Configuring NTAG 424 DNA with Encrypted-Part and CMAC-Part

[manuel_mertl]

Problem:

How do i configure my NTAG 424 DNA using the TagXplorer and and my Macbook.

Goal:

I want to be able to configure my tags in a way like described in the section 4.4.4 (https://www.nxp.com/docs/en/application-note/AN12196.pdf )

https://ntag.nxp.com/424?e=EF963FF7828658A599F3041510671E88&c=94EED9EE65337086

So the goal is to have 2 parameters in my URL called "e" and "c" where "e" holds the encrypted version of the UID and the CTR and "c" would hold the cmac value.

Description:

Lets say i would like to use the following URL as base "https://ntag.nxp.com/424"

What configuration settings would i need to do in the following two screens? (using default keys is sufficent for my problem at that point)

and here:

might there also be other screens where i would have to configure things to be able to achieve my goal?

jonathaniglesias‌

Thank you :smileyhappy:

[yuan_cao]

@manuel_mertl   @Jonathan_Iglesias  
thank you so much guys, i am aslo block here.
i think aslo many people do not konw we sholud revser and zero padding for ctr

i put my python code whcih works (thanks open ai)

from Crypto.Cipher import AES

from Crypto.Hash import CMAC

# Step 1: Calculate Full CMAC using SV2

def calculate_full_cmac():

    # Define the input values for Step 1

    key = bytes.fromhex("00000000000000000000000000000001")  # Master key

    sv2 = bytes.fromhex("3CC30001008004AA5AAA1E1890180000")  # SV2 value

    # Initialize CMAC with AES

    cmac = CMAC.new(key, ciphermod=AES)

    cmac.update(sv2)

    # Compute the full CMAC (16 bytes)

    full_cmac = cmac.digest()

    full_cmac_hex = full_cmac.hex().upper()

    print("Step 1: Full CMAC (16 bytes):", full_cmac_hex)

    return full_cmac

# Step 2: Calculate SDMMAC using Full CMAC

def calculate_sdmmac(full_cmac

    # Key for the calculation (KSesSDMFileReadMAC is Full CMAC from Step 1)

    key = full_cmac

    # Zero-length input (empty input for SDMMAC)

    input_data = b''

    # Create a CMAC object using the key and AES

    cmac = CMAC.new(key, ciphermod=AES)

    # Update the CMAC with the input data (zero-length here)

    cmac.update(input_data)

    # Calculate the full CMAC

    cmac_full = cmac.digest()

    # Shorten the CMAC to take every second byte (as in the Java implementation)

    sdmmac = cmac_full[1::2]

    sdmmac_hex = sdmmac.hex().upper()

    print("Step 2: SDMMAC (8 bytes, shortened):", sdmmac_hex)

    return sdmmac

# Execute the steps

full_cmac = calculate_full_cmac()

sdmmac = calculate_sdmmac(full_cmac)

[randhawp]

Is there a document for TagXplorer that shows the meaning of the various error codes. I have 2 brand new NTAG 424DNA, what I go in to authenticate with default settings the following error comes up: Error: 91AE

[genetakavic]

Hi @Jonathan_Iglesias!

My 424 works just fine with my own web service using https:// protocol, but now I need to hand this link over to another service with a particular prefix (smth:// for example). It is on purpose that the protocol combobox does not offer an option for no prefix (0x00)? Am I able to do this somehow within the tool or do I need to modify the APDU command and send it my own way ? Thx for your time!

[AMS1979]

Sorry for all the questions.

Is there a way to reset the NDEF url after it has been set?  Any attempt to change the URL results it an error 6982.  I've gone through several of these tags and would like to reuse them.

Any guidance here is appreciated.

[piejanssens]

Have you figured out eventually how to get rid of that error 6982? I'm experiencing the same issue when trying to change the URL via the mirroring features setup.

[randhawp]

Try changing the access key (after authenticating) with OE key and then change the NDEF information.

[piejanssens]

What is the 'OE' key?

Access rights for Read, R/W, W, Change are all using key 00.

Key 00 is set to the all-zero key and I can authenticate with it.

[Contributor]

Dear jonathaniglesia, please give me a similar step by step instruction for generating a plain URI as in AN12196 4.4.1 that looks like this:

https://ntag.nxp.com/424?uid=04C767F2066180&ctr=000001&c=54A45B2C3A558765

I am completely lost with File settings  and Mirroring features that do not match

[Jonathan_Iglesias]

Hi Manuel Mertl,

Hope you are doing great, all of this steps are assuming that you have a new tag, for this please follow the next steps :

1.  go to mirroring features
2. NTAG 424 DNA
3. select the protocol in this case is https://www.
4. copy and paste this ntag.nxp.com/424?e=00000000000000000000000000000000&c=0000000000000000 in the URI data 
5. then be sure that the offset values for e and c. as you can see the tool let you check it by putting the cursor in the part you want to know the offset value  in this case e offset is 1A0000 or 26d in decimal ( this tool use decimal values but for other cases please use hex) and for c the offset is 3D0000 = 61d.
6. leave the offset for e
7. then write the NDEF
8. then go an authenticate to card key number with default value
9. go to get/change file settings
10. please use the settings in the following images,  please try to follow the numbering because some things enable others, like the check box for SDM and mirroring enable the SDM access rights and then this enables the check box for uid and ctr.

I tested on my side this worked, let me know if you still have any issue or questions or if there is any error on your side.

Have a nice day !!

BR

Jonathan

[kimikumantaro]

Hi Emmanuel, 

I have Ntag424 chips, already configured in TagXplorer. using the correct offset in Mirroring section. And configured the SDM in Ntag424 section. Following your instructions. Thank you so much.

this is my test case URL full path according to the documentation AN12196, in the SDMMAC Mirror section: http://nxp.test/nfc/verify?e=EF963FF7828658A599F3041510671E88&c=94EED9EE65337086

with this url, it was a success, I get SDMMAC generation equals to the c field.

but in real production test case, the SDMMAC generation is not equal to the c field. I think there are some configurations for the tag that are still missing. Maybe on the:
- KSDMFileRead Key Number
- M1 = b8bc31467d83ae6525fbb5a2cfdf1694

I could not configure these 2 fixed fields in TagXplorer. 

Thank you

[athul_pm]

How to achieve this using commands in javascript.
after authentication do we need to use that for any further requests?
I am getting 911e for updateFileSetting command.

[manuel_mertl]

Hi, jonathaniglesias‌!

Thank you so much, works like a charm. I just had to adapt die values for the keys a little bit to get it working with my backend verification. So I ended up with the following configuration for the first test version:

[V-IRL]

Hey @manuel_mertl  I know this conversation is a few years old but hopefully you catch this. I'm exploring how to properly encode and authenticate unique 424 tags for merchandise authentication and ticketing. Any chance you're free to share what you learned?

[Jonathan_Iglesias]

great :smileygrin:  glad that it worked.

let me know if  you have any questions in the future. 

Have a nice day !
BR

Jonathan

[V-IRL]

Hey Jonathan!

I'm also new to 424 chips. My company is looking to use them for authenticating goods and also to use the same chips for access control and ticketing. 

Here is some background:

I have 1000 tags ready to be embedded in some merchandise for our first collection but they need to be encoded for authentication. We're looking to have authentication services provided by NXP authentication if possible but I'm waiting to hear back from NXP on getting access to that software and service. 

We also need to pull the unique ID of each tag or some sort of identifier that we can integrate into our blockchain end for cross verification.

So our needs are : 1. unique ID that we can query for each tag 2. support in encoding the tags 3. authentication support on the backend for our web app and native app. 

Thank you!

[AMS1979]

Hey Team,

Ok something weird going on

Mu url structure is:

https://isdomaincom.io/path/1?e=00000000000000000000000000000000&c=00000000000000

SDM MAC Input Offset: 66
SDM MAC Offset: 66
PICC Data Offset: 31

I've tried your example again on an additional 2 tags(now uneditable due to error 6982) and now getting the following url structure when I read from the tag

https://isdomaincom.io/path7F1B47206C71DC76A7AE7382B1B668190009A1BD60A2EA60C6900000

I'm not sure what I'm doing differently from the first time I used the tags.  As these are fresh tags Is there some preliminary step I need to do?  Do I have to write an NDEF first and then conduct the NTAG Operations?  

[AMS1979]

ok, figured it out.

The application doesn't like sub paths "/1".  

have to add an additional 5 to the original calculated amount of 31, 66 respectively.  The 5 is the total amount of characters after the first path("/path" )

/1?e=

This was a tricky one.  Hope it helps some people out!  Cheers

[AMS1979]

Ok so although the path is correct the iPhone doesn't recognize the url stored.  With an NFC reading app the stored URL is padded with what seem to be bytes.  I don't think these chips like additional paths ("/") in the query strings.  The urls work fine with the example, but adding another folder to the path seem to break things.  I'm now all out of test chips.

[AMS1979]

Just tested on an Android Nokia phone and no issues.  This seems to be related to how apple iOS nft reads the tag.  I'll keep you posted.

Tested with iPhone 7, iPhone8 , (not reading)

[AMS1979]

Yes, this finally woked for me however your instructions seemed to have locked my test tag.  I am now getting Error 6982 for any command I try and run from TaxXplorer.  Is there any way around this?

What does this error code mean?

Thanks!