Data Structure of Mifare S50 RFID Card

29 Oct

Data Structure of Mifare S50 RFID Card

(Feature photo quote: https://pressola.uk/product/mifare-1k-s50/)

S50 Data Sheet Download

Mifare S50 (also known as Mifare Classic 1K) is one of the most commonly used high-frequency RFID cards. Its data structure adopts a “sector-block” hierarchical design, following strict storage rules and access control logic. Here is a detailed explanation of its data structure:

I. Overall Storage Capacity and Division

The total capacity of Mifare S50 is 1024 bytes, divided into “Sectors” and “Blocks”:

Contains a total of 16 sectors (numbered 0~15);
Each sector includes 4 blocks (numbered 0~3);
Each block stores a fixed 16 bytes (128 bits);
Total blocks: 16 sectors × 4 blocks = 64 blocks (numbered 0~63), total capacity: 64 blocks × 16 bytes = 1024 bytes.

II. Detailed Structure of Sectors and Blocks

Among the 4 blocks in each sector, 3 are data blocks (for storing user data) and 1 is a control block (for key management and access control). The specific division is as follows:

Sector Number	Block Number	Block Type	Function Description
Sector 0	Block 0	Manufacturer Block	Stores the card’s unique identifier (UID) and manufacturer information (e.g., NXP logo), non-modifiable (locked by default).
	Block 1	Data Block	Can store user data (subject to access control).
	Block 2	Data Block	Can store user data (subject to access control).
	Block 3	Control Block	Stores Key A, access control bits, and Key B of the sector (see detailed explanation below).
Sector 1~15	Block 0~2	Data Block	Can store user data (subject to access control).
Sector 1~15	Block 3	Control Block	Stores Key A, access control bits, and Key B of the sector.

III. Structural Analysis of Key Blocks

1. Manufacturer Block (Sector 0 Block 0)

It is the most special block of the entire card. Fixed information is written by the manufacturer during production, and it is permanently locked (non-modifiable). The structure is 16 bytes, including:

Bytes 0~3: UID (4 bytes, unique card identifier, e.g., 0x12 0x34 0x56 0x78);
Byte 4: BCC (UID checksum, XOR result of the first 4 bytes of UID);
Byte 5: SAK (1 byte, card type identifier, e.g., 0x08 indicates Mifare Classic 1K);
Bytes 6~10: Manufacturer information (e.g., NXP’s fixed code 0x00 0x00 0x00 0x00 0x00);
Bytes 11~15: Reserved (usually 0x00 or manufacturer-defined data).

Example (16 bytes):
12 34 56 78 6A 08 00 00 00 00 00 00 00 00 00 00

2. Control Block (Block 3 of Each Sector)

The 3rd block (Block 3) of each sector is the control block, which manages the keys and access permissions of the sector. The structure is fixed as 16 bytes, divided into 3 parts:

Byte Range	Content	Length	Description
0~5	Key A	6 bytes	Used for authentication of the sector (e.g., `0xFF 0xFF 0xFF 0xFF 0xFF 0xFF` is the default key).
6~9	Access Control Bits	4 bytes	Define read/write permissions for all blocks (including data blocks and control blocks) in the sector (core control logic).
10~15	Key B	6 bytes	Optional key (can be used as a backup authentication key or as a data block if permissions allow).

Example (default control block):
FF FF FF FF FF FF FF 07 80 69 FF FF FF FF FF FF

Key A: FF FF FF FF FF FF (default);
Access control bits: FF 07 80 69 (default permission configuration);
Key B: FF FF FF FF FF FF (default).

3. Data Blocks (All Blocks Except Manufacturer and Control Blocks)

Data blocks (e.g., Sector 0 Block 1~2, Sector 1~15 Block 0~2) are used to store user-defined data. The structure is 16 bytes with no fixed format, completely defined by the application scenario:

For example: An access card can store the cardholder’s ID (e.g., 0x00 0x01 0x02 0x03 ...);
A payment card can store the balance (e.g., 4 bytes representing the amount: 0x00 00 00 0A indicates 10 yuan).

IV. Access Control Bits (Core Permission Logic)

The 4 bytes (bytes 6~9) in the control block are access control bits, which determine the read/write permissions of all blocks in the sector (including data blocks and control blocks). The core is to define the binding relationship between “operation types” and “key authentication” through “permission bits”.

Parsing Rules for Access Control Bits

The 4-byte access control bits have a total of 32 bits, and the actual valid bits are 24 bits (divided into 3 groups, 8 bits each), corresponding to the permissions of 3 data blocks (Block 0~2) and 1 control block (Block 3) in the sector. The specific grouping is as follows:

Byte 6 (bit0~7): Controls permissions for Block 0;
Byte 7 (bit0~7): Controls permissions for Block 1;
Byte 8 (bit0~7): Controls permissions for Block 2;
Byte 9 (bit0~7): Controls permissions for Block 3 (control block).

Among each group of 8 bits, 3 key bits (C1, C2, C3) define permission levels, corresponding to the allowable conditions for the following operations:

Read operation: Whether reading block data is allowed;
Write operation: Whether modifying block data is allowed;
Increment/Decrement: (For special data blocks) Whether increment/decrement operations are allowed (e.g., balance update).

Common Permission Example (Default Configuration `FF 07 80 69`)

Data blocks (Block 0~2): Read and write are allowed after authentication with Key A or Key B;
Control block (Block 3): Modification is only allowed after authentication with Key B (to ensure key security).

V. Block Address Calculation

To easily locate specific blocks, the block address can be calculated by the sector number:

The 4 block addresses of sector N (0≤N≤15) are: 4×N, 4×N+1, 4×N+2, 4×N+3.

For example:

Block addresses of Sector 0: 0 (4×0), 1 (4×0+1), 2 (4×0+2), 3 (4×0+3);
Block addresses of Sector 1: 4 (4×1), 5 (4×1+1), 6 (4×1+2), 7 (4×1+3);
…
Block addresses of Sector 15: 60 (4×15), 61, 62, 63.

VI. Summary

The core feature of Mifare S50’s data structure is the “sector-block” hierarchical design, which realizes key management and access control through control blocks to ensure data security. Its structure can be summarized as:

16 sectors, 4 blocks per sector, totaling 64 blocks and 1024 bytes;
Special blocks (manufacturer block, control block) have fixed structures, while data blocks store information flexibly;
Access control bits determine read/write permissions, and operations require key authentication.

Understanding this structure is the basis for implementing operations such as reading, writing, and key modification of Mifare S50 cards.

Data Structure of Mifare S50 RFID Card