SDM (Secure Dynamic Messaging)

What Is SDM?

SDM (Secure Dynamic Messaging) is a firmware-level feature in NXP's NTAG 413 DNA and NTAG 424 DNA chip families that dynamically injects authenticated data into NDEF messages at the moment of each tap. Unlike traditional static NDEF storage, SDM-enabled tags modify their output on every read, embedding encrypted chip state, UID, counter values, and AES-CMAC authentication codes directly into the URL payload.

How SDM Works Internally

When a reader issues an NDEF read command, the tag's hardware AES engine performs real-time cryptographic operations:

1. Template URL: The tag stores a base URL with placeholder offsets for dynamic data fields.
2. PICC data injection: At the configured offset, the chip inserts its encrypted UID and current NFC read counter using a configured AES key.
3. CMAC computation: The chip calculates an AES-CMAC over the entire NDEF payload using a second AES key and inserts it at the CMAC offset.
4. Counter increment: The internal read counter advances monotonically, ensuring no two taps produce the same output.

SDM Configuration Parameters

Backend Verification Flow

When a user taps an SDM-enabled tag, the phone opens the dynamically generated URL. The backend server parses the PICC data and CMAC, decrypts the PICC data to extract the UID and counter, recomputes the CMAC, and verifies the counter is strictly greater than the last recorded value. If all checks pass, the tag is authenticated as genuine and not replayed.

SDM vs Password Protection

Password protection in NTAG 21x uses a static 32-bit password transmitted in plaintext. SDM provides cryptographically stronger security: 128-bit AES keys, encrypted data, per-tap uniqueness, and counter-based replay prevention.

Practical Considerations

• Key provisioning: Each tag must be individually provisioned with unique or diversified AES keys during manufacturing.
• Server infrastructure: SDM requires a verification backend capable of AES decryption and CMAC validation.
• URL length: Dynamic fields add approximately 50-80 characters. Ensure the tag has sufficient user memory.

SDM is the foundation of NXP's SUN (Secure Unique NFC) authentication ecosystem and the current state of the art in NFC tag security.