NFC Key Cards (FabFire)

Functional Principle

Basic

Card authentication using NXP/MiFare DESFire cards. These cards have the ability to restrict access for data on the cards using symmetric encryption and using a keyed Diffie-Hellman to prevent eavesdropping by any relaying party. A card has several “applications”, containing up to 32 files. A file can be read or written. Both kinds of access can be restricted to parties knowing a PSK, on a file-to-file basis.

Files

The current system uses File 0001 through File 0003:

File 0001 allows public (i.e. unauthenticated) read access and contains the Strings FABACCESS, DESFIRE, and 1.0 as packed list of UTF-8 encoded zero-terminated strings.

Examples:

This file serves an identifier, allowing a server to verify if it is able to use this card.

File 0002 allows public read access and contains: An URL-encoded name of the issuing lab as URN in the format urn:fabaccess:lab:<labname>

Examples:

A valid IRI pointing towards the bffh instance running for this lab. This bffh SHOULD be reachable from the internet. Using private use IP addresses or IRIs that resolve to such may be necessary for labs behind restrictive firewalls or due to local policy. The IRI MUST use the “fabaccess” scheme, and SHOULD NOT contain an userinfo, path, query, or fragment part. Examples:

A zero-terminated list of UTF-8 encoded IRIs giving contact options to notify the issuer or owner in case the card has been lost. Issuers SHOULD set one value on card creation and MAY allow card owners to change or add values of their choosing. Examples:

File 0003 allows public access or access using a key, at the issuers option. It contains a token that can be used by the home server of the card owner to identify the card owner. The format of the token MUST NOT be relied on by any party except the home server.

FabFire Specification

Application Identifier (AID): 0x464142

NFC Implementation

C# - https://gitlab.com/fabinfra/fabaccess/nfc Rust - https://gitlab.com/fabinfra/fabaccess/nfc_rs

Tools

Tool for provisioning new cards for use with the FabAccess card system. https://gitlab.com/fabinfra/fabaccess/FabFire-Provisioning-Tool

FabFire adapter translates mqtt messages from the reader hardware to api https://gitlab.com/fabinfra/fabaccess/fabfire_adapter

Hinweise zu NTAG von NXP

Unsere Client-App Borepin kann neben QR-Codes auch sogenannte "NTags" von NXP scannen. Hierzu muss die NFC-Funktion des Telefons/Tablets aktiviert sein, auf dem die App läuft. Beim Auflegen des Tags wird die entsprechende Aktion getriggert. Folgendes Datenformat wird auf dem NTag benötigt: fabaccess://fabaccess.local/resource/{machine id}

Beispiel für NTags in Form von Transpondern, Smartcards und Klebetags. Den einen oder anderen dürfte jeder schon mal gesehen haben.

 

Vorlagen für Karten-Designs

https://gitlab.com/fabinfra/design