Skip to main content

Credential Profiles

Scope note: this page describes the credential-profile surface exposed through proto/org.proto.

Overview​

Credential profiles configure how Link and firmware read a generic DESFire credential.

At a high level, a credential profile defines:

  • how the DESFire application is selected
  • how authentication is performed
  • whether a privacy application is used first
  • what file data is read
  • how credential bytes are extracted
  • how the transaction is completed

Current API Surface​

The current Org API exposes credential profiles through:

  • Org.UpdateCredentialProfiles(UpdateCredentialProfilesRequest)
  • DeviceSummary.credential_profiles
  • credential_profile.proto
  • credential_profile_configurations.proto
  • keys.GenericDesfire

UpdateCredentialProfiles​

UpdateCredentialProfiles sends a complete credential-profile set to one or more devices.

Request shape:

  • device_ids: target devices
  • profile_set: complete DesfireProfileInputSet to apply

DesfireProfileInputSet contains:

  • profiles[]: repeated DesfireProfileInput
  • ecp: optional bytes payload

Each DesfireProfileInput contains:

  • configurations: lastlock.api.DesfireProfileConfigurations
  • keys: lastlock.api.keys.GenericDesfire

Configuration Model​

DesfireProfileConfigurations defines the generic DESFire transaction settings.

Important fields include:

  • select_method, app_aid, df_name
  • privacy_aid, privacy_auth_method, privacy_div_method, privacy_key_num_on_card
  • get_card_uid
  • cred_auth_method, cred_div_method, cred_key_num_on_card
  • file_number, read_offset, read_length
  • credential_offset, credential_length
  • commit_type

The related enums are:

  • SelectMethod
  • AuthMethod
  • DivMethod
  • CommitType

Key Material​

Credential profiles use lastlock.api.keys.GenericDesfire key material:

  • credential_key: required AES-128 credential authentication key
  • privacy_key: optional AES-128 privacy authentication key

Those keys are supplied alongside the profile configuration in each DesfireProfileInput.

Device Summary​

DeviceSummary.credential_profiles contains the last DesfireProfileSet sent for the device.

Guidance​

When using credential profiles:

  • treat UpdateCredentialProfiles as a full profile-set update for the target devices
  • keep each profile’s configurations and keys paired correctly
  • use DeviceSummary.credential_profiles when you need to inspect the last profile snapshot sent to a device