NTAG424 DNA NFC Labels

Specify the label and delivery state

Use NTAG424 DNA when your project needs cryptographic tag verification beyond a static product link. Select the label for the actual packaging, then agree the personalisation and verification workflow. A valid tag message alone does not prove the contents of a package are genuine.

NTAG424 DNA chip capabilities

These are chip features described in the NXP NTAG424 DNA data sheet. The label image on this page is a generic format example, and the quoted chip and construction must be confirmed before ordering.

How Secure Dynamic Messaging (SUN) works

Secure Dynamic Messaging (SDM) powers the Secure Unique NFC (SUN) message. When configured for SDM, the chip inserts authentication data into an NDEF URL as it is read. The verification server checks the message and the counter history; reading an ordinary static URL is not a SUN verification.

• Tap. A compatible phone reads the configured NDEF URL. Confirm the phone models and reading behaviour in the pilot.
• On-chip. The chip generates the configured SDM fields, such as encrypted UID and counter data and an AES-CMAC. Successive reads within the same read sequence can use the same counter.
• Open. The phone opens the URL with the authentication fields, for example `https://verify.example.com/t?picc_data=…&cmac=…`.
• Verify. The server checks the configured cryptographic fields and the counter history for that tag.
• Result. The service displays the agreed outcome for a valid message, a previously seen message or invalid data.

The verifier should reject counters it has already seen or receives out of order. This detects those replays, but a message collected earlier and never submitted can still pass a later check. NXP describes this remaining risk in data sheet section 9.3. Your integrator must decide whether that is acceptable for the application; counter checks are not proof of a live tap. For configuration and verification details, use NXP AN12196.

Why a SUN tag resists cloning: the CMAC authentication tag

In AES mode, the NTAG424 DNA CMAC authentication tag is an 8-byte truncated AES-CMAC (NIST SP 800-38B). The chip computes it on each new tap from a session key derived from a secret key and, as configured, the UID and counter, and mirrors it into the URL (data sheet 9.3.7–9.3.9). Only a verifier holding the key can recompute it: a cloned tag can only replay messages the genuine tag produced, while a copied static URL works like the original.

What the brand's verification server must check

1. Decrypt the UID and counter with the SDM meta-read key, if encrypted.
2. Recompute the CMAC from the tag's file-read key, UID, counter and any covered URL data; reject a mismatch.
3. Reject a repeated or out-of-order counter, then store the new one.
4. Look up the UID: issued or not, and its product, order and market; check any TagTamper status mirrored in the message.

The five AES-128 keys and what each does

NTAG424 DNA holds five independent AES-128 keys, numbered Key 0 to Key 4. Key 0 is fixed as the application master key. The other four are assigned to roles by the integrator during personalisation; the mapping below is a common arrangement rather than a hard-wired one.

In production the SDM file-read key is usually diversified per tag from the key owner's master key, so one recovered key does not expose other tags. If the UID is encrypted in the URL, the meta-read key must not be UID-diversified, because the server decrypts the UID with it; that shared key needs especially strong protection (AN12196 section 3.4.2). Separately, the NXP originality signature supports a chip-provenance check. It does not authenticate package contents and is distinct from verification of an SDM message.

The TagTamper variant

NTAG424 DNA TagTamper (NT4H2421Tx) is a separate chip variant connected to a detection loop in the label. With the feature enabled, the chip checks the loop when powered and activated or when a relevant command triggers a measurement. Once it records the permanent status as Open, that status cannot be reset to Closed, including by re-personalisation. The permanent and current states can be included in SDM. See NXP TagTamper data sheet, section 10. An opening-detection project also needs a label that routes the loop across the seal; confirm the offered variant and construction in the quotation.

Secure NFC tags for luxury apparel authentication

For luxury apparel, use a tag that adds a fresh authentication code to every tap, such as NTAG424 DNA with SUN, rather than a fixed link: a copied tag cannot generate a new valid code. Proud Tek supplies the labels and any agreed configuration; the brand's system provider runs verification. NXP names authenticating goods and identifying sales outside authorised markets as uses (data sheet section 3).

Proud Tek produces NFC labels and custom tags; each construction is confirmed per order and tested on samples.

Luxury apparel sold in the United States

The same 13.56 MHz label serves US sales; the phones vary. iPhone XS and later read https URL tags in the background without an app (Apple); pilot with iPhone and Android models. A US retailer may also require a UHF tag for inventory (RFID for retail and apparel); Proud Tek makes UHF labels and hang tags too. Test both together.

Factory overruns and diversion: what NFC authentication can and cannot prove

A verified SUN message shows that a tag holding your key produced it, not how the item reached the seller. Overruns are units your contract manufacturer makes beyond the authorised quantity (US Justice Department example) and sells outside your channels, with genuine tags if spare personalised labels are at the factory. Diverted goods are authorised stock sold outside the agreed market. Controls around the tag:

• Control keys and personalisation: issue labels per purchase order; reconcile used and spoiled ones.
• Record each chip UID against product, factory, order and market.
• Activate on receipt, so surplus tags return “not issued”.
• Watch scan locations: scans outside a UID's issued market can flag possible diversion, not prove it. Scan IP addresses and locations can be personal data (GDPR Article 4(1)); agree what is logged.

Agree who delivers each part

Proud Tek can prepare an agreed label configuration through the RFID encoding service. The quotation must state which work is included. Labels we configure are each read back, and the order ships with a data report; labels with a printed serial also get a file that links each UID to its serial, and both come as Excel, CSV or XML. The buyer and integrator define the configuration and acceptance criteria; never send secret keys in an enquiry form, ordinary email or artwork file.

Sample acceptance checklist

How NTAG424 DNA compares with other anti-counterfeit options

For a product-information URL with no cryptographic verification requirement, NTAG213 NFC labels are the simpler and lower-cost choice. If you are still weighing a tap against a printed code for the same link, the RFID vs QR code guide compares them. Choose NTAG424 DNA when your integrator requires cryptographic verification and can provide the configuration and verification workflow. For closed-loop reader systems rather than consumer taps, compare a DESFire tag instead.

Request an NTAG424 DNA label quotation

Send the label dimensions or available space, mounting surface, quantity, artwork needs, destination and required date. Add the chip variant, requested delivery state and your integrator’s non-secret configuration summary. If any detail is unknown, identify it so it can be resolved before sample preparation. Use the product’s quotation or sample button to keep the NTAG424 label selected; see the sample arrangements and RFID label range for further options.