topic Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part in NFC

Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

manuel_mertl — Fri, 31 Jul 2020 14:34:50 GMT

Problem:

How do i configure my NTAG 424 DNA using the TagXplorer and and my Macbook.

Goal:

I want to be able to configure my tags in a way like described in the section 4.4.4 (https://www.nxp.com/docs/en/application-note/AN12196.pdf )

https://ntag.nxp.com/424?e=EF963FF7828658A599F3041510671E88&c=94EED9EE65337086

So the goal is to have 2 parameters in my URL called "e" and "c" where "e" holds the encrypted version of the UID and the CTR and "c" would hold the cmac value.

Description:

Lets say i would like to use the following URL as base "https://ntag.nxp.com/424"

What configuration settings would i need to do in the following two screens? (using default keys is sufficent for my problem at that point)

and here:

might there also be other screens where i would have to configure things to be able to achieve my goal?

jonathaniglesias‌

Thank you :smileyhappy:

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

Jonathan_Iglesias — Mon, 03 Aug 2020 19:32:51 GMT

Hi Manuel Mertl,

Hope you are doing great, all of this steps are assuming that you have a new tag, for this please follow the next steps :

go to mirroring features
NTAG 424 DNA
select the protocol in this case is https://www.
copy and paste this ntag.nxp.com/424?e=00000000000000000000000000000000&c=0000000000000000 in the URI data
then be sure that the offset values for e and c. as you can see the tool let you check it by putting the cursor in the part you want to know the offset value in this case e offset is 1A0000 or 26d in decimal ( this tool use decimal values but for other cases please use hex) and for c the offset is 3D0000 = 61d.
leave the offset for e
then write the NDEF
then go an authenticate to card key number with default value
go to get/change file settings
please use the settings in the following images, please try to follow the numbering because some things enable others, like the check box for SDM and mirroring enable the SDM access rights and then this enables the check box for uid and ctr.

I tested on my side this worked, let me know if you still have any issue or questions or if there is any error on your side.

Have a nice day !!

Jonathan

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

manuel_mertl — Mon, 03 Aug 2020 20:35:46 GMT

Hi, jonathaniglesias‌!

Thank you so much, works like a charm. I just had to adapt die values for the keys a little bit to get it working with my backend verification. So I ended up with the following configuration for the first test version:

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

Jonathan_Iglesias — Mon, 03 Aug 2020 20:37:35 GMT

great :smileygrin: glad that it worked.

let me know if you have any questions in the future.

Have a nice day !
BR

Jonathan

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

Contributor — Wed, 30 Sep 2020 10:52:15 GMT

Dear jonathaniglesia, please give me a similar step by step instruction for generating a plain URI as in AN12196 4.4.1 that looks like this:

https://ntag.nxp.com/424?uid=04C767F2066180&ctr=000001&c=54A45B2C3A558765

I am completely lost with File settings and Mirroring features that do not match

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

AMS1979 — Sat, 26 Jun 2021 03:25:41 GMT

Yes, this finally woked for me however your instructions seemed to have locked my test tag. I am now getting Error 6982 for any command I try and run from TaxXplorer. Is there any way around this?

What does this error code mean?

Thanks!

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

AMS1979 — Sun, 27 Jun 2021 15:23:15 GMT

Hey Team,

Ok something weird going on

Mu url structure is:

https://isdomaincom.io/path/1?e=00000000000000000000000000000000&c=00000000000000

SDM MAC Input Offset: 66
SDM MAC Offset: 66
PICC Data Offset: 31

I've tried your example again on an additional 2 tags(now uneditable due to error 6982) and now getting the following url structure when I read from the tag

https://isdomaincom.io/path7F1B47206C71DC76A7AE7382B1B668190009A1BD60A2EA60C6900000

I'm not sure what I'm doing differently from the first time I used the tags. As these are fresh tags Is there some preliminary step I need to do? Do I have to write an NDEF first and then conduct the NTAG Operations?

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

AMS1979 — Sun, 27 Jun 2021 15:27:57 GMT

ok, figured it out.

The application doesn't like sub paths "/1".

have to add an additional 5 to the original calculated amount of 31, 66 respectively. The 5 is the total amount of characters after the first path("/path" )

/1?e=

This was a tricky one. Hope it helps some people out! Cheers

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

AMS1979 — Mon, 28 Jun 2021 05:45:23 GMT

Ok so although the path is correct the iPhone doesn't recognize the url stored. With an NFC reading app the stored URL is padded with what seem to be bytes. I don't think these chips like additional paths ("/") in the query strings. The urls work fine with the example, but adding another folder to the path seem to break things. I'm now all out of test chips.

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

AMS1979 — Mon, 28 Jun 2021 06:56:37 GMT

Sorry for all the questions.

Is there a way to reset the NDEF url after it has been set? Any attempt to change the URL results it an error 6982. I've gone through several of these tags and would like to reuse them.

Any guidance here is appreciated.

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

AMS1979 — Mon, 28 Jun 2021 08:38:12 GMT

Just tested on an Android Nokia phone and no issues. This seems to be related to how apple iOS nft reads the tag. I'll keep you posted.

Tested with iPhone 7, iPhone8 , (not reading)

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

randhawp — Thu, 14 Oct 2021 15:24:41 GMT

Is there a document for TagXplorer that shows the meaning of the various error codes. I have 2 brand new NTAG 424DNA, what I go in to authenticate with default settings the following error comes up: Error: 91AE

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

piejanssens — Tue, 12 Apr 2022 17:28:49 GMT

Have you figured out eventually how to get rid of that error 6982? I'm experiencing the same issue when trying to change the URL via the mirroring features setup.

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

randhawp — Tue, 12 Apr 2022 18:17:30 GMT

Try changing the access key (after authenticating) with OE key and then change the NDEF information.

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

piejanssens — Tue, 12 Apr 2022 18:33:15 GMT

What is the 'OE' key?

Access rights for Read, R/W, W, Change are all using key 00.

Key 00 is set to the all-zero key and I can authenticate with it.

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

V-IRL — Mon, 06 Jun 2022 23:09:43 GMT

Hey Jonathan!

I'm also new to 424 chips. My company is looking to use them for authenticating goods and also to use the same chips for access control and ticketing.

Here is some background:

I have 1000 tags ready to be embedded in some merchandise for our first collection but they need to be encoded for authentication. We're looking to have authentication services provided by NXP authentication if possible but I'm waiting to hear back from NXP on getting access to that software and service.

We also need to pull the unique ID of each tag or some sort of identifier that we can integrate into our blockchain end for cross verification.

So our needs are : 1. unique ID that we can query for each tag 2. support in encoding the tags 3. authentication support on the backend for our web app and native app.

Thank you!

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

V-IRL — Mon, 06 Jun 2022 23:26:06 GMT

Hey @manuel_mertl I know this conversation is a few years old but hopefully you catch this. I'm exploring how to properly encode and authenticate unique 424 tags for merchandise authentication and ticketing. Any chance you're free to share what you learned?

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

genetakavic — Tue, 07 Jun 2022 10:19:11 GMT

Hi @Jonathan_Iglesias!

My 424 works just fine with my own web service using https:// protocol, but now I need to hand this link over to another service with a particular prefix (smth:// for example). It is on purpose that the protocol combobox does not offer an option for no prefix (0x00)? Am I able to do this somehow within the tool or do I need to modify the APDU command and send it my own way ? Thx for your time!

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

yuan_cao — Fri, 24 Jan 2025 15:51:40 GMT

@manuel_mertl @Jonathan_Iglesias
thank you so much guys, i am aslo block here.
i think aslo many people do not konw we sholud revser and zero padding for ctr

i put my python code whcih works (thanks open ai)

from Crypto.Cipher import AES

from Crypto.Hash import CMAC

# Step 1: Calculate Full CMAC using SV2

def calculate_full_cmac():

# Define the input values for Step 1

key = bytes.fromhex("00000000000000000000000000000001") # Master key

sv2 = bytes.fromhex("3CC30001008004AA5AAA1E1890180000") # SV2 value

# Initialize CMAC with AES

cmac = CMAC.new(key, ciphermod=AES)

cmac.update(sv2)

# Compute the full CMAC (16 bytes)

full_cmac = cmac.digest()

full_cmac_hex = full_cmac.hex().upper()

print("Step 1: Full CMAC (16 bytes):", full_cmac_hex)

return full_cmac

# Step 2: Calculate SDMMAC using Full CMAC

def calculate_sdmmac(full_cmac

# Key for the calculation (KSesSDMFileReadMAC is Full CMAC from Step 1)

key = full_cmac

# Zero-length input (empty input for SDMMAC)

input_data = b''

# Create a CMAC object using the key and AES

cmac = CMAC.new(key, ciphermod=AES)

# Update the CMAC with the input data (zero-length here)

cmac.update(input_data)

# Calculate the full CMAC

cmac_full = cmac.digest()

# Shorten the CMAC to take every second byte (as in the Java implementation)

sdmmac = cmac_full[1::2]

sdmmac_hex = sdmmac.hex().upper()

print("Step 2: SDMMAC (8 bytes, shortened):", sdmmac_hex)

return sdmmac

# Execute the steps

full_cmac = calculate_full_cmac()

sdmmac = calculate_sdmmac(full_cmac)

Re: Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

athul_pm — Wed, 12 Mar 2025 09:20:34 GMT

How to achieve this using commands in javascript.
after authentication do we need to use that for any further requests?
I am getting 911e for updateFileSetting command.