DESFire write data command fails with 917E (length error)

Question

I am facing a very strange problem with MIFARE DESFire. When I write small amounts of data (e.g. 11 bytes), the write operation succeeds. However, when I try to write e.g. 50 byte, the response is 917E, which means there is some length issue in command.

Try to write 11 bytes:

<-- 90 3D 00 00 12 01 000000 0B0000 1234567890AABBCC DDEEFF 00
--> 9100 (success)

Try to write 50 bytes:

<-- 90 3D 00 00 39 01 000000 320000 1234567890AABBCC DDEE1234567890AA
                                    BBCCDDEE12345678 90AABBCCDDEE1234
                                    567890AABBCCDDEE 1234567890AABBCC DDEE 00
--> 917E (length error)

Fromma

Answer 1

The error indicates that your command is too long. You probably use DESFire EV1 which only supports wrapped APDU lengths up to 55 bytes. Consequently, the maximum data length for the WriteData command, when packed into a single APDU in wrapped native mode, is

55 - APDU Header - APDU Lc - File ID - Offset - Length - APDU Le =
55 - 4           - 1       - 1       - 3      - 3      - 1       = 42 bytes.

This is slightly smaller than the limit for the WriteData command itself due to the APDU wrapping. Note that you could still send (much) more data in one WriteData command by spliting the data across multiple DESFire frames (using the 0xAF status and command codes).

Update

The 55 bytes are mentioned in the DESFire EV1 datasheet. Actual tests by vikky revealed that this might acutally be 60 bytes (leading to a maximum data length of 47 bytes).

Fleawort

Ok, but Desfire document does not mention.So according to you We can write only 42 byte in single command. – Fromma

I am able to write 47byte(Total command length 60 bytes) in single wrapped APDU.When I try write 48 byte , error is 917E. So are you sure DESfire EV1 only support wrapped APDU length up to 55 bytes. – Fromma

@vikky That's the number mentioned in the DESFire EV1 datasheet. – Fleawort