Overview
ISO/IEC 13157-1:2014 specifies the NFC-SEC protocol services and Protocol Data Units (PDUs) used to secure NFCIP-1 communications. It defines two primary services - the Shared Secret Service (SSE) and the Secure Channel Service (SCH) - and the protocol mechanisms (PDUs and state machine) that peer NFC-SEC entities use to establish shared secrets, confirm keys, protect PDUs, and terminate secure sessions. This part is complemented by the NFC-SEC cryptography part (ISO/IEC 13157-2) that defines the underlying algorithms (e.g., ECDH/AES as used in the series).
Key topics and technical requirements
- Services defined
- Shared Secret Service (SSE): Establishes a cryptographic shared secret between two NFC-SEC users for later use.
- Secure Channel Service (SCH): Derives a link key from a shared secret and protects bi-directional communication across the channel.
- Protocol mechanisms
- Key agreement: Performed using ACT_REQ / ACT_RES PDUs according to the selected Protocol Identifier (PID).
- Key confirmation: Performed using VFY_REQ / VFY_RES PDUs to verify the agreed shared secret.
- PDU security (SCH only): Uses ENC PDUs to provide sequence integrity, confidentiality, data integrity, and origin authentication as defined by the chosen NFC-SEC cryptography standard.
- Termination: TMN PDUs to close SSE and SCH sessions.
- PDUs and protocol control
- Specification of NFC-SEC-PDUs (SEP, PID, NFC-SEC payload, ERROR) and Protocol Control Information (PCI).
- Protocol rules cover error handling, interworking, sequence integrity, and cryptographic processing.
- Conformance and scope
- Implementations may support one or more services and must use the cryptographic mechanisms referenced by the PID.
- Does not define application-level security for smart-card-specific use cases (ISO/IEC 7816 series remains applicable there).
Practical applications and target users
- Who uses this standard:
- NFC device and chipset manufacturers, smartphone OEMs, secure element vendors
- Payment, transit, and access-control solution providers implementing NFC-based secure channels
- Security architects, protocol engineers, and integrators designing NFC communication stacks
- Test labs and certification bodies validating NFC-SEC compliance
- Practical value:
- Enables interoperable secure NFC connections over NFCIP-1
- Standardizes PDU formats and lifecycle (establish, confirm, protect, terminate)
- Facilitates reuse of cryptographic profiles (via PID) for consistent security across devices
Related standards
Keywords: NFC security, NFC-SEC, NFCIP-1, secure channel, shared secret, PDU, key agreement, key confirmation, ENC PDU, NFC protocol.
Open preview (PDF)Information technology — Telecommunications and information exchange between systems — NFC Security — Part 1: NFC-SEC NFCIP-1 security services and protocol