MIFARE Ultralight AES, C and EV1
– NTAG, ICODE, and UCODE DNA
• Secure storage and updating of keys
– 128 key entries for symmetric cryptography
– 3 RSA key entries for asymmetric cryptography
– 8 ECC public key entries for signature verification
– 4 ECC curves entries
– 48 EMV CA public key entries (supports 8 RID minimum)
• SHA-1, SHA-224 and SHA-256 hashing computation
• TDEA and AES-based key diversification
• Generic cryptography commands for user-defined schemes
• Supports EMVCo terminal functionality
• True random number generator (TRNG) compliant to AIS-31
2.2 Communication
• ISO/IEC 7816 (part 2 and 3) contact interface
– Support Class A, B and C operating condition
– Support ISO/IEC 7816 baud rates
– Support high-speed baud rates up to 1.5 Mbit/s
• Optional I2C Target mode host interface (only available on HVQFN package)
• Communication protocol compliant with ISO/IEC 7816-3 T=1 protocol
• Up to four logical channels; simultaneous multiple card support
• Support for MIFARE DESFire and MIFARE Plus authentication (with related secure messaging and session
key generation)
• Secure Host to SAM and back end to SAM communication with symmetric cryptography including 3-pass
authentication for confidentiality and integrity
• Secure Host to SAM and back end to SAM communication with RSA-based cryptography for key updating
• X-mode direct interface with NXP’s contactless reader ICs (RC663, RC52x, PN512)
2.3 Programmable logic (restricted feature) 2
• Up to 32 kB of code and data in EEPROM for user customized functionality
• 1 kB of RAM for user’s dynamic data
• Internal Host access to all MIFARE SAM AV3 commands
2.4 Security evaluation and certification
• CC EAL6+ certified hardware platform (based on NXP’s SmartMX2 P6022y VB)
• Composite certified with MIFARE Security Evaluation Scheme (Equivalent to EMVCo Security Evaluation)
(Evaluation lab: TÜViT, Certification lab: UL)
• FIPS 140-2 CAVP certified
2.5 New features
This section gives an overview of the new features compared to MIFARE SAM AV2. Please see [1] for details.
• All new features from MIFARE DESFire EV2 requiring cryptographic operations. This includes EV2 secure
messaging and Transaction MAC support (incl CommitReaderID).
• All new features from MIFARE Plus EV1 requiring cryptographic operations. This includes EV1 secure
messaging, Transaction MAC support (incl CommitReaderID) and Sector Security Level Switching.
• New Virtual Card Selection and Proximity Check protocols.
• Post-Delivery Configuration support.
• MIFARE Ultralight EV1 password authentication.
• AES authentication according to ISO/IEC 29167-10 for UCODE and ICODE support.
• LRP support for DESFire secure messaging, as supported by DESFire Light and NTAG42x(TT) and for Offline
Crypto operations.
• ECC originality signature verification as supported by all recent MIFARE products.
• Generic CMAC-based key derivation for a.o. Transaction MAC session key generation and (e.g. UCODE) key
diversification.
• Fine-grained key access control.
• EMV terminal support for certificate verification, offline authentication and pin code verification.
• Programmable Logic feature to allow customized business logic and a.o. key diversifications to be run within
the SAM.
• Personalization SAM feature to generate cryptogram to export keys for injection in another SAM for AES
variant and for RSA variant.
• AES-256 support for Offline Crypto and SAM-Host protection.
• RSA OAEP encryption and decryption.
• ATR configuration.
• I2C target interface in addition to ISO/IEC 7816 interface (for HVQFN only).