Mobile NFC security white paper

This new white paper gives an overview of the state-of-the-art of mobile NFC security and analyses the balance between the risks, mitigation and functional requirements of using HCE for mobile payments. A must-read for anyone working in related sectors.

Random Oracle

Useful blog about smart cards, mobile NFC, etc.

OTI COPNI wave - mobile NFC plug-in module

OTI has demonstrated impressive out-of-the box thinking with this NFC plug-in module for mobile devices. Basically, if your phone has an audio stereo jack, you can have mobile NFC.

Now the only questions are: which mobile OSes will OTI support, and will the API be open?

If only a few mobile OSes are supported within the first year (or two), then the API had better be open... A closed API would mean that freelance/community developers won't be able to fill the software gap for this device and some will opt for creating competing - and most likely open-source - solutions. This has already happened with mobile phones. Furthermore, integrated chips containing NFC controller+secure element are becoming readily available, as are NFC software libraries, so the entry threshold to the market is clearly not high.

NFC + Arduino

NFC on Arduino is possibly old news, but the library is still being improved.

MNOs + Banks discuss NFC for 2011

A blip on the "NFC adoption" radar screen: a slew of the biggest mobile network operators and banks will discuss development of the NFC ecosystem

5 Major EU Telcos agree to collaborate on NFC standards

Full story here.

This is good news - looks like someone finally took a lesson from the Japanese DoCoMo strategy.

New developments

The contactless sector has now reached the start of the snowball phase, with several NFC pilot projects being announced weekly, new NFC devices being released (Inside Contactless, Infineon and G&D partnership)  bi-weekly, and new TSM service providers and brokers (Ericsson IPX: TSM) going public once a month.
Huge multinational customers are finally getting in on the action (Coca-Cola, Disney, Barclays, and many more).

If the current trend continues, I predict (based on my impressions, for what they're worth) further linear growth in R&D and market size until end Q2 2011. In the next two years we'll see most of the innovation taking place; market penetration rate should reach its peak at the end of 2012. I look forward to revisiting this prediction :)

SWP-enabled SIM cards

SWP support is slowly becoming more widespread among mobile phone vendors, but there are almost no NFC-enabled SWP UICCs to be found. Gemalto has come up with their own SWP&NFC UICC prototype for a pilot study in Singapore. Note that WatchData (SIMPass) and Bladox (Waver) have been doing similar product development but without the SWP functionality. In fact, WatchData argues that SWP is overrated and unattractive for handset vendors.

I think Bladox will be - for the near future - a better choice than Gemalto from the viewpoint of small startups who are looking to source NFC-enabled SIM cards.

Edit 2011-01-05:
On Track Innovations now also offers an NFC-enabled SIM+antenna. No other information e.g. SWP support.

Nokia NFC SDK

Nokia rolled out their 6131 NFC model around January 2007, aimed mainly at developers. To upload your own MIDlets to the phone you have to ask your dealer to factory unlock the phone, or do it yourself via an Unlock MIDlet (Nokia wiki listed below has a link) which will prevent it from working with trusted MIDlets and applets afterwards. Nokia makes up for this royal pain by offering a decent NFC and MIDlet SDK, and the developer community for their products is quite big and provides good support.

Good places to start reading:

• Official Nokia NFC SDK page
  
• Forum Nokia Documentation and Tools pages
• Forum Nokia wiki FAQ for 6131 NFC
  
• Nokia Secure Chip FAQ
• Nokia MIDlet development tutorial

At the time of this posting the PDF for the Nokia 6131 NFC SDK Programmer's Guide was not available via the official Nokia site, so instead I got it from the Uni. Lüneburg FTP along with the Nokia SDK and other docs. (All the guide PDFs and supporting documentation are included in the SDK.)

Note: Unlocked Nokia 6131 NFC phones all use the same key-set, namely

42/1/DES-ECB/404142434445464748494a4b4c4d4e4f
42/2/DES-ECB/404142434445464748494a4b4c4d4e4f
42/3/DES-ECB/404142434445464748494a4b4c4d4e4f

and security protocol is the GP default: SCP02 option 15 (CMAC+ENC, refer to Nokia 6131 NFC Technical Product Description v1.0 section 7.2, p 26). For JCOP Tools this translates to using ext-auth enc, while in GPShell you would use mode_211 and open_sc -security 3 [...] A detailed discussion with examples can be found on the Nokia Forum. For detailed definitions of SCP02 and its options, refer to Global Platform Card Specification 2.1.1 Appendix E.1.1, p213.