Taking the standard elsewhere
A transit system anywhere may build cards and readers to it, add the modules it needs, and change what it likes. This page sets out what a fork can change while its cards still read at the gates of the Bloc, and what it has to change if it wants to hold value.
The line between the two
| Element | Must hold | Note |
|---|---|---|
| ROM identity block | yes | 256 bytes, the same fields, signed by an issuer key a Bloc gate can obtain. |
| Record structure | yes | 32 bytes, the same offsets. A gate elsewhere has to be able to count your records. |
| SELECT and READ_ID | yes | Answerable without any key, so any reader can learn what the card is. |
| Frame layout and CRC | yes | Otherwise nothing above it can be parsed. |
| AUTH and the record seal | yes | AES-128 as specified. Your network key stays yours. |
| EEPROM system area | first 32 bytes | Language, script, type size, sound and the assistance flag, so a traveller's settings survive a frontier. |
| EEPROM beyond that | no | Yours. The holder's area is a Fluid decision and not part of the standard. |
| Fare and purse modules | no | Compile them in and your cards still read here. What is charged is your business. |
| NAND size and layout | no | 2 MiB is the Fluid choice. A smaller ring works if it holds the period you publish. |
| Physical card | no | Format, artwork, hologram and the contact pads are yours. The coil figures are fixed by ISO 14443. |
Four steps
-
Take the trees
Clone from source.nrf.rof/cardrom-driver, source.nrf.rof/gate-firmware and source.nrf.rof/conformance, or take the tarballs from the front of this section. Nothing has to be signed and nobody has to be told.
-
Choose your flags
The build flags decide what your build contains, and they sit in cardrom_config.h at the root of the firmware tree. A fare-taking network turns on two flags that are off here and accepts the memory cost.
-
Mint an issuer key
Use Ed25519. Publish the public half where a foreign reader can fetch it, and send it to keys@nrf.rof if you want cards read here. What arrives is published at keys.nrf.rof/issuers, which every gate in the Republic refreshes every night.
-
Run the suite
Run the test vectors, the twelve commands, the status words, the deadline, and a fuzz pass over the frame parser against your build with
python3 -m conformance --target ./build, and publish the output beside your specification to claim conformance. Results sent to keys@nrf.rof are listed at keys.nrf.rof/conformant.
Questions that come up
-
Can a fork be sold?
Yes. There is no patent, no licence and no field-of-use limit, and a private operator may build and sell cards and readers to its modified standard.
-
Will Fluid gates take a fare card?
They will read it and record the journey. They will not touch the purse, because the code that would do it is not compiled into any reader here.
-
What about the name?
The standard is named after the building it was signed in. You can use it for a build that passes the suite.
-
Who decides a revision?
The three networks of the Bloc, together, in public. A fork is welcome at that table and is not bound by what it decides.