MIFARE DESFire EV3 - AES-128 Contactless Multi-Application IC | NXP
MPN: MIFARE DESFire EV3 ✓ Active| Qty | Unit Price | Extended |
|---|---|---|
| 1 | $1.85 | $1.85 |
| 10 | $1.55 | $15.50 |
| 100 | $1.28 | $128.00 |
| 500 | $1.08 | $540.00 |
| 1,000 | $0.94 | $940.00 |
| 5,000 | $0.82 | $4,100.00 |
MIFARE DESFire EV3 Overview
A contactless smartcard IC is a passive NFC chip that harvests energy from a reader's RF field, communicates over a 13.56 MHz HF air interface, and stores credentials and application data in secure non-volatile memory. MIFARE DESFire EV3 belongs to the NXP MIFARE DESFire platform family within the broader contactless smart card hierarchy, sitting between classic MIFARE Classic products and secure element SE chips, designed for high-throughput transit fare collection, secure access management, multi-application enterprise credentialing and NFC mobile deployment via MIFARE 2GO.
Key features include AES-128 hardware acceleration alongside legacy 3DES support, Secure Dynamic Messaging (SDM) that mirrors secure OTPs as text into the NDEF message (compatible with NTAG DNA readers), SUN (Secure Unique NDEF) message authentication, mutual three-pass authentication per ISO/IEC 7816-4, and full backward compatibility with MIFARE DESFire EV1 and EV2 command sets. The chip is NFC Forum Type 4 Tag certified (Certificate ID 58652) and supports configurable ATS information for card personalization across diverse reader infrastructures.
Typical applications include contactless transit ticketing, electronic toll collection, employee and student ID, hotel key cards, citizen eID cards, micropayment loyalty schemes, and mobile credential provisioning via NXP's MIFARE 2GO service. Applications running on DESFire EV3 can be deployed to NFC mobile phones without silicon changes, allowing issuers to manage physical and mobile credentials from a single personalization workflow.
When designing with DESFire EV3, ensure the inlay antenna geometry matches the target reader's RF field strength, and verify that the SAM (Secure Access Module) on the reader side supports EV3's full command space including EV2/EV3 transaction MAC commands. Migration from EV1 or EV2 is largely command-compatible but requires re-personalization of application keys. This page synthesizes distributor availability, cross-family alternatives and design trade-offs not found in the manufacturer datasheet.
Drop-in alternatives for MIFARE DESFire EV3 — same package, pin-to-pin compatible. Different-package parts requiring PCB rework are excluded.
Quick Comparison Tool — Select alternative parts for side-by-side comparison:
MIFARE DESFire EV2
✅ Drop-In📋 Reference alternative (not in catalog)
MIFARE DESFire EV1
✅ Drop-In📋 Reference alternative (not in catalog)
MIFARE DESFire D40
✅ Drop-In📋 Reference alternative (not in catalog)
MIFARE Plus EV2
✅ Drop-In📋 Reference alternative (not in catalog)
NTAG 424 DNA
✅ Drop-In📋 Reference alternative (not in catalog)
MIFARE DESFire EV3 Specifications (manufacturer-published)
| Product Type | Contactless multi-application IC (NFC smart card chip) |
| Family | MIFARE DESFire (MF3D(H)x3) |
| Air Interface | ISO/IEC 14443-4 Type A, 13.56 MHz |
| Operating Distance | Up to 10 cm (typical, depends on antenna geometry) |
| EEPROM Memory | 2 KB / 4 KB / 8 KB / 32 KB options (MF3D23/MF3D43/MF3D83/MF3DR3 per family naming) |
| Cryptography | AES-128 and 3DES hardware accelerators |
| Authentication | Mutual three-pass authentication (ISO/IEC 7816-4) |
| Common Criteria Certification | EAL5+ |
| NFC Forum Certification | Type 4 Tag (Certificate ID 58652) |
| Unique Serial Number | 7-byte UID, with optional RANDOM ID for privacy |
| Secure Messaging | Secure Dynamic Messaging (SDM), SUN (Secure Unique NDEF), transaction MAC |
| Backward Compatibility | MIFARE DESFire EV1 and EV2 command sets |
| Configurable ATS | Yes (Applicant Tracking System for personalization) |
| Mobile Deployment | MIFARE 2GO service for NFC phone provisioning |
| Operating Temperature | -25C to +70C (inlay/card) |
| Package | Wafer / bumped die / contactless inlay module (no conventional SMD pinout) |
| RoHS Status | Compliant |
MIFARE DESFire EV3 Interfaces & Connectors
No manufacturer-published interface list is available for MIFARE DESFire EV3. Refer to the manufacturer documentation for connector and header details.
Refer to the manufacturer documentation for the full expansion header pinout and connector pin numbering.
Power & Thermal Characteristics
| Operating Temperature | -25C to +70C (inlay/card) |
Power input and thermal parameters for MIFARE DESFire EV3 as published by the manufacturer.
Typical Applications
MIFARE DESFire EV3 is suitable for 7 applications: Public Transit Ticketing, Enterprise Access Control & Employee ID, Hotel Key Cards & Hospitality, Student ID / Campus Cards, Micropayment & Loyalty, Citizen eID & Government Credentialing, Mobile Credential Provisioning via MIFARE 2GO.
Public Transit Ticketing
MIFARE DESFire EV3 fits transit fare collection because its ISO/IEC 14443-4 Type A air interface is interoperable with the vast installed base of transit readers, transaction times stay under 200 ms at typical antenna geometries, and its EAL5+ Common Criteria certification meets procurement requirements from most major transit operators. Unlike MIFARE Classic, DESFire EV3 supports transaction MAC commands that protect against fare evasion and replay attacks in open-gate systems where the contactless interface is exposed. The flexible file system allows a single card to host multiple transit operator applications (regional bus, metro, ferry, bike-share) under one credential. Compared to EV2, the EV3 SUN feature lets operators display a unique tap-confirmation token in NFC apps, enabling real-time passenger notifications. Recommended companion MPNs: PN5180 (NXP NFC frontend), MIFARE 2GO (mobile deployment service).
Recommended
Enterprise Access Control & Employee ID
DESFire EV3 is widely deployed in enterprise physical access control systems because its AES-128 hardware crypto and EAL5+ certification satisfy the security policies of most corporate IT and federal-tenant environments, while its multi-application file system allows a single badge to host building access, IT system SSO, parking and cafeteria payment without reissuance. The optional RANDOM UID feature protects employee privacy in public-facing tap environments where badge UID leakage is a concern. Secure Dynamic Messaging (SDM) lets a DESFire EV3 credential serve as a one-time-password generator to two-factor authentication systems, replacing or supplementing software TOTP apps. Compared to MIFARE Classic, EV3 prevents cloning attacks and is resistant to the Crypto-1 weaknesses that have driven most enterprise migrations. Recommended companions: CLRC663 (NXP reader IC), NXP SAM AV2 (Secure Access Module for key diversification).
Recommended
Hotel Key Cards & Hospitality
DESFire EV3 is increasingly the chip of choice for premium hotel key cards because the secure messaging model allows front-desk encoders to issue time-bounded guest keys without exposing the master property key, and the proximity check feature detects relay attacks against in-room tap readers. Hotel groups can re-issue or extend stays via a single EV3 credential that holds room access, lobby amenities, loyalty wallet and check-out data. Compared to legacy MIFARE Classic hotel keys, EV3 supports per-guest AES session keys and audit logging on the credential itself. Recommended companions: PN7462 (NFC reader with integrated MCU).
Recommended
Student ID / Campus Cards
Universities and K-12 systems use MIFARE DESFire EV3 because its multi-application model lets a single student card serve dorm access, cafeteria meal plans, library checkout, exam attendance and bus transit, each with its own cryptographic key set managed independently by the relevant campus department. The 7-byte UID allows unique student identification across systems without privacy-violating fixed identifiers, and EAL5+ certification is increasingly required for FERPA-aligned education procurement. Compared to legacy MIFARE Classic 1K/4K, EV3 offers stronger key diversification and tamper-evident transaction logs. Recommended companions: PN5180 (NFC reader frontend for high-throughput campus readers).
Recommended
Micropayment & Loyalty
Retailers and transit-adjacent micropayment schemes use DESFire EV3 because the transaction MAC prevents counterfeit token replay and the secure file system supports e-purse and loyalty point balances on the same card as access credentials. Pre-authorized stored-value wallets can be reloaded via NFC phones through MIFARE 2GO, extending the merchant acceptance network without additional hardware. Compared to MIFARE Plus EV2, DESFire EV3 supports more flexible application-level balance updates and richer audit trails. Recommended companions: PN7462 (NFC reader with integrated payment stack), NXP EdgeLock SE050 (secure element for vault).
Recommended
Citizen eID & Government Credentialing
National eID, ePassport and government benefit programs use DESFire EV3 because its EAL5+ Common Criteria certification is one of the few contactless IC certifications that satisfies government procurement frameworks, and its AES-128 hardware crypto aligns with NIST recommendations for federal identity programs. The SUN feature can carry a unique citizen tap token for offline verification, supporting regional benefit delivery in low-connectivity areas. Compared to proprietary government smart card ICs, EV3 offers a broader reader ecosystem and lower total cost of ownership. Recommended companions: NXP SAM AV3 (Secure Access Module, government-grade key handling).
Recommended
Mobile Credential Provisioning via MIFARE 2GO
Issuers use DESFire EV3 in conjunction with the MIFARE 2GO service to provision the same credential - transit pass, employee badge, student ID - to both a physical EV3 card and to NFC smartphones using Host Card Emulation. This dual-medium strategy lets organizations issue credentials once in their personalization pipeline and reuse them on Apple Wallet, Google Wallet and OEM wallets, eliminating the need for separate mobile credential platforms. Compared to proprietary mobile credentials, the EV3 + MIFARE 2GO model preserves the existing reader infrastructure and avoids lock-in to a single handset OEM.
Recommended
Recommended Products Summary
Engineering reference data for MIFARE DESFire EV3 — comparison, design guidance, and compliance information.
Selection Guide
Comparison with Alternatives
| Parameter | This Product | MIFARE DESFire EV2 | MIFARE DESFire EV1 | MIFARE DESFire D40 | MIFARE Plus EV2 | NTAG 424 DNA |
|---|---|---|---|---|---|---|
| Brand | NXP Semiconductors | NXP Semiconductors | NXP Semiconductors | NXP Semiconductors | NXP Semiconductors | NXP Semiconductors |
| Package | Wafer / Die / Contactless Inlay | Wafer / Die / Inlay | Wafer / Die / Inlay | Wafer / Die / Inlay | Wafer / Die / Inlay | Wafer / Die / Inlay |
| Air Interface | ISO/IEC 14443-4 Type A | ISO/IEC 14443-4 Type A | ISO/IEC 14443-4 Type A | ISO/IEC 14443-4 Type A | ISO/IEC 14443-4 Type A | ISO/IEC 14443-4 Type A / NFC Forum Type 4 |
| Memory | 2 / 4 / 8 / 32 KB EEPROM | 2 / 4 / 8 KB | 2 / 4 / 8 KB | 4 KB fixed | 1 / 2 / 4 KB | ~416 bytes |
| Cryptography | AES-128 + 3DES | AES-128 + 3DES | AES-128 + 3DES | AES-128 + 3DES | AES-128 + CRYPTO1 | AES-128 |
| EAL Certification | EAL5+ | EAL5+ | EAL4+ | EAL4+ | EAL5+ | EAL4+ (CC EAL3+ AVA_VAN.4) |
| SUN / SDM Support | Yes (SUN + SDM) | SDM only | No | No | No | SUN only |
| Proximity Check | Yes | No | No | No | No | No |
| Mobile Credential (MIFARE 2GO) | Yes | Yes | Limited | No | Yes | Yes (via NTAG Connect) |
Key Differentiators
- SUN message authentication support (vs MIFARE DESFire EV2)
- Proximity check against relay attacks (vs MIFARE DESFire EV1 / D40)
- Larger available memory variant (32 KB) (vs MIFARE Plus EV2)
Design Notes
DESFire EV3 inlay antenna coil geometry determines both operating distance and transaction time. NXP recommends a 6-8 turn coil with 35-45 mm outer diameter and 0.1-0.3 mm track width for standard 13.56 MHz credit-card-form-factor credentials. Antenna inductance in the 2-5 uH range matches the chip's internal resonance capacitor for peak coupling at typical reader field strengths; deviations beyond +/- 20% reduce operating distance significantly.
Migrating from MIFARE Classic 1K/4K to DESFire EV3 requires more than swapping chips - the sector/block AES/CSV data layout is fundamentally different (file-based vs sector-based), and reader-side SAM AV2/AV3 firmware must be updated to interpret the new Application ID and File ID command space. Treat any 'drop-in MIFARE Classic replacement' vendor claim with skepticism and validate the full read/write command flow on your reader hardware before committing to fleet rollout.
DESFire EV3 transaction MAC features (transaction MAC, full MAC, SDM) add a few hundred milliseconds of cryptographic computation per tap, but the air-interface portion of the transaction remains dominated by reader modulation overhead. Tuning the reader's modulation index to 8-30% per ISO/IEC 14443-2 minimizes the analog attack-decoding window during the initial anticollision phase, which is the primary vector for relay attacks even on AES-128-secured credentials.
Compliance Information
RoHS compliant per NXP product page. Common Criteria EAL5+ certified per NXP datasheet. ISO/IEC 14443-4 Type A, ISO/IEC 7816-4 mutual authentication compliance. NFC Forum Type 4 Tag certified (Certificate ID 58652).
