MIFARE Classic 1K vs MIFARE DESFire Light
MIFARE Classic 1K offers 1024 bytes memory with Crypto-1 (broken) security, making it ideal for legacy transit cards, access control (legacy systems). MIFARE DESFire Light provides 640 bytes with AES-128 + LRP security, suited for transit tickets, loyalty, micro-payment tokens.
MIFARE Classic 1K
MIFARE DESFire Light
MIFARE Classic 1K vs MIFARE DESFire Light
MIFARE DESFire Light occupies an interesting position: it delivers genuine AES-128 security in a stripped-down, cost-optimized package aimed directly at high-volume transit tickets. Compared with Classic 1K, it offers better security at competitive cost.
Overview
MIFARE Classic 1K provides 1,024 bytes with Crypto-1Crypto-1Broken proprietary cipher in MIFARE Classic (reverse-engineered 2008)View full → security (broken). It is the dominant legacy transit and access card chip.
MIFARE DESFire Light provides 640 bytes of memory with AES-128 and Leakage Resilient Primitive (LRP) authenticationauthenticationIdentity verification of NFC tags/readers via passwords or cryptographyView full →. It implements a simplified subset of the DESFire command set: 3 standard data files, 1 backup data file, 1 value file, and 1 cyclic record file. The reduced feature set (no ISO 7816-4 SELECT, no multiple AIDs) lowers die cost compared to full DESFire, enabling competitive pricing for single-application disposable tickets.
Key Differences
- Security: Classic 1K is cryptographically broken. DESFire Light uses AES-128 with mutual authenticationmutual authenticationTwo-way identity verification between reader and tagView full → — no known practical attack.
- Memory: Classic 1K has 1,024 bytes; DESFire Light has 640 bytes.
- Feature set: DESFire Light is intentionally simplified — one application, fixed file structure. Classic 1K can technically host multiple sectors for different uses.
- Target use case: DESFire Light is designed for single-application disposable transit tickets (single journey, day pass). Classic 1K is a multi-use card platform.
- Cost: DESFire Light is priced to compete with or undercut Classic 1K at high volume, making the security upgrade essentially free in large transit deployments.
Technical Comparison
| Parameter | MIFARE Classic 1K | MIFARE DESFire Light |
|---|---|---|
| Memory | 1,024 bytes | 640 bytes |
| Security | Crypto-1 (broken) | AES-128 + LRP |
| Mutual authentication | No | Yes |
| Applications | Multiple sectors (minimal isolation) | Single application |
| File types | Fixed blocks | Standard, Backup, Value, Cyclic |
| Protocol | ISO 14443ISO 14443Standard for contactless smart cards at 13.56 MHz (Types A and B)View full →-3A | ISO 14443-4 (T=CL) |
| NDEF support | No | Limited |
| Target use | Legacy multi-use card | Disposable transit ticket |
| Typical cost (volume) | $0.10–$0.25 | $0.12–$0.28 |
Use Cases
DESFire Light was created specifically to replace Classic 1K in disposable and limited-use transit ticket applications — single-journey cards, weekly passes — where Classic 1K's insecurity is a liability but full DESFire EV3's cost is not justified for a card that will be discarded after a few rides.
Classic 1K remains in multi-year legacy replacement programs where operator infrastructure cannot yet support DESFire.
Verdict
For new single-application transit ticket programs, DESFire Light is the direct Classic 1K replacement: comparable cost, genuine AES-128 security, and no cryptographic vulnerabilities. Classic 1K should only persist in environments locked to legacy readers that cannot be upgraded.
Recomendación
Choose MIFARE Classic 1K when you need massive installed base, widely available; choose MIFARE DESFire Light when you need DESFire security in a cost-optimized package.