DESFire Command Set

DESFire exposes a native application-layer command set on top of ISO/IEC 14443-4. Each command has a one-byte code. The EV1 / EV2 / EV3 columns show whether a command exists on that generation — Yes, No, or Yes with a noted behavioural difference. A handful of commands gained their first support in EV2 (delegated applications, multiple key sets, Transaction MAC, Proximity Check), and EV3 mostly refines existing commands rather than adding many new ones.

Where two codes are shown (for example 0xBD / 0xAD), the command has more than one documented opcode form. The ISO 7816-4 class lists the standards-wrapped equivalents (SELECT, READ BINARY, READ RECORD, INTERNAL / EXTERNAL AUTHENTICATE) that let a DESFire card be driven by a generic ISO 7816-4 stack. This is an architecture-level interface reference: byte-level framing, secure-messaging payloads, and exploit-relevant detail are intentionally out of scope.

The command table above is grouped by functional class. Filtering by class is the fastest way to answer “what can I do at this point in the session?” — because DESFire gates most commands behind authentication state and per-file access rights.

• Security & authentication — AuthenticateISO, AuthenticateAES, and the EV2 AuthenticateEV2First / EV2NonFirst handshakes that open a secure-messaging session, plus ChangeKey, ChangeKeySettings, and GetKeyVersion. These establish the session keys that authorise everything else.
• PICC & application management — CreateApplication, DeleteApplication, SelectApplication, GetApplicationIDs, GetVersion, and FormatPICC. EV2 adds delegated applications and multiple key sets at this layer.
• File management — the Create*File family (standard-data, backup-data, value, linear-record, cyclic-record), GetFileIDs, GetFileSettings, and ChangeFileSettings. File settings carry the access-rights nibbles that decide which key may read, write, or change a file.
• Data manipulation — ReadData / WriteData, the value-file operations GetValue, Credit, Debit, and LimitedCredit, the record operations ReadRecords / WriteRecord / ClearRecordFile, and the transaction boundary CommitTransaction / AbortTransaction. Value and backup files only become durable once the transaction is committed.
• ISO 7816-4 wrapped — the standards-mode equivalents (ISOSelectFile, ISOReadBinary, ISOReadRecords, ISOUpdateBinary, ISOInternalAuthenticate) that let a generic ISO 7816-4 middleware stack drive a DESFire card without speaking the native protocol.

If you are bringing up a reader, a transit validator, or a personalisation script, this reference answers three practical questions quickly: does the command exist on the generation you are targeting, what is its one-byte code, and which functional class (and therefore which authentication state) it belongs to. For the response side of each exchange, pair it with the DESFire status decoder; for file access-rights bytes, the access-rights decoder; and for generation-level context, DESFire EV1/EV2/EV3 architecture and the generation-differences write-up.