AT88SC1604 Card

Identification Number (Nc):An identification number with up to 56 bits is defined by the issuer and should be unique for each device.

Cryptogram (Ci):The 56-bit cryptogram is generated by the internal random generator and modified after each successful verification of the cryptogram by the chip, on host request. The initial value, defined by the issuer, is diversified as a function of the identification number. The 64 bits used in the authentication potocol consist of the 56-bit cryptogram and the 8-bit  uthentication Attempts Counter (AAC). Note that any change in the AAC status will change Ci for the next authentication attempt.

Secret Seed (Gc):The 64-bit secret seed, defined by the issuer, is diversified as a function of the identification number.

Memory Test Zone:The memory test zone is an 8-bit free access zone for memory and protocol test.

Password Set:The password set consists of two sets of two 24-bit passwords for read and write operations, defined by the issuer. The write password allows modification of the read and write passwords of the same set. By default, Password 1 is selected for all user zones.
Secure Code: The secure code is a 24-bit password defined by Atmel and is different for each card manufacturer. The Write 1 Password is used as the secure code until the personalization is over (PER = 0).
Attempts Counters: There are four 8-bit password attempts counters (PACs), one for each password, and one other 8-bit attempts counter for the authentication protocol (AAC). The attempts counters limit the number of consecutive incorrect code presentations allowed (currently
four).

Device Configuration Register:This 8-bit register allows the issuer to select the device configuration options (active-low).

Programmable Chip Select (CS0–CS3): The four most significant bits (b4–b7) of every command comprise the chip select address. All AT88SC153 devices will respond to the default chip select address of $B (1011). Each device will also respond to a second chip select address programmed into CS0–CS3 of the device configuration register. By programming each device to a unique chip select address, it is possible to connect up to 15 devices on the same serial data bus. The Write EEPROM and Verify Password commands can be used globally to all devices sharing the bus by using the default chip select address $B.
Eight Trials Allowed (ETA): If enabled (ETA = “0”), the ETA extends the trials limit to eight incorrect presentations allowed (passwords or authentication). If disabled (ETA = “1”), the PAC and AAC will allow only four incorrect attempts.
Unlimited Authentication Trials (UAT): If enabled (UAT = “0”), the AAC is disabled, allowing an unlimited number of authentication attempts. The PACs are not affected by the UAT bit.

Unlimited Checksum Reads (UCR): If enabled (UCR = “0”), the device will allow an unlimited number of checksums without requiring a new authentication.
Supervisor Mode Enable (SME): If enabled (SME = “0”), verification of the Write 1 password will allow the user to write and read the entire passwords zone (including the PACs).

After a valid authentication has been completed, the internal pseudo-random generator (PRG) will compute a secure checksum after one write command or several consecutive write commands. This checksum certifies that the data sent by the host during the write commands were received and therefore written in the memory. For every write command, the device clocks the data bytes into the PRG and its output is the Checksum Authentication Register (CAR), which is a function of Ci, Gc, Q, and the data bytes written.

After a valid authentication, any write command will enable the checksum mode and cause AAC to become the virtual location of the 8-byte CAR. When all data have been transmitted, the host may perform a Read CAR command by sending a read command with the AAC address ($20). The first 8 bytes transmitted by the device form the secure checksum.
The checksum mode allows only a single Read CAR operation for each valid authentication. The checksum mode is disabled at the end of the Read CAR command, whatever the number of bytes transmitted, or by a read command with any other address. The checksum mode can only be enabled once for a given authentication.
Note: During the Read CAR command, the internal address counter is incremented just as in a normal read command. Once 8 bytes have been transmitted, the checksum mode is automatically disabled, and if the host continues to request data, the device responds as to a normal read command, from the address $28.