1.0. Introduction The ACR3x Mobile Card Reader serves as an interface for the communication between a mobile device and a magnetic/contact/contactless card. Different types of cards have different commands and communication protocols, and the ACR3x establishes a uniform interface from the mobile device to the card.
Supports Android™ 2.3 and above • Supports iOS 5.0 and above • Compliant with the following standards: VCCI RoHS 2 REACH Visit www.acs.com.hk for the list of supported devices Same as above Page 6 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
EMV™ Contact Level 1 Microsoft WHQL ® RoHS 2 REACH Visit www.acs.com.hk for the list of supported devices; PC/SC and CCID support are not applicable Same as above Page 7 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
ISO 18092 ISO 14443 EN 6095/IEC 60950 VCCI RoHS 2 REACH Topaz type is excluded. Please contact ACS for more details. Visit www.acs.com.hk for the list of supported devices. Same as above Page 8 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk...
4.0. System Block Design 4.1. ACR31 ISO7810/7811 Magnetic Head Magnetic Stripe Decoder IC Power Management Phone Jack Mobile Device Battery ACR31 Figure 1: ACR31 Architecture Page 11 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
4.2. ACR32 ISO7810/7811 ISO7816 Magnetic Head ACR3901 Smart Card Reader IC Magnetic Stripe Decoder IC Phone Jack Power Re-chargeable Mobile Device Management battery ACR32 Figure 2: ACR32 Architecture Page 12 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
ISO7810/7811 13.56 MHz frequency Magnetic Head Built-in antenna Magnetic Stripe ACR1251 Decoder IC RF chip Phone Jack Power Re-chargeable Mobile Device Management battery ACR35 Figure 3: ACR35 Architecture Page 13 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Since the magnetic fields of Hi-Co and Lo-Co cards are different, a magnetic stripe decoder IC with automatic gain control can be used in the design to cater these two types of cards. Page 14 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Note: The ACR32 never switches on the power supply to the inserted card by itself. The controlling computer through the proper command sent to the reader must explicitly do this. Page 15 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
The sampling frequency should be at least double the clock frequency (Nyquist rate) used in the Manchester coding scheme. After sampling the signals, the data encoded in the signals could be received by determining the logical zero-crossing time. Page 16 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
7.0. Application Programming Interface Please refer to the HTML files included in the ACR3x Android Library or ACR3x iOS Library. The libraries may be downloaded from ACS website. Page 17 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Byte Address Memory address location of the memory card MEM_L Length of data to be written to the memory card Byte x Data to be written to the memory card Page 19 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Page 20
Response Data Format Where: SW1 SW2 = 90 00h if no error Page 20 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
= D0h for 32, 64, 128, 256, 512 kilobit iic card = 1101 000*b for 1024 kilobit iic card, where * is the MSB of the 17 bit addressing Page 22 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Page 23
Length of data to be written to the memory card Byte x Data to be written to the memory card Response Data Format Where: SW1 SW2 = 90 00h if no error Page 23 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
= B3h for reading zone 11b = B4h for reading fuse Byte Address Memory address location of the memory card MEM_L Length of data to be read from the memory card Page 24 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Length of data to be written to the memory card MEM_D Data to be written to the memory card Response Data Format Where: SW1 SW2 = 90 00h if no error Page 25 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
8.3.5. INITIALIZE_AUTHENTICATION Command Format Pseudo-APDU Q(0) Q(1) … Q(7) Where: Q(0),Q(1)…Q(7) Host random number, 8 bytes Response Data Format Where: SW1 SW2 = 90 00h if no error Page 26 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Byte Address b is the memory address location of the memory card = 1000 0000b for reading fuse MEM_L Length of data to be read from the memory card Page 28 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Length of data to be written to the memory card Byte x Data to be written to the memory card Response Data Format Where: SW1 SW2 = 90 00h if no error Page 29 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Other values indicate the current verification has failed. 8.4.5. INITIALIZE_AUTHENTICATION Command Format Pseudo-APDU Q(0) Q(1) … Q(7) Where: Byte Address Memory address location of the memory card Q(0),Q(1)…Q(7) Host random number, 8 bytes Page 30 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Q1(7) Where: Byte Address Memory address location of the memory card Q1(0),Q1(1)…Q1(7) Host challenge, 8 bytes Response Data Format Where: SW1 SW2 = 90 00h if no error Page 31 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Length of data to be read from the memory card Response Data Format BYTE 1 … BYTE N Where: BYTE x Data read from memory card SW1 SW2 = 90 00h if no error Page 32 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
MEM_L = 1 + INT( (number of bits - 1)/8 ) For example, to read 8 protection bits starting from memory 0010h, the following pseudo-APDU should be issued: FF B2 00 10 01h Page 33 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Length of data to be written to the memory card Byte x Data to be written to the memory card Response Data Format Where: SW1 SW2 = 90 00h if no error Page 34 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
2. Present the specified code to the card. 3. Try to erase the presentation error counter. Command Format Pseudo-APDU CODE MEM_L Byte 1 Byte 2 Where: CODE Two bytes secret code (PIN) Page 35 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Page 36
= Error Counter. FFh indicates successful verification. 00h indicates that the password is locked (or exceeded the maximum number of retries). Other values indicate that current verification has failed. Page 36 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Length of data to be read from the memory card Response Data Format BYTE 1 … BYTE N Where: BYTE x Data read from memory card SW1 SW2 = 90 00h if no error Page 37 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Response Data Format PROT 1 PROT 2 PROT 3 PROT 4 Where: PROT y Bytes containing the protection bits from protection memory SW1 SW2 = 90 00h if no error Page 38 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Byte Address = 000A b (00h to 1Fh) is the protection memory address location of the memory card MEM_L Length of data to be written to the memory card Page 39 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
= Error Counter. 07h indicates that the verification is correct. 00h indicates the password is locked (exceeded the maximum number of retries). Other values indicate that the current verification has failed. Page 40 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Command Format Pseudo-APDU CODE MEM_L Byte 1 Byte 2 Byte 3 Response Data Format Where: SW1 SW2 = 90 00h if no error Page 41 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Length of data to be read from the memory card Response Data Format BYTE 1 … BYTE N Where: BYTE x Data read from memory card SW1 SW2 = 90 00h if no error Page 42 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
02h: Write with backup enabled (SLE4436, SLE5536 and SLE6636 only) 03h: Write with carry and with backup enabled (SLE4436, SLE5536 and SLE6636 only) BYTE Byte value to be written to the card Page 43 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
3. Generate the specified number of CLK pulses for each bit of authentication data computed by the card. 4. Read 16 bits of authentication data from the card. 5. Reset the card to normal operation mode. Page 44 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Page 45
16 bits of authentication data computed by the card. The LSB of BYTE 1 is the first authentication bit read from the card. SW1 SW2 = 90 00h if no error Page 45 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Length of data to be read from the memory card Response Data Format BYTE 1 … BYTE N Where: BYTE x Data read from memory card SW1 SW2 = 90 00h if no error Page 46 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
To erase error counter or user area, please use the VERIFY_USER_CODE command as specified in the Section 8.8.5. Command Format Pseudo-APDU Byte Address MEM_L Where: Byte Address Memory byte address location of the scratch pad Typical value is 02h Page 47 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
After SW1 SW2 = 90 00h has been received, read back the User Error Counter to check if the VERIFY_USER_CODE is correct. If User Error Counter is erased and is equal to “FFh,” the previous verification is successful. Page 48 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
After SW1 SW2 = 90 00h has been received, read back the Application Area can check if the VERIFY_MEMORY_CODE is correct. If all data in Application Area is erased and is equal to “FFh,” the previous verification is successful. Page 49 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Length of data to be read from the memory card Response Data Format BYTE 1 … BYTE N Where: BYTE x Data read from memory card SW1 SW2 = 90 00h if no error Page 50 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Section 8.9.6. 3. VERIFY_SECURITY_CODE commands as specified in Section 8.9.7. Command Format Pseudo-APDU Byte Address MEM_L Where: Byte Address Memory byte address location of the word to be erased. Page 51 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Address AT88SC101: Erase Application Zone with EC function disabled AT88SC102: Erase Application Zone 1 AT88SC102: Erase Application Zone 2 with EC2 function disabled AT88SC1003: Erase Application Zone 1 Page 52 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Error Counter LEN Length of presentation error counter in bits. The value should be 80h always. Byte Address Byte address of the Application Zone Key in the card Page 53 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Byte 2 Where: Error Counter LEN Length of presentation error counter in bits Byte Address Byte address of the key in the card CODE 2 bytes Security Code Page 54 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
//To get the serial number of the PICC card UINT8 GET_UID[5]={FF, CA, 00, 00, 00h}; //To get the ATS of the ISO14443 A contactless card UINT8 GET_ATS[5]={FF, CA, 01, 00, 00h}; Page 57 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Load Authentication Keys Response Format (2 bytes) Response Data Out Result Load Authentication Keys Response Codes Results SW1 SW2 Meaning Success 90 00h The operation was completed successfully Page 59 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Value Block Operation Response Format (2 bytes) Response Data Out Result Value Block Operation Response Codes Results SW1 SW2 Meaning Success 90 00h The operation was completed successfully. Error 63 00h The operation failed. Page 64 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Example 2: Decimal 1 = {00h, 00h, 00h, 01h} Value Read Value Block Response Codes Results SW1 SW2 Meaning Success 90 00h The operation was completed successfully. Error 63 00h The operation failed. Page 65 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
{FF B1 //Copy the value from value block to value block APDU = {FF D7 04 02 //Increment the value block APDU = {FF D7 00 00 00 Page 66 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
>> 1A F7 F3 1B CD 2B A9 58h [90 00h] Note: For ISO 14443-4 Type A tags, the ATS can be obtained by using the APDU “FF CA 01 00 00h.” Page 67 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
(RND_B[0:15]). The final sequence of 32 bytes of random numbers (RND_C[0:31]), that is: RND_C[0:31] = RND_B[0:15] + RND_A[0:15], will undergo encryption operation with the Customer Master Key being used in the server and the final Page 69 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Send authentication Transmitted request message through the bridging device Answer to the request message Send authentication response message Answer to the authentication response message Figure 5: Authentication Procedure Page 70 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Master Key before any further injection of sensitive data can proceed. 10.3. AES Key Injection At the time ACR3x is manufactured in the factory, there is a default ACS AES Key being loaded into the flash memory. Customer can change this key to any values after authentication.
DUKPT for unsuccessful card swipe is to allow the mobile device application to prompt the user to swipe again without pushing the useless data to the backend server, while maintaining a more synchronized encryption counter with the server. Page 72 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
It should be noted that when there is data error during card swipe, the track data field will be filled with zeros and only the error will be reported in the message. Page 73 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Bit 4 Bit 3 Bit 2 Bit 1 LRC error End Sentinel error Start Sentinel error Notes: 1. Bits 7 to 1 are error codes. 2. Error-free = 0 Page 76 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Microsoft is a registered trademark of Microsoft Corporation in the United States and/or other countries. MIFARE, MIFARE Classic, MIFARE DESFire EV1, MIFARE Ultralight, MIFARE Ultralight C are registered trademarks of NXP B.V. and are used under license. Page 77 of 77 ACR3x – Reference Manual info@acs.com.hk www.acs.com.hk Version 1.03...
Need help?
Do you have a question about the ACR3x mobile and is the answer not in the manual?
Questions and answers