NFC RATS, ATS, and ISO-DEP

Connect POOM to a compatible NFC Type A tag and study the RATS and ATS exchange that establishes ISO-DEP communication.

Now the most interesting part begins. In the first labs, POOM found a card, obtained its UID, and selected it. Those steps explain how an NFC conversation starts.

Now we want to do more than ask:

"Is there a card?"

or:

"Which card is it?"

We want to start talking to it. First, we will see how a compatible card enters ISO-DEP. That prepares a channel for exchanging application data.

  1. Find the card.
  2. Select it.
  3. Prepare the communication channel.
  4. Send a command.
  5. Receive a response.

Lab 4.1 - RATS, ATS, and ISO-DEP

Selecting a card does not yet mean that we can send application commands. The new question is:

"I selected you. Can we start a more complete conversation?"

Three new names appear:

RATS
ATS
ISO-DEP

Goal

Understand:

  • what happens after SELECT and SAK;
  • what RATS and ATS mean;
  • what ISO-DEP is used for;
  • why this step is needed before sending APDUs.

What is ISO-DEP?

Until now, POOM was finding and selecting a card. ISO-DEP prepares communication that can carry commands and responses from a higher layer.

For this lab, think of ISO-DEP as:

the channel POOM prepares so it can talk to applications inside a compatible card.

Not every NFC card uses ISO-DEP, so POOM first needs to determine whether the selected card supports this next step.

What are RATS and ATS?

RATS means:

Request for Answer To Select

POOM sends it after selecting a compatible card. For this lab, read it as:

"I selected you. Can we continue using ISO-DEP?"

In a real capture, it appears as:

[TX] E0 00

The byte E0 identifies the RATS command. The second byte carries negotiation parameters that we do not need to decode yet.

If the card accepts, it responds with ATS:

Answer To Select

For this lab, read ATS as:

"Yes. We can continue, and these are my communication parameters."

A real card may return:

[RX] 0D 78 00 70 02 53 4C 4A 26 31 23 02 01

You do not need to interpret every byte yet. The important point is that the card answered RATS and communication can continue over ISO-DEP.

Let's go to the lab

  1. On POOM, open THE BEAST from the main menu, then select CLI.
  2. Place POOM on top of a compatible NFC Type A tag. The antenna is on the back, so the tag goes underneath POOM.
Animated POOM menu navigation opening THE BEAST and selecting CLI.
First, open THE BEAST on POOM and select CLI.
POOM placed on top of a compatible NFC Type A tag.
Keep the tag underneath POOM and hold both devices steady during the activation sequence.

Use the embedded NFC CLI and run these commands in order:

nfc-core-start
nfc-tech-set-a
nfc-card-connect
Compatibility: continue only if the selected card supports ISO-DEP and returns an ATS.

Real example

poom> nfc-card-connect
  [TX] REQA (26)
  [RX] ATQA: 04 00
  [TX] 93 20
  [RX] C1 2F 8A 1E 7A
  [TX] 93 70 C1 2F 8A 1E 7A
  [RX] 20
  [TX] E0 00
  [RX] 0D 78 00 70 02 53 4C 4A 26 31 23 02 01
  ISO/IEC 14443-A card detected.

The first lines show the familiar REQA, ATQA, Anticollision, and SELECT flow. The new exchange is:

[TX] E0 00
[RX] 0D 78 00 70 02 53 4C 4A 26 31 23 02 01

POOM sends RATS, and the card returns its ATS. In plain language:

POOM: "Can we continue using ISO-DEP?"
Card: "Yes. We can continue."

What you should learn

StageWhat happens
REQA / ATQAPOOM discovers that a card is present.
UID / SELECT / SAKPOOM selects that card.
RATS / ATSPOOM prepares ISO-DEP communication.

Now the path is ready for the next step: sending a real application command to the card.