LF - EN Memory EM4056 Memory EM4056 and its security J.-D. Chatelain

MSB LSB 000 001 002 003 004 005 006 007 008 009 010 011 Laser ROM 1 0 The first three words (laser ROM) contain the transponder’s unique identification number The word at address 126 permits configuration of the soft protection activated by the password, which is found at address 127 The following three words are reserved for CONTRINEX There remain 16 usable bits per word for data OTP (One Time Programmable) Read protection of one word The memory is made up of 128 words, each of 18 bits The last two bits of each word (LSB: Least Significant Bits) are dedicated to its protection OTP Read and Write protection of one word OTP Write protection of one word 100% 0 0 0 1 75% 1 0 50% 1 1 25% 122 123 124 125 126 127

Reading a protected word without login LF - EN Memory EM4056 Reading a protected word without login Mask protected region Setting the « Mask protected region » bit Write protection Read protection TAG not logged in Its equivalent in HEX Result of a reading A memory word in binary

Reading a protected word with login LF - EN Memory EM4056 Reading a protected word with login When words are protected with a « Password », they can be accessed only with a login. When a word is protected by a « Read protection » bit, it may only be compared with a known word. TAG logged in Mask protected region Write protection Read protection Result of a reading

Comparison Result of reading transponder addresses 20 through to 24 LF - EN Memory EM4056 Comparison Result of reading transponder addresses 20 through to 24 Result of reading the same addresses after having protected addresses 21 and 22

The acknowledgment (error) code "4" after the second phase indicates that the entered data is not identical to the data stored in the memory. Complete words are to be compared The acknowledgment (error) code "0“, after the second phase, indicates that the entered data is identical to the data stored in the memory Content of the memory of the transponder

Memory EM4056 and its security End of this chapter J.-D. Chatelain LF - EN Memory EM4056 Memory EM4056 and its security End of this chapter J.-D. Chatelain