Near Field Communication (NFC)

What is Near Field Communication?

Near Field Communication (NFC) is a set of communication protocols that enables two electronic devices, one of which is usually a portable device such as a smartphone, to establish communication by bringing them within 4 cm (1.5 in) of each other. NFC is based on inductive coupling between two loop antennas operating at the ISM band frequency of 13.56 MHz, with data rates of 106, 212, or 424 kbps.

Unlike Bluetooth or Wi-Fi, NFC does not use electromagnetic waves for communication. Instead, it relies on magnetic field induction between two coil antennas. The initiator (active device) generates an RF field that powers the target (passive device), enabling communication without the target needing its own power source. This magnetic coupling mechanism is fundamentally different from far-field radio communication and is why NFC has such limited range—approximately 4 cm maximum.

NFC Operating Modes

NFC operates in three distinct modes, each serving different use cases. Understanding these modes is essential for grasping the full scope of NFC applications:

• Reader/Writer Mode: The NFC device reads and writes data to NFC tags (passive targets). This mode uses ISO 14443 and is used for reading smart posters, accessing product information, and writing NDEF data to tags. The reader generates the RF field and communicates with the passive tag using load modulation.
• Peer-to-Peer (P2P) Mode: Two NFC devices exchange data bidirectionally using NFC-DEP (NFC Data Exchange Protocol), defined in ISO 18092. This mode enables quick data exchange between smartphones, such as sharing contacts, URLs, or bootstrapping a Bluetooth/Wi-Fi connection. The protocol supports both active and passive communication modes.
• Card Emulation Mode: An NFC device emulates a contactless smart card, allowing it to be read by standard contactless readers. This mode is critical for mobile payments—Apple Pay, Google Pay, and Samsung Pay all use card emulation. Host Card Emulation (HCE) allows software-based card emulation without a dedicated secure element.

The NFC Protocol Stack

The NFC Forum has defined a comprehensive protocol stack that builds on existing ISO standards while adding NFC-specific functionality. The stack layers, from bottom to top, are:

• RF Layer (ISO 14443 / ISO 18092): The physical layer handles modulation (OOK/ASK), data rates, and the RF field. ISO 14443 defines Type A (106 kbps, Modified Miller coding) and Type B (106 kbps, NRZ-L coding) modulation schemes. ISO 18092 adds FeliCa-compatible modulation at 212 and 424 kbps.
• LLCP (Logical Link Control Protocol):Provides a logical link between NFC devices, supporting both connection-oriented and connectionless communication. LLCP handles fragmentation, multiplexing, and flow control. It is the NFC equivalent of Ethernet's LLC layer and enables multiple protocols to share the NFC link.
• RTD (Record Type Definition): Defines how data is structured in NFC tags. RTD specifies well-known types such as URI, Text, MIME type, and Smart Poster. Each record has a type identifier, optional ID, and payload. RTD records are serialized into NDEF messages.
• NDEF (NFC Data Exchange Format): A lightweight binary message format used to exchange data between NFC devices and tags. An NDEF message contains one or more NDEF records, each carrying a typed data payload. NDEF supports payloads up to 2^32 - 1 bytes through chunked records. It is the universal data format of the NFC ecosystem.
• SNEP (Simple NDEF Exchange Protocol): A request/response protocol that runs over LLCP for exchanging NDEF messages between NFC devices. SNEP is used in P2P mode to push and pull NDEF messages. It supports both PUT and GET operations with optional content negotiation.

ISO Standards Behind NFC

NFC is built on a foundation of ISO standards that predate NFC itself. Understanding these standards is crucial for understanding NFC's capabilities and limitations:

• ISO 14443 (Proximity Cards): Defines contactless smart cards operating at distances up to 10 cm. It has two variants—Type A (used by MIFARE, NXP) and Type B (used by Calypso, DESFire). Communication uses 13.56 MHz with ASK modulation. The standard defines anticollision (ISO 14443-3), transmission protocol (ISO 14443-4), and command sets. Most NFC tags and cards conform to ISO 14443.
• ISO 15693 (Vicinity Cards): Operates at distances up to 1 meter, using a different modulation scheme than ISO 14443. ISO 15693 cards are used in library systems, supply chain, and asset tracking. While not part of NFC proper, some NFC readers can operate in ISO 15693 mode for extended range applications.
• ISO 18092 (NFC-DEP): Defines the NFC Data Exchange Protocol, which is the basis for NFC P2P mode. It specifies communication parameters, frame formats, and the activation/deactivation sequence. ISO 18092 supports both active and passive communication modes at 106, 212, and 424 kbps.
• JIS X 6319-4 (FeliCa): A Japanese standard for contactless smart cards, originally developed by Sony. FeliCa uses a different modulation and coding scheme than ISO 14443 Type A/B but operates at the same 13.56 MHz frequency. FeliCa is widely deployed in Japan for transit (Suica, PASMO) and e-money (Edy, nanaco). The NFC Forum incorporated FeliCa support into NFC specifications.

MIFARE: The Dominant NFC Chip Family

MIFARE is a family of NFC-compatible contactless smart card ICs manufactured by NXP Semiconductors. MIFARE chips are the most widely deployed NFC technology globally, with over 1 billion cards in circulation:

• MIFARE Classic: Available in 1K (16 sectors, 64 blocks) and 4K (32+8 sectors) variants. Uses Crypto-1 stream cipher for authentication and encryption. Communication at 106 kbps. Each sector has its own key pair (Key A and Key B) for access control. MIFARE Classic was designed in the early 1990s and was found to have critical vulnerabilities in 2007 when researchers demonstrated practical attacks against Crypto-1.
• MIFARE DESFire: High-security MIFARE variant with AES-128 encryption, 3DES, and CRC-32 integrity checks. Available in EV1 (1997), EV2 (2006), and EV3 (2012) generations. Supports multiple applications on a single card, per-application keys, and file-based data storage. DESFire EV3 is the recommended MIFARE variant for new deployments due to its strong cryptographic protections.
• MIFARE Ultralight: Low-cost, simple NFC tag ICs designed for disposable applications. Ultralight C adds 3DES authentication. Ultralight EV1 offers 1648 bits of user memory with one-time programmable features. Commonly used for URL tags, smart posters, and single-use transit tickets.

Contactless Payments

NFC is the backbone of modern contactless payment systems. The EMVCo specifications define how payment data is transmitted between the card (or phone) and the terminal:

• EMVCo Specifications: EMV (Europay, Mastercard, Visa) defines the contactless payment protocol. EMV Contactless (Book C) specifies the RF communication interface, transaction processing, and security requirements. The latest EMVCo 3.0 specification (2018) supports quick chip and dynamic authentication.
• Tokenization: Apple Pay, Google Pay, and Samsung Pay do not transmit the actual card number. Instead, they use device-specific payment tokens (DPANs) generated by a Token Service Provider (TSP). The token is useless if intercepted, providing security beyond the underlying card number. Each transaction generates a unique cryptogram.
• Host Card Emulation (HCE): Introduced in Android 4.4 (2014), HCE allows any app to emulate an NFC card without requiring a dedicated Secure Element (SE). HCE stores payment credentials in software, using cloud-based tokenization for security. The alternative is a hardware Secure Element (eSE or microSD-based SE), which provides tamper-resistant storage but requires carrier or bank cooperation.
• Secure Element vs HCE: A hardware Secure Element (SE) is a tamper- resistant chip that stores cryptographic keys and payment credentials. It provides stronger security but requires physical integration into the device. HCE trades some security for flexibility—credentials can be provisioned over-the-air without hardware changes. Most modern implementations use a combination: SE for primary payment, HCE for secondary cards and transit.

NFC Tag Types

The NFC Forum defines five tag types, each based on different chip technologies with varying capacities and capabilities:

• Type 1: Based on Innovision Topaz chips. Simple, low-cost tags with 96 bytes of memory (expandable to 4608 bytes). Supports read/write and one-time programmable features. No encryption. Used in simple URL and text tags.
• Type 2: Based on NXP MIFARE Ultralight chips. 48 bytes to 1904 bytes of memory. Supports read/write, OTP areas, and NDEF data. Most common tag type for smart posters and simple NFC applications. Very low cost, enabling mass deployment.
• Type 3: Based on Sony FeliCa chips. 1 kB to 9 kB of memory. Supports high-speed data transfer (212/424 kbps) and contactless payment. Used in Japanese transit and e-money systems. Supports multiple command sets for different applications.
• Type 4: Based on ISO 14443A/B chips (MIFARE DESFire, etc.). 1 kB to 32 kB of memory. Supports ISO 7816-4 commands and NDEF data. Highest security among tag types—supports AES and 3DES authentication. Used in high-value applications like transit and access control.
• Type 5: Based on ISO 15693 chips (ICODE SLI, etc.). 2 kB to 2528 bytes. Operates at extended range (up to 1 meter) compared to Types 1-4. Used in supply chain, library systems, and logistics. The newest tag type, added in 2014.

Reading and Writing NFC Tags

Understanding NDEF message structure is essential for NFC development. An NDEF message contains one or more records, each with a header and payload:

• NDEF Record Structure: Each record has a header (flags: MB, ME, CF, IL, TNF), type length, ID length, payload length, type, optional ID, and payload. The TNF (Type Name Format) field indicates how to interpret the type: Well-Known (0x01), Media-type (0x02), Absolute URI (0x03), External Type (0x04), or Unknown (0x05).
• Well-Known Types:RTD URI (RFC 2396 encoded URLs), RTD Text (UTF-8 or UTF-16 text with language code), and Smart Poster (collection of RTD records). RTD URI uses a prefix byte (0x00 = no prefix, 0x01 = "http://www.", 0x02 = "https://www.", etc.) followed by the URI string.
• Read/Write Example:To write a URL to an NFC tag, create an NDEF message with a single RTD URI record: TNF=0x01, Type="U", Payload=[prefix byte][URL]. To read a tag, the NFC reader receives the NDEF message and parses the record structure to extract the data. Most mobile OSes automatically parse NDEF messages and prompt the user to open URLs, add contacts, etc.

NFC Security Considerations

While NFC's short range provides inherent physical security, several attack vectors exist that must be considered:

• Eavesdropping: NFC operates via magnetic coupling, making remote eavesdropping extremely difficult—the attacker would need a large antenna within 4 cm. However, theoretical attacks using resonant antennas at greater distances have been demonstrated in laboratory conditions. The short range is a fundamental security feature, not a limitation.
• Relay Attacks:An attacker can relay NFC communication between a legitimate reader and a victim's card/phone over a greater distance. This requires two cooperating devices—one near the victim, one near the legitimate reader. Relay attacks are the most practical NFC threat and have been demonstrated against payment systems and transit cards.
• Data Manipulation: An attacker could intercept and modify NFC data in transit. This is mitigated by encrypted communication channels (DESFire) and transaction cryptograms (EMV payments). However, basic NFC tags (Type 1, Type 2) have no encryption and are vulnerable to data manipulation if intercepted.
• MIFARE Classic Crypto-1 Weaknesses:The Crypto-1 cipher used in MIFARE Classic was reverse-engineered and broken in 2007. Researchers demonstrated that a card could be cloned in seconds using commodity hardware. The attack exploits weaknesses in the cipher's linear feedback shift register (LFSR) design. MIFARE Classic should not be used for security-critical applications—MIFARE DESFire or other AES-based solutions are recommended.

Transit and Access Control

NFC has become the dominant technology for public transit ticketing and physical access control worldwide:

• Transit Cards:London's Oyster card uses MIFARE DESFire for contactless transit. Tokyo's Suica and PASMO use Sony FeliCa (JIS X 6319-4). Hong Kong's Octopus card, originally FeliCa-based, now supports NFC payments. These systems process millions of transactions daily with sub-300ms tap times. Mobile transit (Apple Express Transit, Google Transit) allows NFC phones to work without authentication, mimicking contactless cards.
• Access Control: MIFARE Classic and DESFire are widely used in building access control systems. Each card stores an access key and permissions. The reader verifies the card and checks access rights against a database. Mobile credentials (using phone NFC) are increasingly replacing physical cards, with additional security through device authentication (biometrics).
• Smart Posters: NFC-enabled posters contain embedded tags that, when tapped, provide additional content—URLs, contact information, app downloads, or promotional offers. Smart posters use NDEF messages with RTD URI records. They are common in retail, museums, and public spaces. The reader can write to tags for dynamic content updates.
• Device Pairing: NFC simplifies Bluetooth and Wi-Fi pairing by exchanging connection parameters via an NDEF message containing a handover record. Tapping two devices triggers the BLE/Wi-Fi handshake without manual setup. Apple, Google, and Samsung all support NFC-initiated device pairing for headphones, speakers, and other peripherals.
• Data Transfer: Android Beam (deprecated in Android 10) and Samsung Beam used NFC P2P mode to initiate peer-to-peer data transfer. The NFC tap established a connection and handed off to Bluetooth for the actual data transfer. Modern Android still supports NFC-triggered sharing for URLs, contacts, and files via the share sheet.

The Economics of NFC

NFC technology has achieved massive scale through its integration into smartphones and the contactless payment ecosystem. Key economic factors include:

• Scale: Over 2 billion NFC-enabled smartphones shipped annually. MIFARE chips are deployed in over 10 billion cards and tokens globally. Transit systems in 100+ cities process billions of NFC transactions per year.
• Cost: Basic NFC tags (Type 2, MIFARE Ultralight) cost less than $0.05 per unit at volume. MIFARE DESFire EV3 chips cost $0.50-$2.00 depending on volume and features. NFC readers cost $5-$50 for consumer-grade, $100+ for payment terminals.
• Standards:The NFC Forum maintains specifications with input from 100+ member companies. EMVCo manages contactless payment standards. ISO standards ensure global interoperability. This standards-driven approach has been critical for NFC's adoption across industries and geographies.

Future of NFC

NFC continues to evolve with new capabilities and applications:

• Wireless Charging: The NFC Forum has specified wireless charging (WLC) for low-power devices using the NFC coil, enabling simultaneous data transfer and power delivery.
• Digital Identity:NFC is central to mobile driver's licenses, health passes, and digital IDs. The EU Digital COVID Certificate and various national ID systems use NFC for document verification.
• IoT Integration: NFC tags on IoT devices enable tap-to-provision for Wi-Fi credentials, cloud configuration, and device management. NFC reduces the friction of setting up smart home devices.
• Secure Authentication: NFC is used for second-factor authentication in enterprise environments, replacing physical tokens with NFC-enabled smartphones or cards.