MIFARE Ultralight EV1 vs MIFARE DESFire EV3

MIFARE Ultralight EV1 vs MIFARE DESFire EV3

MIFARE Ultralight EV1 and MIFARE DESFire EV3 represent the floor and near-ceiling of the NXP NFC product line respectively. Comparing them is useful for understanding the full capability range available in the NFC chip ecosystem and for calibrating where your application should sit on the cost-security continuum.

Overview

MIFARE Ultralight EV1: 48–128 bytes, 32-bit password, 24-bit monotonic counter, OTP. Minimal transit token designed for cost-minimum single-use or limited-use ticket deployments in controlled operator environments. NFC ForumNFC ForumIndustry body developing NFC standards, specifications, and certifications since 2004View full → Type 2 compliant with native NDEF support.

MIFARE DESFire EV3: 2–32 KB EEPROMEEPROMNon-volatile memory technology retaining data without powerView full →, AES-128 with SCP03 full-session encrypted secure channel, hardware proximity check for relay attack protection, up to 28 independent applications with separate AES key sets, Common Criteria EAL5+ certification. The most capable multi-application NFC smart card IC in NXP's commercial product line. Deployed in national transit programs, government ID, and high-security corporate access control.

Key Differences

• Security gap: 32-bit password vs AES-128 with SCP03 full-session encryption and hardware proximity check. This represents the entire security spectrum of the NXP NFC product line compressed into one comparison.
• Memory: 128 bytes vs 32 KB — a 250x difference. DESFire EV3 can hold transit balance, loyalty balance, access credentials, and e-wallet data for multiple independent applications on one card.
• Multi-application: Ultralight EV1 has none. DESFire EV3 supports 28 independent applications with separate AES key domains — each application is isolated and cannot access another application's data.
• SCP03 secure channel: DESFire EV3 encrypts and MACs the entire card-reader session. Ultralight EV1 has no session-level security.
• Common Criteria: Ultralight EV1 has none. DESFire EV3 is EAL5+ — required by governments for national identity and high-security transit.
• Cost: $0.05–$0.12 vs $1.50–$4.00 — up to 80x difference.

Technical Comparison

Use Cases

MIFARE Ultralight EV1 is appropriate for the cost-minimum end: single-use transit tickets, disposable event wristbands, and low-value promotional tokens where the operator controls the entire reader infrastructure and cost per tag is the dominant constraint.

MIFARE DESFire EV3 is appropriate for the security-maximum end: national transit programs requiring EAL5+ procurement certification, government employee badges, corporate multi-application cards where SCP03 session security and relay attack protection are required, and any deployment where the card is carried for years with multiple independent AES-protected application domains.

Verdict

Ultralight EV1 and DESFire EV3 serve opposite ends of the NFC deployment spectrum. Choose Ultralight EV1 when cost is the primary constraint and the token is disposable with limited security requirements in a fully operator-controlled environment. Choose DESFire EV3 when government-grade security certification, multi-application isolation, relay attack protection, and SCP03 secure channels are required — and when the card lifetime justifies the premium. Most real-world deployments fall somewhere between these extremes — use this comparison to calibrate your position on the cost-security continuum and select the appropriate chip for your security budget and threat model.