Overview
ISO/IEC 13157-3:2016 specifies the NFC‑SEC cryptography mechanisms for Protocol Identifier PID = 02, defining message contents and cryptographic methods for secure NFC peer-to-peer communication. The standard mandates use of Elliptic Curve Diffie‑Hellman (ECDH) with curve P‑256 (ECDH‑256) for key agreement and AES in Galois/Counter Mode (AES‑GCM) for authenticated encryption. It is part of the NFC Security series and complements ISO/IEC 13157‑1 (protocol) and ISO/IEC 13157‑2 (other cryptography variants).
Key topics and technical requirements
- Key agreement: ECDH using curve P‑256 (per FIPS 186‑4) to derive a shared secret.
- Authenticated encryption: AES‑128‑GCM for data confidentiality and integrity (t = 96-bit tag).
- Key derivation: Two KDFs for Secure Simple Exchange (SSE) and Secure Channel (SCH) based on AES‑CMAC PRF‑128 (AES‑CMAC used as PRF).
- Key confirmation: Entities exchange AES‑CMAC‑96 tags to confirm both have derived the same keys (per ISO/IEC 11770‑3).
- Nonces: Each peer sends fresh random nonces with at least 128 bits of entropy; nonces must be uncorrelated across transactions (ISO/IEC 18031 referenced).
- StartVar (IV derivation): StartVar is generated from nonces using AES‑CMAC per ISO/IEC 19772 and correlated corrigenda to ensure distinct IVs per message.
- Key usage separation: Derived keys MK, K and MK (SSE/SCH) have specific, limited purposes (master keys, authenticated encryption keys); keys must be unique per transaction.
- Protocol details: Covers primitives, message sequence integrity (SN), data conversions, and SCH/SSE invocation and data exchange for PID 02.
Practical applications
ISO/IEC 13157‑3:2016 is intended for implementing secure NFC interactions where devices do not share pre-established secrets. Typical use cases:
- Mobile payments and wallet-to-wallet transactions
- Secure pairing and data exchange between phones, wearables, and readers
- Ticketing, transit passes, and access control where short-range authenticated channels are required
- Point‑to‑point NFC file transfer with confidentiality and integrity guarantees
Who should use this standard
- NFC chipset and secure element designers
- Firmware and NFC protocol implementers
- Application developers building secure NFC services
- Security architects, evaluators, and certification bodies assessing NFC communication security
Related standards
Keywords: ISO/IEC 13157‑3:2016, NFC security, NFC‑SEC, ECDH‑256, AES‑GCM, AES‑CMAC, key derivation, authenticated encryption, secure NFC channel.