UID - Uniquely identify (and clone?) NFC tags

One of the great advantages of NFC tags, in addition to their robust storage and contactless, configuration-free reading, is the serial number they contain, which can be used for unique identification. This article will first discuss the basics of NFC UID and then show how UID can be used in practice. Finally, the topic of UID cloning is addressed in order to assess the security of UID-based identification mechanisms.

UID - Unique Identification Number

Each NFC tag contains a serial number that makes it uniquely identifiable. The technical justification for this serial number can be found in the ISO/IEC 14443-3 specification and can be illustrated with a practical problem: If an NFC reader encounters multiple NFC tags at the same time, then it must be able to distinguish the individual NFC tags from each other in order to separate the data streams. If each tag contains a unique number, this differentiation succeeds (collision detection). Due to the short range of NFC, this problem seems to be of little practical relevance, but if USB readers are used and several small objects are equipped with e.g. 5mm NFC tags, the differentiation of a tag can become difficult. In addition, the serial number offers further advantages, as will be explained later.

UID Structure

In simple terms, the UID is a simple number that is permanently stored in the NFC tag. The most common NFC tags currently use 7 bytes to store the serial number, providing space for a 14-digit hexadecimal number. The hexadecimal system is converted to a base 16 number system commonly used in computer science where counting is from 0-F (instead of 0-9 as in the commonly known decimal system). Thus the serial number can be stored in a space-saving way. Due to the 7 bytes, there are accordingly FF:FF:FF:FF:FF:FF many numbers available, which corresponds to the number 72,057,594,037,927,935 converted into the 10 system. So enough space to provide for a worldwide unique assignment of numbers.

In reality, the actual range of free numbers is somewhat smaller, since e.g. blocks may be reserved for manufacturers or product lines. Therefore, the specification provides for the dynamic extension of the number range. Past experience has shown, for example, that the 4-byte UIDs used in the Mifare Classic ran out several years ago and larger number ranges are necessary. However, the current 7-byte UIDs offer sufficient space for the foreseeable future. The following UID variants are currently specified:

UID use cases

Thanks to the uniqueness of the UID, there are numerous use cases that cannot be realized with alternative product identifiers (barcodes, QR codes). For example, if you save all the UIDs used for the delivered NFC tags (which can be booked as a service from us), then the NFC tag can be identified when scanned. When labeling products or clothing, for example, it is possible to identify whether the product is original. Using the UID for intelligent inventory solutions is also a typical use case. Reading the UID is possible with Android, iOS or Windows and the appropriate software. In our How2s, we describe how to read out the UID in detail for each individual platform. With downstream software for matching the UID, the use cases described above can thus be solved.

Clone UID

The UID of an NFC tag is a worldwide unique serial number. It should therefore be impossible to read out the UID and program it on other NFC tags (UID cloning). In fact, however, there are some (not original NXP) chipsets that allow the free configuration of the UID. It is also possible to simulate an NFC tag with any UID using a hardware reader. So there are possibilities to clone the UID. However, these will not be discussed here. Rather, the question now arises as to whether the UID can be assumed to be secure. The fact is that the security level of the desired is to be considered in order to be able to give an answer. Among other things, the following questions must be clarified:

• Who is the user group (open / closed)?
• Is the UID to be cloned known?
• Who controls the infrastructure?
• Are additional characteristics to the UID used?
• What damage can occur in the event of misuse?

In general, it can be stated that the UID can be used well everywhere where the disclosure of the UID does not have serious, security-related consequences. The UID can be used without hesitation for product identification or inventory, since the product itself is available to the inspector in addition to the NFC tag. In contrast, the UID should be critically questioned as the sole security feature for locking systems and is, strictly speaking, unsuitable. In professional solutions, chipsets with extended security functions (MIFARE DESFire) are used here. However, NXP now also offers a remedy for authenticity verification with chipsets such as the NTAG DNA, which in addition to the serial number can generate a unique message during scanning that can be verified by the caller.

Conclusion

The UID is one of the most important advantages of NFC tags and provides the means to uniquely identify NFC tags and associated objects. Cloning of NFC tags is possible with certain means but should only be considered in security-critical use cases. We would be happy to advise you on the use of UID and offer technical support here, e.g. by reading out orders in advance, to support its use.

Further information

Hexadecimal System NXP Application Notes on the UID