NTAG 424 DNA – SDM CMAC Verification Fails with Custom Tag Data

[rabelais]

Hello NXP Community,

We are currently implementing and testing an 'attendance verification system' based on 'Java Spring', using 'NTAG 424 DNA with SDM (Secure Dynamic Messaging)'.

### Test Environment

* 'Hardware': Omnikey HID 5022CL
* 'Software Tools':
・GoToTags Desktop
・TagXplorer
* 'Test URL Format':
'http://xxxxx.xxxxxx.com/user/nfcverify.do?uid=00000000000001&ctr=000000&c=0000000000000000'
* 'Offset Settings':
・UID Offset: '46'
・Read Counter Offset: '65'
・MAC Offset: '74'
・MAC Input Offset: '0'
* 'SDM Parameters in URL':
'uid', 'ctr', 'c'
* 'Keys Configured': Key 0 through Key 5 (all tested)

### Test Summary & Issue

1. We used 'both GoToTags and TagXplorer'.
In TagXplorer, even with 'SDM Mirroring enabled', the Offset fields remain grayed out and uneditable.
Therefore, all tag configuration was completed via 'GoToTags'.
2. All 6 keys (Key 0 ~ Key 5) have been tested with known values.
3. When using 'public test vectors' for AES-CMAC, our CMAC verification logic returns the correct result.
However, with 'our configured tag's data', the verification 'consistently fails'.

### Additional Observations

* We suspect the issue may relate to encoding or tag configuration (e.g., KDF, Truncation, Endianness, etc.).
* We have already tested all possible combinations of these settings to rule out configuration mismatches.
* We also found online that some tools may encode SDM data differently, depending on the version or environment.

### Request for Help

If anyone has insight or has experienced similar issues when configuring SDM with 'NTAG 424 DNA', we would greatly appreciate any suggestions or references.

Thank you very much in advance!

[EduardoZamora · Accepted solution]

Hello @rabelais

By any chance, have you referred to NTAG 424 DNA and NTAG 424 DNA TagTamper features and hints? Section 3 provides the details to get a deeper understanding on Secure Dynamic Messaging and also includes some examples of URLs with mirrored data. You can also refer to NTAG 424 DNA Data Sheet, Section 9.3.

Also, the 8-byte SDMMAC is calculated using AES according to the CMAC standard described in NIST Special Publication 800-38B, truncated by using only the 8 even-numbered bytes out of the 16 bytes output when represented in most-to-least-significant order. Could you please confirm that your verification is done according to this specification?

Please, consider that TagXplorer is an old software that is no longer supported. We recommend using RFIDDiscover, as this tool allows you to test and configure NTAG devices from our portfolio. RFIDDiscover supports many third-party PCSC devices; however, we also recommend PEGODA Contactless Smart Card Reader Based on PN7642.

Something important to remark is that RFIDDIscover is secured under NDA (Non-Disclosure Agreement); you can try requesting an NDA directly from the NDA online form. After this, you must request the tool through the Secure Files (Secure Access Rights FAQs | NXP Semiconductors).

Regards,
Eduardo.

[rabelais]

Thank you very much for your kind advice.

I'll try again using the combination of 'RFIDDiscover' and the 'PEGODA Contactless Smart Card Reader' as you suggested.

Much appreciated!