RFID, NFC & UWB · Study deck
NFC Security and Alternatives
Picture a worker tapping a label before opening a storage cage.
Radio Remi is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Compare NFC, QR, BLE, UWB, and RFID security boundaries without treating range as the whole security model.
- Distinguish static tag data, signed or dynamic tag data, and credential-based authentication.
- Explain relay, tamper, clone, and privacy risks for NFC-centered IoT workflows.
- Define release evidence for security-sensitive tap, scan, range, and reader workflows.
Major section
Start With the Story
The first question is which claim comes from distance and which claim needs a protected check.
- BLE means Bluetooth Low Energy, a short-range radio designed for low-power links.
- RFID means radio-frequency identification, a family of radio tag and reader systems.
- UWB means ultra-wideband, a radio method that can support precise ranging.
Major section
Start With the Story (continued)
NFC is easy to overtrust because the user is close to the reader.
- This runway does not prove that one radio or code is secure in every setting.
- Close range can help with intent, but it does not automatically prove confidentiality, authorization, freshness, tamper resistance, or relay protection.
- NFC, QR, BLE, UWB, and RFID all expose different risks, so the useful review names the threat, the fallback, and the evidence that makes the chosen interaction safe enough.
Major section
Start With the Story (continued)
Proximity is not proof: A tap shows that a reader and target were near each other, but it does not prove identity, consent, freshness, or authorization.
- Static data: A UID, printed code, or plain NDEF record can identify an object, but it can also be copied unless the application treats it as an untrusted pointer.
- Dynamic proof: A nonce, counter, signature, challenge-response, or online validation step can prove freshness or possession of a credential.
- Relay risk: A relay forwards legitimate traffic between a target and reader, so strong cryptography alone may not show that both endpoints are physically co-located.
Major section
In 60 Seconds · Start With the Boundary
NFC is useful when a deliberate tap should select an object or credential, but short range is only one control.
- QR codes are easy to copy and photograph.
- BLE provides longer sessions but needs pairing, key handling, and reconnect policy.
- Security comparisons fail when they ask which technology is "secure" in the abstract.
Major section
Comparison Rule · Static Data, Dynamic Proof, and Credentials
A dynamic credential can be undermined by a weak fallback.
- A strong NFC tap can be undermined by trusting an unsigned URL.
- A precise range estimate can be undermined if it is not bound to the right device identity.
- A successful fresh proof does not override a revoked role or unsafe equipment state.
Major section
Card Emulation Is a Credential Interface · Handover Moves the Risk
Card emulation changes the trust model.
- The device or card is not just a data label; it participates in a credential protocol expected by a reader.
- The follow-on connection still needs peer binding, session protection, retry policy, and user-visible failure handling.
- A successful tap is only the start of the proof chain.
Major section
Threats and Controls · Common Mistake: Proximity-Only Approval
The most useful NFC security review maps each threat to a control and to the evidence that proves the control works.
- Signed or dynamic records can expose a clone when the backend rejects a reused static identity.
- A strict NDEF allowlist rejects unknown schemes or malformed payloads.
- Relay risk: Cryptography may still be relayed.
Major section
Tap Intent Is Not Confidentiality
The most common NFC security belief is that a few-centimetre operating range makes interception irrelevant.
- NFC's genuine advantage is deliberate tap intent, not automatic confidentiality or authorization.
- The NFC tag should not say "open drawer 4" as a trusted command.
- The comparison changes when fallback is used.
Major section
Tap Intent Is Not Confidentiality (continued)
A safer design treats the tap as a selector: asset=cabinet-12-drawer-4, input=nfc, and a signed or backend-validated proof if the tag supports one.
- Those bytes select an object; they are not an instruction to open it and are not shown as an NDEF memory dump.
- The app validates the host or schema, and verifies a signature when proof is available, before asking backend policy.
- The backend checks the signed-in technician, asset state, reservation, and lock health; only then can it issue a short-lived release instruction to the BLE controller.
Major section
Tap Intent Is Not Confidentiality (continued)
A copied static tag can point to the same drawer, so it must never grant protected work by itself.
- The phone then asks the backend whether this signed-in technician may check out that tool at this time.
- The backend sends a short-lived release instruction to the BLE controller only after asset state, user role, reservation state, and lock health all match.
- A QR scan can select the same drawer, but it is easier to photograph or replace, so the backend should record input=qr_fallback and may require stronger user confirmation or supervisor approval.
Major section
Attack Evidence for Tap Workflows
Those categories prevent field fixes from becoming invisible security bypasses.
- The relay attack is the important one for proximity claims.
- The attacker does not break the cryptography; they extend the wire by presenting a genuine credential to a genuine reader that are in different places.
- Each row should name the parser result, proof result, policy decision, user message, and audit event.
Major section
Compare Interaction Models
Those checks explain why swapping technologies does not automatically fix a design.
- NFC without proof fails at input integrity.
- QR without backend validation fails the same way.
- BLE with weak reconnect policy may pass input integrity but fail target binding if the phone talks to the wrong lock.
Major section
Comparing NFC With Alternatives · Selection Questions
NFC vs BLE: NFC is strong for deliberate selection.
- The right comparison depends on the workflow, not on a generic technology ranking.
- NFC vs QR: NFC can support dynamic tag proof and hidden data, while QR is visible and easy to duplicate.
- BLE is better for continuing sessions after selection.
Major section
Fallback and Failure Handling
Fallback is part of the security design, not only a usability feature.
- A fallback path can preserve service when tags fail, but it can also become the easiest way around the stronger control.
- Telemetry should identify which input path was used so failures and misuse can be reviewed.
Major section
Release Evidence
A compatibility matrix records readers, phones, tag technology, fallback media, and mounting conditions.
- Negative tests should show how the app rejects a copied static identifier, malformed data, an unauthorized session, or a stale proof.
- Field tests then check the intended surface and workflow.
- Telemetry: Input technology, proof result, policy decision, fallback path, denial reason, and support correlation ID.
Major section
Design Review Checklist
Freshness: The design names the nonce, counter, signature, challenge-response, or backend state check used to reject stale data.
- Relay: The design states whether relay matters and which timing, context, or second-factor controls apply.
- Privacy: Stable identifiers, logs, and telemetry are minimized and justified.
- Fallback: Weaker paths are visible, policy-gated, and tested.
Deck summary
Key takeaways
The first question is which claim comes from distance and which claim needs a protected check.
- NFC is easy to overtrust because the user is close to the reader.
- Proximity is not proof: A tap shows that a reader and target were near each other, but it does not prove identity, consent, freshness, or authorization.
- NFC is useful when a deliberate tap should select an object or credential, but short range is only one control.
- A dynamic credential can be undermined by a weak fallback.
Retrieval practice
Recall check 1 of 3
Radio Remi says: answer from memory, then check your reasoning.
Q1A design treats an NFC tag's UID as the credential that authorizes access. Why is that weak?
Show answer
Answer: B A static UID can be read and cloned, so it proves neither freshness nor authorization and is not a credential.
Retrieval practice
Recall check 2 of 3
Radio Remi says: answer from memory, then check your reasoning.
Q2A contactless access system assumes that because NFC only works at a few centimetres, a badge read proves the badge is physically at the door. Why is this unsafe, and what class of defense addresses it?
Show answer
Answer: C NFC's short operating range does not prove presence; relay attacks forward the exchange over distance without breaking cryptography.
Retrieval practice
Recall check 3 of 3
Radio Remi says: answer from memory, then check your reasoning.
Q3A smart locker can be opened by tapping an NFC tag on the locker door or scanning a QR fallback label. Which security design is strongest?
Show answer
Answer: C A tap or scan is an input signal.
Print reference
Answers
Answer key.
- B · A static UID can be read and cloned, so it proves neither freshness nor authorization and is not a credential.
- C · NFC's short operating range does not prove presence; relay attacks forward the exchange over distance without breaking cryptography.
- C · A tap or scan is an input signal.