Reference Documents
Specifications, datasheets, and open-source implementations the library is built and checked against. Links checked on 2026-10-16.
Documents whose licence allows redistribution are kept in the repository under docs/references/, with sources, checksums, and licence evidence in its README. Everything else is copyrighted by its publisher and is linked only. Several ISO/IEC, JIS, KS, and SS standards must be bought.
Vendored copies
Unmodified copies. RFCs may be reproduced in full under the IETF Trust's policy; NIST publications are US Government works, not subject to copyright in the United States (17 U.S.C. §105).
| Document | Used for | Availability |
|---|---|---|
| RFC 4493, The AES-CMAC Algorithm | AES-CMAC for DESFire EV1/EV2 secure messaging and PACE/CA with AES; test vectors. | Vendored copy: docs/references/rfc4493.txt · rfc-editor.org |
| RFC 5652, Cryptographic Message Syntax (CMS) | Parsing the eMRTD Document Security Object (SOD) as CMS SignedData for passive authentication. | Vendored copy: docs/references/rfc5652.txt · rfc-editor.org |
| RFC 5280, Internet X.509 PKI Certificate and CRL Profile | Document Signer certificate and SubjectPublicKeyInfo structures in the SOD and DG15. | Vendored copy: docs/references/rfc5280.txt · rfc-editor.org |
| NIST FIPS 197 (2023 update), Advanced Encryption Standard | AES block cipher behind CMAC, DESFire AES authentication, and PACE/CA session keys. | Vendored copy: docs/references/NIST.FIPS.197-upd1.pdf · doi.org |
| NIST FIPS 180-4, Secure Hash Standard | SHA-1 and SHA-2 for BAC key derivation, data-group hash checks, and active authentication. | Vendored copy: docs/references/NIST.FIPS.180-4.pdf · doi.org |
| NIST SP 800-38B, The CMAC Mode for Authentication | CMAC subkey generation and truncation rules alongside RFC 4493. | Vendored copy: docs/references/NIST.SP.800-38b.pdf · doi.org |
ICAO Doc 9303, Machine Readable Travel Documents
Free PDFs from the ICAO Doc 9303 page. icao.int may answer scripted requests with a bot check; the files open in a browser.
| Document | Used for | Availability |
|---|---|---|
| Part 3: Specifications Common to all MRTDs | MRZ fields and check digits (weights 7, 3, 1) for the BAC key seed. | Link only · © ICAO, all rights reserved |
| Part 10: Logical Data Structure (LDS) | eMRTD application AID, EF.COM, data-group file IDs and tags, DG1/DG2/DG11/DG12 layouts. | Link only · © ICAO, all rights reserved |
| Part 11: Security Mechanisms for MRTDs | BAC, PACE, chip authentication, active authentication, and secure messaging (DO'87/DO'99/DO'8E). | Link only · © ICAO, all rights reserved |
| Part 12: Public Key Infrastructure for MRTDs | Document Signer certificate and SOD profile used by passive authentication. | Link only · © ICAO, all rights reserved |
BSI technical guidelines
| Document | Used for | Availability |
|---|---|---|
| TR-03110, Advanced Security Mechanisms for MRTDs and eIDAS Token, Parts 1–3 | PACE, chip authentication, and terminal authentication protocols, OIDs, and the SecurityInfos in DG14 and EF.CardAccess. | Link only · © BSI |
| TR-03111, Elliptic Curve Cryptography | ECDSA plain signature format (r ‖ s) and EC key encodings for active authentication. | Link only · © BSI |
ISO/IEC standards
Paid standards. The links go to the ISO catalogue; iso.org may answer scripted requests with HTTP 403, but the pages open in a browser.
| Document | Used for | Availability |
|---|---|---|
| ISO/IEC 14443-3:2018, Initialization and anticollision | CRC_A and CRC_B, ATQA and SAK interpretation for card identification. | Link only · © ISO/IEC, paid |
| ISO/IEC 14443-4:2018, Transmission protocol | ATS parsing and the SAK bit that marks ISO 14443-4 compliance. | Link only · © ISO/IEC, paid |
| ISO/IEC 7816-4:2020, Organization, security and commands for interchange | APDU structure, SELECT, READ BINARY, status words, and secure-messaging data objects. | Link only · © ISO/IEC, paid |
| ISO/IEC 15693-3:2019, Anticollision and transmission protocol | ISO 15693 Get System Information, block read/write, and block security status commands. | Link only · © ISO/IEC, paid |
| ISO/IEC 9797-1:2011, MACs using a block cipher | MAC algorithm 3 (retail MAC) and padding method 2 for BAC secure messaging. | Link only · © ISO/IEC, paid |
| ISO/IEC 9796-2:2010, Signatures giving message recovery | RSA active-authentication verification with message recovery. | Link only · © ISO/IEC, paid |
| ISO/IEC 10118-3:2018, Dedicated hash-functions | Hash-function identifiers (such as 33 for SHA-1) in the ISO 9796-2 trailer during RSA active authentication. | Link only · © ISO/IEC, paid |
NFC Forum specifications
All listed on the NFC Forum specifications page. Download terms are set on that page.
| Document | Used for | Availability |
|---|---|---|
| NFC Data Exchange Format (NDEF) | NDEF message and record encoding and parsing. | Link only · © NFC Forum |
| RTD Text | Text record payloads (status byte, language code, UTF-8/UTF-16). | Link only · © NFC Forum |
| RTD URI | URI record identifier-code prefixes. | Link only · © NFC Forum |
| Smart Poster RTD | Nested Smart Poster messages with URI and title records. | Link only · © NFC Forum |
| Type 2 Tag (T2T) | Capability container and NDEF TLVs on Ultralight and NTAG. | Link only · © NFC Forum |
| Type 3 Tag (T3T) | FeliCa NDEF attribute block and data blocks. | Link only · © NFC Forum |
| Type 4 Tag (T4T) | NDEF tag application SELECT, CC file, and NDEF file reads and writes. | Link only · © NFC Forum |
| Type 5 Tag (T5T) | ISO 15693 capability container, MLEN, and the T5T area. | Link only · © NFC Forum |
FeliCa
| Document | Used for | Availability |
|---|---|---|
| JIS X 6319-4:2016, High speed proximity cards | FeliCa frame format, block list elements, and command codes. | Link only · © JSA, paid |
| FeliCa Card User's Manual, Excerpted Edition | Read/Write Without Encryption, Request Service, and status flags. | Link only · © Sony |
| FeliCa Lite-S User's Manual | System code 88B4, Lite/Lite-S detection from the memory map (block 90h, WCNT, exists only on Lite-S; CoreNFC does not expose PMm), and the memory map. | Link only · © Sony |
Other Sony manuals are on the FeliCa technical information page.
NXP datasheets and application notes
| Document | Used for | Availability |
|---|---|---|
| AN10833, MIFARE type identification procedure | ATQA/SAK and GET_VERSION mapping to card types. | Link only · © NXP, all rights reserved |
| MF1S50yyX/V1, MIFARE Classic EV1 1K | Sector layout and access-condition decoding. Identification only; no authentication. | Link only · © NXP, all rights reserved |
| MF0ICU2, MIFARE Ultralight C | 3DES authentication, AUTH0/AUTH1 configuration, and the memory map. | Link only · © NXP, all rights reserved |
| MF0ULX1, MIFARE Ultralight EV1 | GET_VERSION, PWD_AUTH, READ_CNT, READ_SIG, and configuration pages. | Link only · © NXP, all rights reserved |
| NTAG213/215/216 | Variant detection, user-memory sizes, configuration pages, and password protection. | Link only · © NXP, all rights reserved |
| NTAG210/212 | Memory layout and configuration pages for NTAG210 and NTAG212. | Link only · © NXP, all rights reserved |
| NT3H1101/1201, NTAG I²C (product page) | NTAG I²C identification from the GET_VERSION product subtype. | Link only · © NXP. Discontinued; nxp.com no longer serves the datasheet PDF. |
| NT3H2111/2211, NTAG I²C plus | NTAG I²C plus identification and memory sizes. | Link only · © NXP, all rights reserved |
| NT4H2421Gx, NTAG 424 DNA | Native GetFileSettings (F5h) layout including the SDM fields, WriteData (8Dh), and access-right nibbles. | Link only · © NXP, all rights reserved |
| AN12196, NTAG 424 DNA features and hints | AuthenticateEV2First flow and session-key derivation vectors (SV1/SV2); NTAG 424 DNA GetFileSettings responses (Tables 7, 10, 11, 18) and the plain WriteData of the CC file (Table 24), including the SDMAccessRights nibble order. | Link only · © NXP, all rights reserved |
| AN12343, MIFARE DESFire Light features and hints | EV2 authentication parts 1 and 2, PCD capabilities, and EV2 secure messaging. | Link only · © NXP, all rights reserved |
| AN10922, Symmetric key diversifications | Background on DESFire key diversification. The library does not implement diversification. | Link only · © NXP, all rights reserved |
nxp.com rejects some scripted requests; the PDFs open in a browser.
Transit standards
| Document | Used for | Availability |
|---|---|---|
| KS X 6924, Korean transit card specification (Korean Standards Service Network) | T-Money, Cashbee, and other Korean card AIDs, purse info, and balance reads. | Link only · © KATS, paid. No stable per-standard URL; search the portal for KS X 6924. |
| SS 518:2014, CEPAS | Singapore CEPAS purse file layout and balance reads. | Link only · © Enterprise Singapore, paid |
Rakuten Edy, WAON and nanaco have no public specification. Their layouts come from community notes, linked only: the jennychan IC card format pages for Edy, WAON and nanaco, and WDIC “WAON”.
The findings behind these readers are on Transit Card Research.
Other RFCs and NIST publications
Also cited in the source. They are freely redistributable but not vendored.
- RFC 3279: algorithm identifiers for X.509 (RSA and DSA keys).
- RFC 5480: elliptic-curve SubjectPublicKeyInfo.
- RFC 5754: SHA-2 algorithm identifiers in CMS.
- RFC 5758: ECDSA with SHA-2 algorithm identifiers.
- FIPS 46-3 (withdrawn): DES and 3DES, used by BAC and legacy DESFire authentication.
Open-source cross-references
Used to cross-check behaviour against real cards. No code is copied; GPL code is linked only.
| Project | Used for | Licence |
|---|---|---|
| proxmark3: cmdhfmfu.c, desfirecore.c, desfiresecurechan.c, cmdhfmfdes.c | Ultralight/NTAG version tables and DESFire authentication, session keys, and secure channel. | GPL-3.0 · link only |
| nfcpy: tt2.py, tt4.py | Type 2 Tag NDEF handling and the Type 4 Tag mapping 1.0 fallback SELECT. | EUPL-1.1 · link only |
| neard plugins/nfctype5.c | Type 5 Tag NDEF detection and reads. | GPL-2.0 · link only. git.kernel.org returned HTTP 500 on 2026-10-16, so this links the GitHub mirror. |
| Metrodroid | China T-Union and KS X 6924 transit data and AIDs; Rakuten Edy service codes and history layout. | GPL-3.0 · link only |
| TRETJapanNFCReader | Rakuten Edy, WAON and nanaco service codes, point fields and history types. | MIT · link only |
| JMRTD | Chip authentication and eMRTD reader flow cross-check. | Open source · link only |