The Ware for August 2007 is a die shot of the EEPROM memory area from an MF RC530 ISO 14443A Reader IC by NXP. The MF RC530 is one of the RFID readers IC that can be used in the MIFARE system, and it employs the CRYPTO-1 protocol. This EEPROM memory is part of a secure memory region that contains the keys used by the CRYPTO-1 protocol. One question I am still puzzling over is the location of the CRYPTO-1 implementation on this die. CRYPTO-1 is a proprietary cipher, and some friends of mine were curious as to the algorithm–so I contacted Flylogic and we popped the top of the MF RC530 to have a look around. My original opinion was that the array of gates immediately below the EEPROM was the CRYPTO-1 cipher. However, tracing the wires in and out of the block seem to disagree with this functionality, and instead it looks more appropriate as the programming and sequencing logic for the EEPROM. There is a microcode ROM on this chip as well, so quite possibly the cipher is implemented using part of the microcode ROM, or it is implemented using random, compiled logic.

Several readers correctly guessed the capacity of the memory array at 4kbits, although many were unclear as to what kind of array it was–some guessed DRAM, others SRAM, others a PLA. Actually, all of these are pretty good guesses. The clue that makes me think this is an EEPROM (or FLASH) array is the charge pumps on the right hand side. The large capacitors are used in a set of voltage doublers to create the high voltage necessary to erase and program the floating gates of the EEPROM memory devices. The high voltages are unique, at least in today’s modern processes, to FLASH and EEPROM devices. Christian Vogel basically nailed this analysis, so he is the winner. Congratulations, email me for your prize!

This entry was posted on Monday, October 8th, 2007 at 11:33 pm and is filed under Hacking. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.