Problem with NTAG protected in NFC side

[GoncaloS]

Hello, 

I am using the NXP tag NTP5332 and actually I has problems with commands that are sent via NFC using customized mobile app.

Using a microcontroller, I configured the tag with plain password for NFC side. Bellow is possible to see the values of the configuration registers:

- Device security configuration
0x103F: [0]: 0x45; [1]: 0x00; [2]: 0xff; [3]: 0xff
PP_AREA_1 = 0xFFFF

- Plain Password location
0x1020: [0]: 0x00; [1]: 0x00; [2]: 0x00; [3]: 0x00
Read Password: 0x00 0x00 0x00 0x00

0x1021: [0]: 0x00; [1]: 0x00; [2]: 0x00; [3]: 0x00
Write Password: 0x00 0x00 0x00 0x00

- NFC Protection Pointer
0x1058: [0]: 0x08; [1]: 0x30; [2]: 0x00; [3]: 0x00
NFC_PP_AREA_0H = 0x08
NFC_PPC = 0x30 (AREA_0-H is read and write protected)

On the NFC side, I am having problems writing to a password-protected memory region. Below is the sequence of commands used to authenticate the device in order to write to a specific memory region.

-Get random number
0x02 | 0xB2 | 0x04
RESPONSE = 0x00 | RANDOM NUMBER (2 Bytes)

-Set Password
0x22 | 0xB3 | 0x04 | TAG UID (8 Bytes) | 0x02 (Password Identifier for Write) | XOR PWD (4 Bytes)
RESPONSE = 0x00

- Write block data
0x22 | 0x21 | TAG UID (8 Bytes) | Block Number (1 Byte) | Data (4 Bytes)
RESPONSE = 0x01 | 0x0F

To read a memory region protected against reading, I follow the sequence of commands described above, changing only the Password Identifier to 0x01 and the operation to read; in this case, the read operation is successful.

If the password protection against reading and writing is removed, the read and write commands work without any problems.

In addition, I also tried sending the GET NXP SYSTEM INFORMATION command, but I got the response: 01 (Error) | 0F (Unknown error).

Get NXP info: 0x22 (Flags) | 0xAB (Cmd code) | 0x04 (Manuf. code) | UID

Can anyone help me with these issues? Am I sending the wrong command?

Thanks for your help!

[KaiLi]

Hello @GoncaloS 

I would like to recommend NTAG 5 - Memory configuration and scalable security to you, which will tell you how to achieve security protected for NTAG 5link.

[GoncaloS]

Hi @KaiLi,

Thank you for your reply. Before making my first post, I had already seen that document.
I followed the example described in chapter 7.1 Write/Store (derived) PWD using the following sequence:

1. Select Cmd (0x25)
0x22 | 0x25 | UID
Result: 0x00

2. Get Random Number (0xB2)
0x12 0xB2 0x04
Result: 0x00 0x89 0x45

3. Set Password (0xB3)
0x12 0xB3 0x04 0x02 0x89 0x45 0x89 0x45 (Write Password: 0x00 0x00 0x00 0x00)
Result: 0x00

4. Write new PWD
0x12 0x21 0x14 0x11 0x22 0x33 0x44
Result: 0x00

5: Write in write protected block
0x12 0x21 0x14 0x01 0x02 0x03 0x04
Result: 0x01 0x0F

In the example above that I tested, I was able to write a new passwor2d, but the operation of writing data to a write- and read-protected block continues to fail. Before this test, I followed steps 1, 2, 3, and 5, but I got the same error. If I replace steps 4 and 5 with a read in a read- and write-protected block, I am successful. Do you know what mistake I am making?

Below, I have provided the values from my configuration records again:
0x1037: [0]: 0x09; [1]: 0x00; [2]: 0x5f; [3]: 0x00
0x103F: [0]: 0x45; [1]: 0x00; [2]: 0xff; [3]: 0xff
0x1020: [0]: 0x00; [1]: 0x00; [2]: 0x00; [3]: 0x00
0x1021: [0]: 0x11; [1]: 0x22; [2]: 0x33; [3]: 0x44
0x1058: [0]: 0x08; [1]: 0x30; [2]: 0x00; [3]: 0x00
0x100C: [0]: 0x00; [1]: 0x81; [2]: 0x00; [3]: 0x00

Is the Password identifier 0x02 of the set password command only for writing passwords? If so, shouldn't it also be for writing information in the blocks?
Thanks for the help!

Regards,
GoncaloS

[KaiLi]

Hello @GoncaloS 

Please refer the following log to format read and write command:

[GoncaloS]

Hi @KaiLi,

In my side, I tested the commands that you sent and worked.
What do I need to do now?

Regards,
GoncaloS

[KaiLi]

Hello @GoncaloS 

UID should use your UID.

[GoncaloS]

Hi @KaiLi,

Thank you for your reply.
As you can see in the image in the previous reply, I entered the UID when I ran READ CONFIG and WRITE CONFIG. I also don't understand how these READ CONFIG and WRITE CONFIG commands help to solve my problem.

However, I still have the problem of not being able to write to a memory region protected with a plain password. Can you replicate the commands I sent in the first ticket to read a memory region that is protected?

Please see the photos attached:
- Read/Write Password
ReadWrite_PWD

- Read "read-protected" register

- Write "write-protected" register

Write "write-protected" register

Regards,
GoncaloS