What is SD card CID number?

Internal SD Card Information

An SD card is a compact storage device that contains both a microcontroller and a memory chip. Key technical information about the card is stored in internal registers, which include:

• CID – Card Identification
• CSD – Card-Specific Data
• OCR – Operating Conditions Register
• RCA – Relative Card Address
• DSR – Driver Stage Register
• SCR – SD Configuration Register

The OCR, CID, CSD, and SCR registers hold card-specific and content-related information, while the RCA and DSR registers handle active card configuration parameters.

Among these registers, the CID (Card Identification) register is especially important because it uniquely identifies each SD card. Let’s explore what it contains and why it’s significant for tasks such as software licensing, encryption, and card validation.

What Is the CID Register?

The CID register is a 16-byte (128-bit) code programmed into the SD card by the manufacturer. It contains detailed identity data about the card.

Under normal circumstances, the CID cannot be changed, making it a valuable tool for:

• Software licensing
• Content protection
• Encryption routines
• Generating secure SD card passwords

CID Modification and Security Implications

However, in cases where SD cards do not fully comply with the official specification—or when specific backdoors are discovered—the CID can be rewritten. These are known as changeable CID SD cards and allow the CID to be modified using a specialized CID change tool. While this opens up possibilities for advanced use cases, it also means that CID-based security can be compromised if proper precautions are not taken.

CID Register Field Breakdown

Here’s a breakdown of the CID register fields and what each component means:

Understanding the Manufacturer ID (MID)

The Manufacturer ID (MID) is assigned by the SD Association (SD-3C LLC). It is considered confidential information, so an official list is not published.

Many SD card brands are produced by OEM suppliers, and the MID and OID may reflect this. In some cases, they appear to show the producer of the SD card controller, but not the brand of the SD card. For example, MID 0x27 together with OID  – ‘PH’ indicates PHISON controller, but not the card brand, and can be found in many different brands such as Delkin, Integral, Lexar, Patriot, Sony, Verbatim, and others, as the Phison Electronics Corporation is one of the common manufacturers for well-known brands.

The Manufacturer ID, as well as the whole CID, is valid and can be trusted only if the SD card is original and not counterfeit. Therefore, based on the CID number, one cannot be sure that the card is original. If the SD card manufacturer ID doesn’t match the label on the card, it’s a first sign that the SD card is counterfeit.

OID – OEM/Application ID

The OID identifies the OEM or application of the SD card. Like the MID, this value is assigned by SD-3C LLC and is not publicly disclosed.