> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-non-diversified-desfire-ob.md). # Configure a non-diversified DESFire object Add a separately keyed DESFire object for a third-party reader or system. If you have a third-party reader or system that needs to read a DESFire card, add a non-diversified DESFire object. A Non Diversified DESFire object lets a third party reader or system read credential data from a card without needing the Gallagher Site Specific Key. The object holds the same cardholder data as the Gallagher Access object, but it is encrypted with its own separate AES key. It can be encoded at the same time as the original object, or added later. ### Data layout 16 bytes in total. All binary fields are MSB to LSB. | Bytes | Content | | ------- | -------------------------------------------------------------------------------------- | | 1 byte | Version, currently zero | | 1 byte | Region code, as an uppercase letter 'A' to 'P' | | 2 bytes | Facility code in binary | | 1 byte | Reserved, should be zero | | 3 bytes | Card number in binary | | 1 byte | Issue level in binary, 1 to 15 | | 5 bytes | Reserved, should be zero | | 2 bytes | CRC in binary. Ccitt1021 polynomial, initial value 0xFFFF, over the preceding 14 bytes | The object is labelled with a 4-byte hex Object ID and secured with a hex AES Key. Both can be shared with a third party that needs to read the object. ### Configure an object on an existing card type 1. In Configuration Client, go to **Card Types**. 2. Open the Card Type you want to add the object to. ![Non-diversified DESFire object creation step 1](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-1e1b18d949a456ffbe972e45755cff89525cb93c%2FSECHUB-CREDENTIALS-NONDIV-01-new-non-div-object-step-01.png?alt=media) 3. Click **New Object** in the top left corner, then select **New Non-diversified MIFARE DESFire Object**. ![Non-diversified DESFire object creation step 2](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-c25edc091f785506376725c40f020bc07d84e872%2FSECHUB-CREDENTIALS-NONDIV-02.png?alt=media) ![Non-diversified DESFire object creation step 3](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-ac7e4c0c7dba47b06da77fc934aed0d557683ab3%2FSECHUB-CREDENTIALS-NONDIV-03.png?alt=media) 4. Right-click the new object and select **Properties**. ![Non-diversified DESFire object creation step 4](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-570dfeaf4676782ecea91d8aca7489d2c4c1c7e3%2FSECHUB-CREDENTIALS-NONDIV-04.png?alt=media) 5. Update the **default AES key**. Use Generate, or enter a key manually. Do not use `000000`. 6. Set the **Application ID**. This is a 6-digit hex field. Do not use the reserved Gallagher IDs listed below. ![Non-diversified DESFire object creation step 5](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-69423921fe79acb6ae5aaea2c99f7f0304af7636%2FSECHUB-CREDENTIALS-NONDIV-05.png?alt=media) ![Non-diversified DESFire object creation step 7](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-09e22c0ded0677e2c087fbfd3489a325e09ed8e7%2FSECHUB-CREDENTIALS-NONDIV-07.png?alt=media) 7. Save, then encode new cards. Both the Gallagher Access object and the Non Diversified object are written. 8. To add the Non Diversified object to cards that are already encoded, re-encode the same card. This adds the new object without affecting the existing Gallagher object. The AES Key and Application ID can be opened, viewed, and edited at any time in Configuration Client. If you configured a Non Diversified object in the past and need to retrieve that information, you can. ### Common encoding properties | Option | Description | | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Gallagher Issued** | Enabled by default. While it is enabled, all other configuration options are disabled. If a blank card is encoded with this option enabled, the Card Master Key is set to a unique 128-bit AES key derived from the MIFARE Plus / DESFire key seed. Uncheck it when encoding onto cards originally issued by a different system. | | **Use card master key** | When checked, the specified Card Master Key is used to encode data onto the card, and the Type dropdown and Card Master Key field are enabled. When unchecked, the card must either be configured not to require Card Master Key authentication for application creation, or dummy Gallagher applications must exist on the card. | | **Type** | The encryption type used for the Card Master Key: AES, 2K3DES, or 3K3DES. | | **Card Master Key** | This field must have either 32 hexadecimal characters for AES or 2K3DES encryption types, or 48 hexadecimal characters for the 3K3DES encryption type. Hexadecimal validation occurs when OK is clicked. | | **Default Application Key** | Required when encoding cards that have been personalised by a third party site. This is the key that allows Gallagher applications to be created on the card. It must be 48 hexadecimal characters. If the third party key provided is only 32 characters, pad it out to 48 by appending additional characters to the end. Hexadecimal validation occurs when OK is clicked. | ### Add an object to cards from another system 1. Obtain the Default Application Key from the system that originally encoded the cards. It is under Server Properties > Card Security > MIFARE Site Keys. 2. In the Card Type's DESFire object Common Encoding Properties, uncheck **Gallagher Issued**. 3. Enter the Default Application Key from the original system. 4. Encode the cards. The Non Diversified object is added alongside the existing objects. > **Note.** The Default Application Key is NOT the PICC / Card Master Key. It only allows the creation of new DESFire applications on a card. It does not allow reading or deleting of existing applications. ### Reserved Gallagher Application IDs Gallagher has predefined Application ID values. Avoid these when encoding Non Diversified objects. | Application ID | Purpose | | --------------- | ------------------------------------------------------------------------ | | F4811F | Config Card, the Admin Card used for Cardax IV reader key updates | | F48120 - F4812E | Gallagher Access credential objects, up to 15 per card | | F4812F | Card Application Directory (CAD), which stores Gallagher object metadata | Up to 15 Gallagher site objects can be encoded onto a single DESFire card, space permitting, so one card can be used on multiple sites. Each object must have a unique facility code and a unique Site Specific Key. *** 🔗 **Related** * [Credentials - Keys](/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-keys.md). What the Card Master Key, Default Application Key, and Site Specific Key each do. * [Credentials - Sharing DESFire cards between Sites](/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-sharing-desfire-cards-betw.md). Sharing a card between two Gallagher sites rather than with a third party system. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-non-diversified-desfire-ob.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.