RFID, NFC & UWB · Study deck
NFC Security and Alternatives
Picture a worker tapping a label before opening a storage cage.
Radio Remi is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Compare NFC, QR, BLE, UWB, and RFID security boundaries without treating range as the whole security model.
- Distinguish static tag data, signed or dynamic tag data, and credential-based authentication.
- Explain relay, tamper, clone, and privacy risks for NFC-centered IoT workflows.
- Define release evidence for security-sensitive tap, scan, range, and reader workflows.
Major section
Start With the Story
The first question is which claim comes from distance and which claim needs a protected check.
- BLE means Bluetooth Low Energy, a short-range radio designed for low-power links.
- RFID means radio-frequency identification, a family of radio tag and reader systems.
- UWB means ultra-wideband, a radio method that can support precise ranging.
Major section
Start With the Story (continued)
NFC is easy to overtrust because the user is close to the reader.
- This runway does not prove that one radio or code is secure in every setting.
- Close range can help with intent, but it does not automatically prove confidentiality, authorization, freshness, tamper resistance, or relay protection.
- NFC, QR, BLE, UWB, and RFID all expose different risks, so the useful review names the threat, the fallback, and the evidence that makes the chosen interaction safe enough.
Major section
Start With the Story (continued)
Proximity is not proof: A tap shows that a reader and target were near each other, but it does not prove identity, consent, freshness, or authorization.
- Static data: A UID, printed code, or plain NDEF record can identify an object, but it can also be copied unless the application treats it as an untrusted pointer.
- Dynamic proof: A nonce, counter, signature, challenge-response, or online validation step can prove freshness or possession of a credential.
- Relay risk: A relay forwards legitimate traffic between a target and reader, so strong cryptography alone may not show that both endpoints are physically co-located.
Major section
In 60 Seconds
NFC is useful when a deliberate tap should select an object or credential, but short range is only one control.
- QR codes are easy to copy and photograph.
- BLE provides longer sessions but needs pairing, key handling, and reconnect policy.
- RFID can scan many assets, but identity and authorization still depend on the tag and backend model.
Major section
Start With the Boundary
Security comparisons fail when they ask which technology is "secure" in the abstract.
- To place start with the boundary on firm evidence, trace: NFC tap toward needs proof and policy in it. Visible copied pointer supplies the consequence.
- The choice depends on visible copied pointer.
Major section
Comparison Rule · Static Data, Dynamic Proof, and Credentials
A dynamic credential can be undermined by a weak fallback.
- A strong NFC tap can be undermined by trusting an unsigned URL.
- A precise range estimate can be undermined if it is not bound to the right device identity.
- Static data,: Challenge-response or counter, and: What evidence is logged as separate entries.
Major section
Card Emulation Is a Credential Interface · Handover Moves the Risk
Card emulation changes the trust model.
- The device or card is not just a data label; it participates in a credential protocol expected by a reader.
- The follow-on connection still needs peer binding, session protection, retry policy, and user-visible failure handling.
- A successful tap is only the start of the proof chain.
Major section
Threats and Controls
The most useful NFC security review maps each threat to a control and to the evidence that proves the control works.
- To make threats and controls reviewable, inspect how: NFC Threat and Control Map relates to: Detect rewrite, verify signature in it.: Reject unknown schemes supplies the consequence.
- Relay risk: Cryptography may still be relayed.
Major section
Tap Intent Is Not Confidentiality
The most common NFC security belief is that a few-centimetre operating range makes interception irrelevant.
- NFC's genuine advantage is deliberate tap intent, not automatic confidentiality or authorization.
- The NFC tag should not say "open drawer 4" as a trusted command.
- The comparison changes when fallback is used.
Major section
Tap Intent Is Not Confidentiality (continued)
A safer design treats the tap as a selector: asset=cabinet-12-drawer-4, input=nfc, and a signed or backend-validated proof if the tag supports one.
- Preserve the: Static copies must not authorize protected work condition in the handoff for tap intent is not confidentiality.
- The phone then asks the backend whether this signed-in technician may check out that tool at this time.
- The backend sends a short-lived release instruction to the BLE controller only after asset state, user role, reservation state, and lock health all match.
Major section
Attack Evidence for Tap Workflows
Those categories prevent field fixes from becoming invisible security bypasses.
- The relay attack is the important one for proximity claims.
- The attacker does not break the cryptography; they extend the wire by presenting a genuine credential to a genuine reader that are in different places.
- Each row should name the parser result, proof result, policy decision, user message, and audit event.
Major section
Compare Interaction Models
Those checks explain why swapping technologies does not automatically fix a design.
- NFC without proof fails at input integrity.
- QR without backend validation fails the same way.
- BLE with weak reconnect policy may pass input integrity but fail target binding if the phone talks to the wrong lock.
Major section
Comparing NFC With Alternatives · Selection Questions
NFC vs BLE: NFC is strong for deliberate selection.
- The right comparison depends on the workflow, not on a generic technology ranking.
- NFC vs QR: NFC can support dynamic tag proof and hidden data, while QR is visible and easy to duplicate.
- BLE is better for continuing sessions after selection.
Major section
Fallback and Failure Handling
Fallback is part of the security design, not only a usability feature.
- A fallback path can preserve service when tags fail, but it can also become the easiest way around the stronger control.
- The comparison reaches authorize action.
- The choice depends on authorize action.
- Reopen fallback and failure handling whenever schema and proof changes.
Major section
Release Evidence
To challenge the claim in release evidence, use it to distinguish: NFC Security Release Evidence from: Named assets and attackers.: Compatibility limits the claim.
- Telemetry: Input technology, proof result, policy decision, fallback path, denial reason, and support correlation ID.
Major section
Design Review Checklist
Freshness:: The design names the nonce, counter, signature, challenge-response, or backend state check used to reject stale data.
- Relay:: The design states whether relay matters and which timing, context, or second-factor controls apply.
- Privacy:: Stable identifiers, logs, and telemetry are minimized and justified.
- Fallback:: Weaker paths are visible, policy-gated, and tested.
Deck summary
Key takeaways
The first question is which claim comes from distance and which claim needs a protected check.
- NFC is easy to overtrust because the user is close to the reader.
- Proximity is not proof: A tap shows that a reader and target were near each other, but it does not prove identity, consent, freshness, or authorization.
- NFC is useful when a deliberate tap should select an object or credential, but short range is only one control.
- Security comparisons fail when they ask which technology is "secure" in the abstract.
Retrieval practice
Recall check 1 of 3
Radio Remi says: answer from memory, then check your reasoning.
Q1A design treats an NFC tag's UID as the credential that authorizes access. Why is that weak?
Show answer
Answer: A A static UID can be read and cloned, so it proves neither freshness nor authorization and is not a credential.
Retrieval practice
Recall check 2 of 3
Radio Remi says: answer from memory, then check your reasoning.
Q2A contactless access system assumes that because NFC only works at a few centimetres, a badge read proves the badge is physically at the door. Why is this unsafe, and what class of defense addresses it?
Show answer
Answer: B NFC's short operating range does not prove presence; relay attacks forward the exchange over distance without breaking cryptography.
Retrieval practice
Recall check 3 of 3
Radio Remi says: answer from memory, then check your reasoning.
Q3A smart locker can be opened by tapping an NFC tag on the locker door or scanning a QR fallback label. Which security design is strongest?
Show answer
Answer: C A tap or scan is an input signal.
Print reference
Answers
Answer key.
- A · A static UID can be read and cloned, so it proves neither freshness nor authorization and is not a credential.
- B · NFC's short operating range does not prove presence; relay attacks forward the exchange over distance without breaking cryptography.
- C · A tap or scan is an input signal.