Updated: January 2025
Current command:
hf mfdes changekey --help
Change PICC/Application key. Needs to provide keynum/key for a valid authentication (may get from default parameters). usage: hf mfdes changekey [--kdf <none|AN10922|gallagher>] options: -h, --help This help -a, --apdu Show APDU requests and responses -v, --verbose Verbose output -n, --keyno <dec> Key number -t, --algo <DES|2TDEA|3TDEA|AES> Crypt algo -k, --key <hex> Key for authenticate (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes) --kdf <none|AN10922|gallagher> Key Derivation Function (KDF) -i, --kdfi <hex> KDF input (1-31 hex bytes) -m, --cmode <plain|mac|encrypt> Communicaton mode -c, --ccset <native|niso|iso> Communicaton command set --schann <d40|ev1|ev2|lrp> Secure channel --aid <hex> Application ID of application (3 hex bytes, big endian) --isoid <hex> Application ISO ID (ISO DF ID) (2 hex bytes, big endian). --oldalgo <DES|2TDEA|3TDEA|AES> Old key crypto algorithm --oldkey <old key> Old key (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes) --newkeyno <dec> Key number for change --newalgo <DES|2TDEA|3TDEA|AES> New key crypto algorithm --newkey <hex> New key (HEX 8(DES), 16(2TDEA or AES) or 24(3TDEA) bytes) --newver <hex> Version of new key (1 hex byte) examples/notes: Change crypto algorithm for PICC key is possible, but for APP keys crypto algorithm is set by createapp command and can't be changed wo application delete hf mfdes changekey --aid 123456 -> execute with default factory setup. change des key 0 in the app 123456 from 00..00 to 00..00 hf mfdes changekey --isoid df01 -t aes --schann lrp --newkeyno 01 -> change key 01 via lrp channelhf mfdes changekey -t des --newalgo aes --newkey 11223344556677889900112233445566 --newver a5 -> change card master key to AES one hf mfdes changekey --aid 123456 -t aes --key 00000000000000000000000000000000 --newkey 11223344556677889900112233445566 -> change app master key hf mfdes changekey --aid 123456 -t des -n 0 --newkeyno 1 --oldkey 5555555555555555 --newkey 1122334455667788 -> change key 1 with auth from key 0 hf mfdes changekey --aid 123456 -t 3tdea --newkey 112233445566778899001122334455667788990011223344 -> change 3tdea key 0 from default 00..00 to provided