SUN (Secure Unique NFC)

What Is a SUN Message?

SUN (Secure Unique NFC) is an authentication technology developed by NXP Semiconductors that generates a cryptographically unique URL every time an NFC tag is tapped. Unlike static NDEF payloads, a SUN-enabled tag produces a different message each time, making replay attacks mathematically impossible. SUN is implemented on NTAG 223 DNA, NTAG 224 DNA, and NTAG 424 DNA chip families.

How SUN Works

SUN leverages the chip's hardware AES-128 cryptographic engine combined with an internal read counter:

1. Counter increment: The tag's internal NFC counter increments by one. This counter is monotonic and cannot be reset.
2. CMAC generation: The chip computes an AES-CMAC over the current counter value, UID, and optionally additional data using a secret key stored in protected memory.
3. URL assembly: The CMAC and counter are encoded into the NDEF URI payload as query parameters (e.g., https://verify.example.com/tag?uid=04A1...&ctr=000042&cmac=A7F3...).
4. Backend verification: The server retrieves the tag's secret key, computes the expected CMAC for the received counter value, and compares it.

Because the counter increases with every tap and the CMAC depends on a secret key that never leaves the chip, an attacker cannot predict future valid URLs.

SUN vs Static Authentication

Relationship to SDM

SUN and SDM (Secure Dynamic Messaging) are closely related. SDM is the underlying chip firmware mechanism enabling dynamic content injection into NDEF messages. SUN is the application-layer term for the authentication use case built on top of SDM. Configuring a tag for SUN involves setting SDM parameters: PICC data offset, CMAC offset, and cryptographic key slot.

Use Cases

• Brand protection: Luxury goods and pharmaceuticals use SUN for per-tap verification that a product is genuine.
• Warranty validation: Each tap creates a unique event, building an immutable interaction history.
• Event ticketing: SUN-enabled wristbands generate a unique token per gate entry, preventing ticket sharing.
• Supply chain tracking: Counter values reveal how many times a tag was read, detecting unauthorized handling.