Program and encode NFC seals

When you leave this page, you will know how to prepare a batch of NFC seals, program a chip end to end, check what was written into it, and decide what to do with a chip that does not answer. Programming is run from the console, on a workstation fitted with a contactless reader, one chip at a time.

The word programming here means writing into the chip. Nothing is marked on the product itself.

#What gets written into a chip

A blank chip holds nothing useful out of the box. Programming places five things in it, in this order.

1. The keys. They replace the factory keys. They close the settings of the chip and the computation of its read proof.
2. The URL. That is what the chip presents to the phone that reads it. The workstation writes it into the area readable by a phone.
3. The seal, on a sealed batch only. The chip starts reporting any opening. Switching it on is permanent.
4. The dynamic read setting. Secure dynamic reading, called SDM in the console, makes the chip recompute a new proof at each read and add it to the URL it presents. The server checks that proof at each read. The protection against copying the content of a chip comes from that computation.
5. The chip certificate. A block signed by the key of your brand, written into the memory of the chip.

The console marks an item as programmed only if the read setting and the certificate have both succeeded. If the certificate could not be written, the item is not marked as programmed and stays selected on screen. Run the operation again on the same chip, without leaving the page.

#The hardware

• A PC/SC contactless reader, plugged into the programming workstation. The tool detects the readers present and offers them to you in a list. The ACS ACR1252U model is supported by name.
• NTAG 424 DNA chips. The diagnostic screen tells you, chip by chip, whether the chip placed on the reader really is one.
• For a sealed batch, NTAG 424 DNA TT chips with an intact loop. The tool reads the hardware subtype of the chip before acting and refuses any chip that is not a TT.
• The programming workstation, with the SealTrust programming tool running. The console talks to that tool on the local machine. The tool must therefore run on the workstation where the console is open.
• A console account whose plan includes NFC encoding. Without that line in the plan, the entries of the Tools menu stay grayed out.

#Prepare the batch

Everything starts from a product model. Open the model, then Mint batch.

The Sealed batch (tamper tags) checkbox states its own reach on its own: "Switches the seal on for every tag of this run. Permanent on the chip, it cannot be undone. Tags must be NTAG 424 DNA TT with an intact tab."

A batch in QR alone does not go through programming. QR is an identification mode in its own right, and its codes are generated from the page of the batch. A batch in NFC + QR goes through programming, like a batch in NFC.

On validation, the console creates the items awaiting programming, places the batch in the encoding queue, and takes you to the encoder with that batch already selected.

#Connect the reader

Go to Tools, then Reader connection.

1. Choose the reader in the list, or leave Auto (first reader).
2. Click Connect to daemon. The daemon is the programming service installed on the workstation.

The screen also offers a drop-down list of brands. That choice stays on the screen and changes nothing in the programming.

When the link is established, the console displays "Connected to NFC daemon. You can now use any NFC page."

#Program a chip, step by step

Open Tools, then NFC Encoder. The screen works on one batch at a time and gives you three buttons in the order of use.

#1. Take an item

Click Take 1 item (ready). The console displays the first item of the batch still awaiting programming, in the Selected item card. The counters at the top follow the progress of the batch: to encode, encoded, failures.

#2. Load the keys into the chip

Click Provision Keys. That button only concerns new chips. The console asks for confirmation and restates what is about to happen: the chip must be new, it receives new keys, the operation is irreversible without those keys, and no data is written into the area readable by a phone.

Place the chip on the reader and leave it there. The tool waits for the answer for up to 60 seconds.

Two normal outcomes:

• Keys written. The console indicates which keys changed.
• Step skipped. The chip already carried the keys asked for. The console says so and invites you to move to the next step.

Only use genuine NTAG 424 DNA chips. A chip whose origin you do not know must not go out to a customer.

#3. Configure dynamic reading and mint the product

Click Configure SDM + Mint (+ URL). That button chains six operations on the same chip, without taking it off the reader.

1. Reading the UID. The console reads the unique identifier of the chip. It waits for the chip for up to 75 seconds.
2. Minting the product. The console mints the item on the blockchain and attaches it to that UID. The server includes in its answer the URL to write into the chip.
3. Writing the URL. The workstation writes the URL into the area readable by a phone.
4. Switching the seal on, on a sealed batch only. It comes before the activation of the read setting, because the read setting is replayed and switching the seal on is not.
5. Activating the dynamic read setting. The chip becomes active at the next read.
6. Writing the chip certificate. The console asks the server for the certificate, then the workstation writes it into the chip. The console displays the number of bytes written. A failure at that step leaves the item not marked as programmed.

The console then marks the item as programmed, updates the counters, and automatically takes the next item of the batch.

#Program a batch in series with the wizard

The page of a batch offers a wizard in four steps: scan the UIDs of the blank chips one by one, confirm the pairing between each item and each UID, mint the whole batch, then program the chips one by one with the encoder. The order of the scan serves as the default pairing, and you can correct it item by item before minting.

The wizard is available on any batch that carries a chip and that has an open encoding job. The console recommends it beyond about twenty items.

#Check after programming

Four checks, from the quickest to the most complete.

Read the chip on the bench. In the encoder, open Diagnostic then Read Tag. The console displays the UID, whether the chip really is an NTAG 424, and the state of dynamic reading: Configured or New tag. A programmed chip must announce Configured.

Look at the counters of the batch. The encoder permanently displays the number of items to encode, encoded and failed. The Export CSV button downloads the result of the batch. The log at the bottom of the page keeps the last 200 lines.

Bring a phone close. The URL written into the chip opens the verification page. At each read, the chip adds a counter that increases and a recomputed proof. The server refuses a read whose counter has already been seen, which makes the replay of a recorded read fail.

Open the product record. The NFC section of the record shows the hash of the UID, the date of the last read, the state of the chip and the total number of reads. A record whose last read is empty has never been read by a phone.

On a sealed batch, the tool reads the state of the seal before and after switching it on. It requires a seal still asleep before, and a closed seal after. Any other answer stops the operation, and you set the unit aside.

#When a chip does not answer

The Selected item card carries the recovery actions.

• Retry puts the item back to awaiting programming, then the console displays the next item awaiting.
• Next moves to the next item without programming anything.
• Mark failed forces the failed state, in every circumstance.
• Mark written is only accepted on an item already minted and being programmed. On an item merely taken from the queue, the click has no effect and no message.

Do not leave the page between the minting of an item and the end of its programming. An item left in that intermediate state no longer counts among the items to encode, and Take 1 item (ready) no longer returns it.

#Recover a chip already programmed

The Tools screen, then Wipe tag, offers four operations that you tick separately. They run in a fixed order, and a failure on one does not interrupt the others.

1. Database cleanup. Detaches the chip from its product record and submits the destruction of the matching token on the blockchain. The console asks you to retype the identifier it displays, serial number or token identifier, then a two-factor authentication code. If the chip matches no record, nothing is destroyed and the console says so.
2. Erase the URL. The chip no longer opens the verification page when a phone reads it.
3. Erase the chip certificate. The chip no longer carries the block signed by the key of your brand.
4. Factory reset. Puts the keys and the access rights of the chip back to their factory values. The console requires you to type RESET to confirm.

#What is left to do after programming

Your programmed items are minted, attached to their chip and readable by a phone. The digital passport, the access rules and putting them on sale are then handled from the catalog, on the record of the batch and on that of each item.

#To go further

• Digital Product Passport: what the passport carries, and how to fill it in for the items you have just programmed.
• Physical identification: what the QR code and the chip each bring, and how to choose between the two.
• Create products: creation one at a time and in batches from the console, upstream of programming.