Combing through spec documents can be a pain in the ass. I recently had to come to a much better understanding of how security features worked inside Mifare S50 and S70 RFID tags, so I put this doc together to try to make the whole thing a little more understandable and easier to read. The document assumes you are at least familiar with the basic memory structure of the S50/S70, and how those memory blocks are formatted and used for NFC. The document only covers exactly how to work with the security keys A and B, and the access bits that define how those keys are used to protect both data and keys.
Just in case you don’t have the requisite understanding, here are the spec docs you should read first;
MF1ICS50 Functional Specification – The functional spec for the ISO/IEC 14443 Type A MIFARE Classic S50 RFID tag.
NFC Type MIFARE Classic Tag Operation – Details how an NFC device (reader) can read and store NDEF data inside the MIFARE family of tags.
MIFARE Classic as NFC Type MIFARE Classic Tag – Details extended functionality and additional information regarding NFC Type MIFARE applications.