I have an (university) project where I basically write and read text out of NFC Tags with Android devices in order to store one's balance in the card (wich can be used on the cafeteria, for example).

Right now, I'm using Ntag213 doing the below code:

NdefRecord mimeRecord = NdefRecord.createMime("text/plain", messageEncrypted.getBytes(Charset.forName("US-ASCII")));
ndef.writeNdefMessage(new NdefMessage(mimeRecord));

As you can notice, I'm using application level encryption to encrypt the message (messageEncrypted) before writing it to the tag (AES-256 encrypt with 'com.scottyab:aescrypt:0.0.1' library - with a very big password key which is also combined with each tag UUID as part of it).

So far so good - Only I can understand the data on the tags.

On my research, I've found that when it comes to security Ultralight C > Ntag213.

**I know both tags have limited space but it is more than enough for me.

Question 1) When using application level encryption, why (is it?) is Ultralight C safer then Ntag213?

Question 2) I'm pretty sure I can guarantee security using AES encryption on application layer, but I don't want people (besides me) messing with the stored data (formatting tag or writing info there - even if I can dettect it). I see that the only way of preventing that (please, correct me if I'm wrong) is to set a password for the tag. However, both Ntag213 and Ultralight C have only an 32 bit password. Is it good enough? Is there another way of preventing someone (besides me) writing data?

Question 3) Which other security measures can I use on such tags to enforce security (tag and application layer)? I see that Ultralight C has 3DES Authentication, but I haven't find an example for Android so far.

Question 4) When you compare tag security (Mifare Desfire > Ultralight > Ntag213 > Mifare Classic), what is really being compared? The ease of one cracking the (native tag's) encryption or the ease of one store (anything) on the tag without permission ?

Question 5) I see a bunch of other techs (Mifare Desfire, ICODE SLIX, Infineon Cipurse) that are more secure, which makes me wonder if the tech I'm using (Ntag213 or Ultralight C) is good enough for storing someones balance. Would you (and that's a personal opinion) say that Ntag213 with application level encryption and 32 bit password good enough for this type of application? And how long would it take someone to actually break its security?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.