Prerequisite Knowledge
Let's first clarify a few different terms: ID card, IC card, RFID card, CPU card, M1 card, MF1 card, UID card, and CUID card…
Seeing these terms may already cause some confusion, but today, I’m here to help you understand the meaning of each term, as well as introduce the common types of cards currently on the market.
This article is long, please reserve some time or read it in batches
RFID Card and IC Card
First, the term everyone needs to know is: RFID.
What does this mean? I’ve taken an excerpt from Wikipedia to help you understand:
Radio Frequency Identification (RFID) – Wikipedia, the free encyclopedia (wikipedia.org).
Radio Frequency Identification (RFID) is a wireless communication technology that can identify specific targets and read/write related data through radio signals without needing mechanical or optical contact between the identification system and the target.
As we can see, RFID is not the name of a specific card but rather a technology, a widely used one. Any “card” utilizing this technology can be called an RFID card. This is a broad category, covering almost all the cards we will discuss today, except for a portion of IC cards which we will talk about next.
IC card definition, from Wikipedia: integrated circuit card
An IC card (Integrated Circuit Card), also known as a smart card, intelligent card, microcircuit card, or microchip card, is a card embedded with a microelectronic chip that complies with the ISO 7816 standard. The communication between the IC card and the reader can be either contact or contactless.
From the two definitions, we can see that RFID cards and IC cards do not have a simple “contains and is contained” relationship because one is defined by technology, and the other by structure. The two cannot be directly compared. Strictly speaking, contact-based IC cards do not fall under the category of RFID cards because one of RFID’s key characteristics is contactless communication. Common examples of contact-based IC cards include bank cards and SIM cards, which are easily recognized by their exposed chips.
Nowadays, contactless IC cards (the type you can swipe without physical contact) are often referred to as radio frequency cards and fall under the category of RFID cards. Many people now group IC cards directly into the RFID card category. While this isn’t entirely wrong, it just lacks a bit of precision in the terminology.
RFID and NFC
By now, you’ve likely come across the term NFC and noticed its frequent association with various “cards.” For example:
- The NFC feature on smartphones
- NFC-enabled fitness bands
- NFC card stickers
- NFC card readers
- …
Although NFC is commonly related to card transactions in everyday life, there are distinct differences between NFC technology and RFID. Let me first explain the meaning of NFC: Near Field Communication – Wikipedia, the free encyclopedia (wikipedia.org).
Near Field Communication (NFC) is a set of communication protocols that allows two electronic devices (one typically being a mobile device, like a smartphone) to communicate when they are within a few centimeters of each other.
NFC actually evolved from RFID technology, developed jointly in 2004 by Philips Semiconductors (now NXP Semiconductors), Nokia, and Sony. Its characteristics include:
- A short transmission range, generally less than 20 cm
- A fixed operating frequency of 13.56 MHz
- A transmission speed of 424 kbit/s
| Comparison of NFC and RFID | ||
|---|---|---|
| NFC | RFID | |
| Transmission Distance | Less than 10cm | A few meters to several dozen meters |
| Operating Frequency | 13.56MHz | Low frequency, high frequency, ultra-high frequency |
| Compatibility | Vendor compatibility | More standards |
| Application Fields | Access control, public transportation, mobile payments, etc. | Manufacturing, logistics, tracking, asset management |
For the specific differences between NFC technology and RFID technology, please refer to this article: NFC and RFID.
Although NFC and RFID have many differences, NFC is compatible with existing passive RFID (13.56 MHz ISO/IEC 18000-3) systems. Therefore, in applications involving high-frequency RFID (13.56 MHz), NFC technology can also be used. Most of the cards we use daily employ NFC technology, so you’ll see NFC mentioned frequently in the following sections.
IC Cards and ID Cards
In daily life, you often hear the term “ID card.” So, what’s the difference between an ID card and an IC card?
Here, the IC card refers to a radio frequency card.
First, let’s understand what an ID card is by looking at the definition:
An ID card, short for Identification Card, is a non-writable contactless card that contains a fixed number. It mainly includes formats like Taiwan’s SYRIS EM and various ID cards from companies like HID MOTOROLA in the U.S. Like magnetic cards, ID cards only use the “card number.” Other than the card number, there are no security features. The card number is public and exposed, meaning that an ID card is essentially a “contactless magnetic card.” The ISO standard for ID cards is 85.5x54x0.80±0.04mm (height/width/thickness), although thicker, thinner, or differently shaped cards are also available on the market.
Differences in Principle and Usage Between the Two Cards
ID Card: ID cards typically operate at low frequencies (125KHz) and are non-writable contactless cards. The card number can only be written once by the chip manufacturer and developers can only read the card number for usage purposes.
IC Card: IC cards typically operate at high frequencies (13.56MHz). Not only can authorized users read large amounts of data, but they can also write data (such as user permissions, user information, etc.). The content stored on an IC card can be rewritten multiple times.
Additionally, there are notable differences in the appearance of these two types of cards, as shown in the following image:
- IC Cards: The coil is rectangular and distributed around the edges of the card.
- ID Cards: The coil is circular and located in the center of the card.
- IC Cards: The surface of the card is smooth and typically does not have a visible card number (though some may have a number).
- ID Cards: The card surface prominently displays a series of numbers indicating the card number.
The specific distinction can be seen in this article:How to Distinguish Between ID Cards and IC Cards?
Summary:
- ID cards are mostly low-frequency, while IC cards are mostly high-frequency.
- IC cards generally have more advantages than ID cards, and the majority in use today are IC cards.
- For rectangular white cards, those with rectangular coils inside and no visible number on the surface are usually IC cards, while those with circular coils and a visible number are typically ID cards.
- For non-standard shaped cards, those with visible numbers are often ID cards. It’s best to use an NFC-enabled phone for testing (since NFC on phones currently only reads high-frequency 13.56MHz), and IC cards will respond.
Introduction to ID Cards
Now that we’ve covered the background knowledge, it’s time to dive into the main content and introduce each type of card in detail, starting with ID cards. The most notable features of ID cards are their low frequency, factory-fixed ID, low cost, and lack of encryption.
General ID card
ID cards have many different kinds of chips, produced by many different companies, the common ones are: Mifare UtraLight IC U1、Mifare DESFire 4K；Legic MIM256 ；ST SR176、SRIX4K；I·CODE 1、 I·CODE 2；Tag-it HF-I、Tag-it TH-CB1A；Temic e5551；Atmel T5557、Atmel T5567、Atmel AT88RF256-12 ；Hitag1、 Hitag 2；μEM EM4100、EM 4102、 EM4069、EM4150；TK4100；Inside 2K、Inside 16K etc.
More common is the ID card of the EM4100 radio frequency chip of the Swiss Microelectronics company, so the general ID card I will introduce with this chip. First go on Google and look for EM4100 data sheet
As can be seen from the Feature, the common ID card only has the storage space of 64bit, and there is no space after the ID is stored. Therefore, the application scenarios of ID card are very limited. Let’s look at the storage structure:
As we can see, only 40 bits are used to store data, where 8 bits represent the user ID/version number, and the remaining 32 bits are for the data bits/card number. The parity bits Px and PCx work as follows: if the corresponding row or column has an even number of 1s (excluding the parity bit), the parity bit is 0; if there’s an odd number of 1s, the parity bit is 1. After encoding, the data becomes a 64-bit string (9-bit start, 54-bit data/parity, and a 1-bit stop), which is continuously transmitted using Manchester encoding once powered on.
This simple introduction to the EM4100 is somewhat unrelated to this article, so it’s just for fun. In fact, most common ID card chips are from the EM4XX series, so it’s common to refer to standard ID cards as part of the EM4XX family. It’s not a big deal. These cards are typically inexpensive, read-only, and commonly used in low-cost access control systems, such as community gates or parking access cards. They offer no real security and can easily be duplicated using a handheld card reader.
ID White Card
Typically referring to EM4305 or T5577, these cards, as the name suggests, can be used to clone ID cards. Sold as blank cards, their internal EEPROM (user data storage) is both readable and writable, allowing the ID to be modified by changing the EEPROM content. The T5577 card, in particular, has many features, including internal sectors for data storage, and certain sectors can even be password-protected. The most special feature is that writing an ID number can turn it into an ID card, writing an HID number can turn it into an HID card, and writing an Indala card number can turn it into an Indala card.
As for why you can copy the ID card with a white card, see this article for details:Explanation of EM4305/T5557 Simulating EM4100
T5577 Brief introduction
Here is a brief introduction to the storage structure, first attach the data sheet: Atmel T5557 Datasheet (orangetags.com). You can study it carefully if you are interested.
The structure of the T5557 card consists of Page 0 and Page 1. Page 1 has two blocks, while Page 0 has eight blocks, with each block containing 33 bits. The first bit is the lock bit, and once it’s written as 1, the remaining 32 bits in that block cannot be modified.
Page 1 is read-only and contains card number information and some manufacturer-specific data. The specific format and meaning can be found in the T5557 chip documentation. Block 0 of Page 0 is the configuration word, which determines the card’s working frequency, modulation method, and the visible number of blocks in Page 0 when communicating with the reader. The configuration word is crucial because different readers may or may not read the same T5557 card, depending on the specific microcontroller design of the reader. Therefore, once set, it should not be modified lightly.
Accessing the T5557 card can be done in two modes: regular read/write and protected read/write. In regular read/write mode, block 7 of Page 0 is a normal data area, and accessing blocks in Page 1 or Page 0 does not require a password. In protected read/write mode, block 7 of Page 0 stores the password and is invisible and unreadable. Accessing blocks in Page 1 or Page 0 requires a password. The low-frequency reader we are using from Huafeng Technology Co., Ltd. operates in regular read/write mode when the configuration word is set to 00 08 80 e8 and in protected read/write mode when set to 00 08 82 f8.
Brief Introduction of EM4305
The EM4305 card features 32 password-protected read/write sectors, a 32-bit unique ID code, and a 10-bit customer code. The EEPROM storage space of the EM4305 card is 512 bits, divided into 16 sectors, each with 32 bits. The lock bit in each sector can set the EEPROM data blocks to read-only mode. The EM4469 provides various low-power data transmission rates and encoding methods. It has an integrated resonant capacitor that can be mask-selected, eliminating the need for external capacitors. Additionally, the chip includes an on-chip rectifier and voltage limiter, and it can operate at temperatures ranging from -40°C to 85°C.
