The NFC Forum has published the second version of its specification for signing and vouching for the integrity of data held in NFC tags, adding support for compact certificates and new signature algorithms.

ROSATI: “We hope to see it eventually being built into the mobile OS, the actual NFC stack”

The Signature Record Type Definition (RTD) 2.0 technical specification is designed to enable developers to verify the authenticity and integrity of data within NFC Data Exchange Format (NDEF) messages, the means by which NFC devices and tags exchange information.

“Signature RTD 2.0 works by specifying the format used when signing NDEF records and provides a list of suitable signature algorithms and certificate types that can be used to create signatures,” the standards body explains.

“When NDEF records are signed in accordance with the Signature RTD 2.0 specification, malicious hackers cannot tamper with trusted messages. In addition, the signature record identifies the signer by name, and signers who act in bad faith can have their privileges quickly revoked.”

The initial version of the specification was unveiled in 2010, and the latest version “adds to the features of Signature RTD Technical Specification 1.0 by supporting compact certificate formats to accommodate most tag types and increasing security strength by supporting National Institute of Standards and Technology (NIST) and [German] Federal Office of Information Security (BSI) recommended algorithms,” the Forum adds.

“The aim here is to develop a security specification for protecting the NDEF messages that are on the tags,” TrustPoint’s Tony Rosati, the NFC Forum’s security technical working group chair, told NFC World. “The way we do that is we use a technique called code signing or signing, where we just sign the contents of the NDEF messages so they can’t be modified.

“All mobile apps on phones are digitally signed and the phone itself, before you open the app, verifies the app — has it been tampered with? — and then it runs the application. So, it uses the same techniques to cryptographically sign messages that are stored on tags and so that anybody reading that message can verify both the message and the author.

“The specification uses standard public key infrastructure (PKI) technology, the same infrastructure that’s used for issuing SSL certificates for web browsers and code signing.”

“So the goal is to develop a security specification to protect NDEF messages and leverage the existing PKI infrastructure that’s already out there and built into your browsers to make this work,” Rosati added.

“The certificate authorities would first be in the business of issuing certificates for signing messages and then the app vendors for NFC-enabled devices would write apps that use the specification. Hopefully, because it’s an open standard, we hope to see it eventually being built into the mobile OS, the actual NFC stack, so it would just work out of the box.”