使用密码保护读写NFC标签-Read/writetoNFCtagwithpasswordprotection

6  

An NFC tag (or actually an NFC Forum tag that implements one of the five NFC Forum Tag Operation specifications) is a simple data memory without any security mechanisms (other than locking memory to read-only). These tags are intended to store freely readable data in NDEF format. No authentication or protection mechanisms against reading of tag contents (or copying of tag contents to other tags) are standardized.

一个NFC标记(或者实际上是一个NFC论坛标记，它实现了五个NFC论坛标记操作规范之一)是一个简单的数据内存，没有任何安全机制(除了将内存锁定为只读)。这些标记旨在以NDEF格式存储可自由读取的数据。没有针对读取标记内容(或将标记内容复制到其他标记)的身份验证或保护机制是标准化的。

However, some existing tag products implement additional security features that go beyond what is specified by the NFC Forum.

然而，一些现有的标签产品实现了额外的安全特性，超出了NFC论坛指定的范围。

The most simple mechanism is a short "password" (typically a 32-bit value). For authentication, this password is transmitted to the tag in cleartext and the tag acknowledges/rejects the authentication. (Note that transmission in cleartext over NFC means that anyone sniffing the communication is able to obtain the password.) Some tags supporting this type of password protection can use the authentication to switch a defined memory area between no access, read-only access, and read/write access.

最简单的机制是一个简短的“密码”(通常是一个32位的值)。对于身份验证，该密码将传输到明文中的标记，标记确认/拒绝身份验证。(注意，通过NFC以明文传输意味着任何嗅探通信的人都能够获得密码。)支持这种类型的密码保护的一些标记可以使用身份验证来切换未访问、只读访问和读/写访问之间的定义内存区域。

• Products implementing this type of password validation are, for example, Infineon SLE66R01P, NXP MIFARE Ultralight EV1, and NXP NTAG21x.
• 实现此类密码验证的产品有Infineon SLE66R01P、NXP MIFARE Ultralight EV1和NXP NTAG21x。

A more sophisticated approach is mutual challenge-response authentication using a shared key. Compared to a simple cleartext password, this means that a passive eavesdropper can't discover the shared key. As with the password, the authentication state may be used to switch a defined memory area between no access, read-only access, and read/write access with most existing tag products. However, not all of them cryptographically bind the memory access and the authentication pahse together.

一种更复杂的方法是使用共享密钥进行相互查询-响应身份验证。与简单的明文密码相比，这意味着被动窃听者无法发现共享密钥。与密码一样，身份验证状态可用于在大多数现有标记产品的无访问、只读访问和读/写访问之间切换已定义的内存区域。然而，并不是所有的密码都将内存访问和认证pahse绑定在一起。

• Products implementing a three-pass mutual authentication are, for example, NXP MIFARE Classic*, NXP MIFARE Ultralight C, NXP MIFARE DESFire (EV1), Sony FeliCa cards.

  实现三通互认证的产品有:NXP MIFARE Classic*、NXP MIFARE Ultralight C、NXP MIFARE DESFire (EV1)、索尼FeliCa cards。

  ^{*) Note that the proprietary authentication and encryption protocol of MIFARE Classic is known to be broken since 2008. Moreover, MIFARE Classic is only supported on Android devices with an NFC chipset from NXP.}

  *)注意到MIFARE Classic的专有认证和加密协议自2008年起就被打破了。此外，MIFARE Classic只支持基于NXP的NFC芯片的Android设备。

When it comes to implementing any from of authentication on Android, you should be aware of the following:

当涉及到在Android上实现任何身份验证时，您应该了解以下内容:

1. If you still want to benefit from automatic starting of your app through an NDEF message (either a custom record that you declare in the intent filter or an Android Application Record), you need to have a freely readable memory are containing that NDEF message. Since password protection/authentication is not part of the NFC Forum specifications, Android itself can't authenticate to the tag (Android would not have the right key/password anyways). Consequently, the NDEF memory area (for tags with flat linearly-addressable memory this is typically the first N blocks of the tag memory) must be readable without authentication.

   如果您仍然希望通过NDEF消息(您在intent filter中声明的自定义记录或Android应用程序记录中声明的自定义记录)自动启动应用程序，那么您需要拥有一个可自由读取的内存，其中包含NDEF消息。由于密码保护/认证不是NFC论坛规范的一部分，Android本身无法对标签进行身份验证(无论如何Android都没有正确的密钥/密码)。因此，NDEF内存区域(对于具有平滑的lin早期可寻址内存的标记来说，这通常是标记内存的第一个N块)必须在没有身份验证的情况下是可读的。

2. Even if you do not use NFC intent filters in the application manifest and only use the foreground dispatch system (or the reader-mode API), you might still want to use NDEF to discover/filter for your tags.

   即使您在应用程序清单中不使用NFC意图过滤器，并且只使用前台调度系统(或读卡器模式API)，您可能仍然希望使用NDEF来发现/过滤您的标记。

3. You cannot use the NDEF abstraction layer (i.e. the Ndef/NdefFormatable classes) to access the protected memory area. Instead, you need to exchange the tag platform-specific low-level commands using one of the tag technology classes (NfcA, ..., IsoDep). Also don't try to mix between mutliple tag classes (e.g. using NfcA for sending the authentication command and Ndef for reading the data afterwards). While this works on some devices, it won't work on most devices since they reset the communication with the tag when swithcing between these communication objects.

   不能使用NDEF抽象层(即NDEF /NdefFormatable类)访问受保护内存区域。相反，您需要使用一个标记技术类(NfcA，…)交换标记特定于平台的低级命令。IsoDep)。也不要尝试混合使用多个标签类(例如使用NfcA发送身份验证命令，使用Ndef来读取数据)。虽然这在某些设备上可行，但在大多数设备上却行不通，因为当在这些通信对象之间切换时，它们会重置与标记的通信。

4. There are known issues with the tag presence check mechanism on some Android devices (mainly before Android 5) that may interfere with the authentication (i.e. the presence check may send commands between the authentication commands resulting in authentication failures). This problem can be overcome with the reader-mode API.

   一些Android设备(主要在Android 5之前)上的标签存在检查机制存在一些已知的问题，这些问题可能会干扰身份验证(例如，存在检查可能会在身份验证命令之间发送命令，导致身份验证失败)。这个问题可以通过读者模式API来解决。

5. Finally, be aware that if you store the password/authentication key within an app, an attacker could easily reverse-engineer your app to obtain the key.

   最后，请注意，如果您将密码/身份验证密钥存储在应用程序中，攻击者可以很容易地反向工程您的应用程序以获取密钥。

3  

Some tags such as MIFARE DESFire natively support passwords / encryption as you describe. Recreating this functionality on the more common types of tags (Topaz/MIFARE Ultralight, etc.) is inherently impossible as NFC tags do not have built in protections for the copying of their data (by design). You could potentially encrypt your data before it is encoded, but this would require the tool decoding the data to be privy to the encryption method (likely a standalone app, separate to the Android OS, for example). Cheaper tags can, as you say, only be made permanently read only.

一些标签，如MIFARE DESFire本机支持密码/加密，正如您所描述的那样。在更常见的标签类型(Topaz/MIFARE Ultralight等)上重新创建此功能本质上是不可能的，因为NFC标签没有内置对数据复制的保护(按照设计)。您可以在数据被编码之前对其进行加密，但这需要解码数据的工具对加密方法保密(例如，一个独立的应用程序，独立于Android操作系统)。正如你所说，更便宜的标签只能被永久读取。

In other words, most NFC tags will not support what you are trying to achieve but there exists tags (that are considerably more expensive) that support larger amounts of data and tools such as password based encryption.

换句话说，大多数NFC标签不会支持你想要实现的目标，但是存在一些标签(这些标签要昂贵得多)，支持更多的数据和工具，比如基于密码的加密。

As MIFARE DESFIRE adhere to ISO 14443-4 and assuming you're using Android you are able to make use of the IsoDep methods. For more info about how to read/write passwords, etc. see this related article: How well does the Android NFC API support Mifare Desfire?

由于MIFARE DESFIRE坚持使用ISO 14443-4，并且假设您正在使用Android，那么您就可以使用IsoDep方法。有关如何读取/写入密码等的更多信息，请参阅本文:Android NFC API支持Mifare Desfire的能力如何?