EdgeNFC
Sign in Start free

Android provisioning — Option C#

Provisioning is where a blank tag becomes a verifiable one. The free EdgeNFC Android app takes your System Master Key, derives a unique per-tag key, installs it on the tag, and writes a SUN URL so every future tap carries a fresh cryptographic MAC. This guide is the same regardless of whether you verify through the hosted gateway or your own DIY edge — both accept the registry the app exports.

Prerequisites#

  • An NFC-capable Android phone with the free EdgeNFC app installed.
  • Your System Master Key (32 hex) and System ID — from Step 2 of the Hosted guide, or from your DIY System.
  • Blank NTAG 424 DNA tags. (NTAG 215 is supported as a fallback — see below.)

Warning

Provisioning writes cryptographic keys to hardware and needs your System Master Key in the app. Use a test key such as 00112233445566778899aabbccddeeff while you learn the flow; treat a real master key like a password. The app keeps the key in memory only (Android Keystore wrapping is on the roadmap) and never persists it in plaintext.

Step 1 — Configure the app#

Open EdgeNFC and enter:

  • System Master Key — the 32-hex key for this System.
  • System ID — e.g. sys_01H…, so exported tags map to the right System.
  • Host — edgenfc.com for hosted, or your own verifier host for DIY.

Step 2 — Arm and tap a blank tag#

Tap Arm, then hold a blank NTAG 424 DNA flat against the phone's NFC antenna until the app reports success. Under the hood the app runs the confirmed provisioning sequence:

  1. AuthenticateEV2First with the factory default Key 0 to open a secure session.
  2. AN10922 AES-128 key diversification — derive this tag's unique SDMFileReadKey from your master key and the tag's UID. (AN10922 is a fixed two-block construction, not generic CMAC.)
  3. ChangeKey — install the diversified key on the tag (the cross-key cryptogram carries (NewKey XOR OldKey) || KeyVersion || CRC32(NewKey)).
  4. ChangeFileSettings — enable SDM/SUN mirroring for UID, read counter, and MAC.
  5. Write the SUN URL template — an NDEF record whose placeholders the tag fills in on each tap (…/verify?sys=…&uid=…&ctr=…&mac=…).

Each per-tag key is unique, so a compromised tag never exposes your master key or any other tag.

Step 3 — Self-verify read-back#

Before marking a tag done, the app closes and reopens the session, reads the SUN mirror back, and decodes it with the same Rust core the verifiers use. A pass shows SELF-VERIFY ✓. You can re-check any tag later with Verify tag.

Note

On Android 16+ the OS cannot NDEF-dispatch NTAG 424 DNA (a platform regression), so the app reads and verifies tags itself through its Verify tag path rather than relying on the system tap handler. This is expected and does not affect provisioning or verification on any other reader.

Provision as many tags as you need; batch mode keeps a running session so you can tap tag after tag. The ChangeKey step and end-to-end MAC verification are confirmed on physical NTAG 424 DNA hardware — this is not a simulation.

Step 4 — Export the registry#

When the batch is done, tap Export registry. The app writes a JSON file listing each tag's UID, key version, and SDM configuration. No key bytes are ever exported — only the metadata a verifier needs to recognise the tag.

Verify it worked#

Import the exported registry into your System so the verifier accepts these tags:

curl -X POST https://edgenfc.com/api/tags/import \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d @registry.json
{ "imported": 12 }

Import is idempotent by UID, so re-running the same export is safe. Now tap a provisioned tag with any phone: a genuine tag resolves to authentic: true, while a clone or a hand-edited URL resolves to authentic: false. You have gone from a blank tag to one the gateway (or your DIY edge) trusts.

NTAG 215 fallback#

Where NTAG 424 DNA is not available, the app can write a static NDEF URL to an NTAG 215. This is a compatibility fallback: a 215 has no SDM engine, so it carries no rolling counter or per-tap MAC and cannot offer clone/replay protection. Use NTAG 424 DNA wherever authenticity matters.

Re-provisioning#

A tag that already holds a diversified key is re-keyed with the current key (the Key 0 policy), not the factory default — so you need the master key to re-provision. Rotating a System (POST /api/keys/{id}/rotate) issues a new key version and requires re-provisioning affected tags. On Hosted, rotation opens a 90-day migration window in which the previous version is still accepted, so the re-write is a scheduled pass rather than an outage — but it is a deadline, and re-provisioning a tag closes that tag's old-key window the moment the registry records the new version. Track what is outstanding with GET /api/keys/{id}/stale-tags, or the dashboard's Stale tags button.

Next steps#