I'm reading about NFC and how its security can be enhanced. I read somewhere that it is possible to use TLS over NFC. Unfortunately, I can't find any more information on that topic.
How does TLS over NFC works ? Is it something standardised ?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Standardized? Well, that depends; there are a lot of standards involved.
Amusingly, someone did, in fact, get IP to run over NFC (both UDP in the form of DNS requests, and TCP in the form of - you guessed it - HTTPS)! Sockets over NFC on Android on the classycode.com blog lists how in more detail.
Their code is on github with an Apache 2.0 license.
In our case, we want to exchange these messages over NFC, using ISO/IEC 7816–4 APDUs, between an Android smartphone (the socket client) that supports Host Card Emulation and an NFC reader connected to the Internet (the socket provider)
The socket provider is a RaspberryPi with a PN532-based reader connected via SPI. It’s connected to internet via Wi-Fi. This turned out to be a great setup for playing with NFC. For short instructions on getting the setup to work, see my last blog post.
The application is written in C and uses libnfc to access the NFC reader. It has no other dependencies, and is fairly compact. It consists of three modules:
pn532_socket_tunnel.c Manages device connection, handles incoming messages. socket_infos.c Encapsulates the application’s state in a fixed-size table of socket infos, i.e. open file descriptors, pending read/write results, statistics. messages.c Parses incoming messages and assembles outgoing messages.
Now that we have a provider that exposes sockets via APDUs, how do we use it on Android? We can leverage a couple of useful things:
java.net.Socket can be subclassed, so we can provide a NFCSocket implementation that overrides the default behavior. javax.net.SocketFactory is a facility for providing custom socket implementations.
We chose okhttp as HTTP Client library as Android’s HttpURLConnection does not provide a means to provide alternative SocketFactory instances on a per-connection basis. We also disable timeouts as our NFCSocket does not support them yet.
Android/Java does not provide a way to override DNS lookup, but fortunately for us, okhttp allows pluggable DNS via the Dns interface:
Of course we don’t want to write our own DNS client, so we just use the MiniDNS library instead.
The Graz University of Technology offers a commercially licensed, pure-Java JSSE called iSaSiLk which is freely available for Open Source projects. Special thanks to Dieter Bratko for providing me support for iSaSiLk!
Success! We downloaded the Hacker News front page via NFC, securely, including the stylesheet and image resources in just over 30 seconds. Which is an eternity of course.
With a Google Pixel and the PN532 reader chip, we get a measly bandwidth of around 1.5 KB/s. Yes, you can browse the web with this. You can even do so securely. But you won’t enjoy it.