The NTAG413 DNA is a secure NFC chip designed by NXP Semiconductors, the first generation of the NTAG DNA range. Compliant with the ISO/IEC 14443-4 standard and the NFC Forum Type 4 format, it embeds AES-128 cryptography and the SUN feature, which generates a unique authentication code at each read. It can be read and written by virtually all NFC-enabled smartphones.
Information
| Manufacturer | NXP Semiconductors |
| Family | NTAG DNA |
| Standard | ISO/IEC 14443 Type A (parts 1 to 4) |
| NFC Forum type | Type 4 Tag (NFC Forum certified) |
| Protocol | APDU as per ISO/IEC 7816-4 |
| Operating frequency | 13.56 MHz |
| Data rate | Up to 424 kbit/s |
| Unique identifier (UID) | 7 bytes, factory programmed |
| Operating distance | Up to approximately 10 cm, depending on the antenna and reader |
| Data retention | 50 years |
| Write endurance | Minimum 200,000 cycles |
| Encryption | AES-128 (3 application keys) |
| User memory | 160 bytes |
| NDEF file | 128 bytes |
Memory
Unlike the NTAG21x chips organized in pages, the memory of the NTAG413 DNA follows a file structure compliant with the ISO/IEC 7816-4 standard:
| File | Size | Content | Default access |
|---|---|---|---|
| CC file (no. 01) | 32 bytes | Capability Container (NFC Forum Type 4) | Free read |
| NDEF file (no. 02) | 128 bytes | NDEF message, SUN mirrors (UID, counter, CMAC) | Free read, key-configurable write |
In practice, the 128-byte NDEF file holds a URL of around 115 characters. When SUN authentication is enabled, the mirrors (UID, counter and CMAC code) take up part of this space (around forty characters) which shortens the base URL accordingly. The link then points to a server in charge of verifying the cryptographic validity of each read.
Features & security
- SUN authentication: at each read, the chip inserts into the URL a dynamic authentication code (AES CMAC) derived from the UID and the counter, verifiable server-side: the content can be neither cloned nor replayed.
- AES-128 keys: three 128-bit application keys, with version management, control the writing of the NDEF file and the calculation of the authentication codes.
- NFC counter: a 3-byte counter is incremented once per session when the NDEF file is read; it can be inserted into the URL via the mirror or read securely.
- Mutual authentication: a three-pass challenge-response protocol authenticates both the chip and the reader holding the keys.
- Secured communication: depending on the configuration, exchanges are carried out in plain text, protected by CMAC or fully encrypted.
- Originality signature: an ECDSA signature programmed at the factory verifies that the chip genuinely comes from NXP.
The NTAG413 DNA has been replaced in NXP's catalog by the NTAG424 DNA, which takes the same principle further with more memory, five keys and additional protections: for a new project, the NTAG424 DNA is the recommended choice.
Compatibility
The NTAG413 DNA is compatible with virtually all NFC smartphones. On Android, reading and writing work natively with NFC Tools, without any particular restriction. On iPhone, automatic background reading is available from the iPhone XS and XR onwards; models from the iPhone 7 can read and write the chip via NFC Tools on iOS 15.6 or later, by starting the scan manually from the app.
With NFC Tools, the NTAG413 DNA chip supports reading technical information, writing NDEF records and erasing. Configuring the cryptographic functions (AES keys, enabling SUN authentication), however, is a specialized encoding process, usually carried out with a dedicated reader and a server-side infrastructure. The list of compatible models is available in the article on compatibility.
NTAG413 DNA vs NTAG424 DNA
| Chip | User memory | NDEF file | AES keys |
|---|---|---|---|
| NTAG413 DNA | 160 bytes | 128 bytes | 3 |
| NTAG424 DNA | 416 bytes | 256 bytes | 5 |
Both chips share the SUN principle and AES-128 cryptography. The NTAG424 DNA adds a 128-byte protected proprietary file, two additional keys, the Random ID option and Common Criteria EAL4 certification: it is today the reference of the range.
Frequently asked questions
How much data can be stored on an NTAG413 DNA?
The NDEF file offers 128 bytes, which corresponds to a URL of around 115 characters, part of which is taken up by the authentication mirrors when SUN is enabled. With the 32-byte CC file, the total user memory reaches 160 bytes.
What is SUN authentication?
SUN (Secure Unique NFC message) generates a unique cryptographic code at each read, inserted into the URL. The server receiving this link verifies that the read comes from the original chip and has not been replayed, making any copy of the content ineffective.
Is the NTAG413 DNA compatible with iPhones?
Yes. Background reading works from the iPhone XS and XR onwards, and both reading and writing NDEF are possible via NFC Tools from the iPhone 7 on iOS 15.6 or later. SUN verification takes place server-side, when the link is opened.
Can an NTAG413 DNA be protected against rewriting?
Yes. The access rights of the NDEF file are configurable by AES key, up to prohibiting any unauthenticated write. The chip does not use the simple password mechanism of the NTAG21x: protection relies entirely on the AES-128 keys.
Useful links
