MiFare - Difference between UID and Serial Number of MiFare Card

Question

I need to read serial number of MiFare card usin WinSCard. I am able to read 7B UID from the MiFare card.

The confusion is that i dont know if the UID and the serial number of MiFare card are same?!!

I have googled the issue but only could get partial success. I found a question on stackoverflow also but it did not help.

I found a document of NXP online which says UID and serial number are different. (on page number 3, line number 5)

There is an application of OmniKey that reads the serial number of the card, and it also returns UID only.

NXP documentation says UID <> Serial Number and a other standard OmniKey application returns UID as Serial Number.

I have started pulling my hair off on the issue. I'd greatly appreciate if anyone could help.

Cholecystitis

MiFare tags don't have a readable serial number. They only have a UID. The reason why you are confused is, that not everyone knows what a UID is, but everyone knows what a serial number is. Therefore UIDs are often untruly referred as serials. NXP tries to clarify that but adds even more confusion by implying a serial exist. The document from NXP is horrible misleading by the way. – Betteanne

So the only readable unique id is this UID? I could read UID using WinSCard. And if serial numbers are not readable, what is the point of providing them? #JustCurious :-) – Cholecystitis

The full quote from that doc is "A UID is not a “serial number”, but a unique identifier. There is no recommendation how to turn the array of bytes into an integer." They're pointing out that converting that to a number is not something that they're defining, and can be done in different ways (e.g. little-endian vs. big-endian) – Neural

Answer 1

Each smart card contains an integrated chip with a unique permanent identification (UID) number burned-in during the manufacturing process. This UID is often referred to as the Card Serial Number (CSN). The card serial number is not encrypted and any reader that is ISO compliant can read the card serial number.

Edit 1:

Mifare Card Serial Number is the unique identifier defined in ISO 14443-3A. There are 3 types of UID defined in the standard - single (4 bytes), double (7 bytes) and triple (10 bytes). Only in first versions of the Mifare card, the UID was 4 bytes but now have migrated to 7 bytes.

EDIT 2: It might be helpful to you...

What is the difference between a 4 byte UID and a 4 byte ID?

A 4 byte UID is an identifier which has been assigned by the card manufacturer using a controlled database. This database ensures that a single identifier is not used twice. In contradiction, a 4 byte ID is an identifier which may be assigned to more then one contactless chip over the production time of a product so that more then one card with the same identified may be deployed into one particular contactless system.

Depressomotor

Yes i know this. But NXP official document says UID and Serial Number are two different things. So only I am confused. – Cholecystitis

I had already visited the link you mentioned in the answer. But the link does not contain answer for "UID = Serial Number?" :-( – Cholecystitis

UID of Identifications card of a country are the same number for all Cards? for example, i check with two Diferent Identification cards and i got same number 6f648407 – Faery

Answer 2

The differentiation in this case comes from the fact that a "Serial Number" implies that the numbers are a series, thus sequentially assigned.

MIFARE cards have Unique Identification Numbers (or in short UID), which are generated by an internal rule which is not necessarily sequential. This means that if you see a card with UID 01020304050607 it does not mean that there are at least that many cards produced so far.

If you ever see someone referring to the Card Serial Number, they are in fact referring to the UID.

The only last confusion can come from the fact that MIFARE cards can be configured to return Random IDs during activation. If that is the case, you would get different "UID" each time you activate the card. In that scenario you need to read the data contained in Block 0 (for which you will need to know the key to sector 0) to get the real UID of the card.

Venn

Thanks for your efforts by my question still stands tall :( – Cholecystitis

@Eduardo, your comment about the "real UID" when the card is configured to return random ids seems to be diametrically opposed to the answer given here, where the linked answer suggests that sector 0 is either the random UID, if configured, or a static UID. – Joung

Answer 3

For DesFire cards:

1. UID is analogous to ethernet MAC address. It is assigned by the chip manufacturer from a database. Everyone who creates applications for the card has access to the UID.
2. The Card Serial Number is specific to the application loaded on to the card. It can only be accessed by that application via an encryption key. If the card had several applications loaded on to it (unlikely but possible), then each could have a different CSN.

Zack