We built our authentication to be understood, not taken on faith alone. We explain how it works in plain language, and we do not dumb it down or ask you to trust our credentials. The cryptography underneath is established and battle-tested. Not all NFC tags can do this. An ordinary tag holds data anyone can copy. Ours prove themselves. Every tag we ship is an NTAG 424 DNA, an NFC Forum Type 4 tag produced exclusively by NXP, with a secure enclave embedded in the chip so it can be authenticated remotely, as many times as it is tapped.
Most NFC tags act as just data storage with no security. They can pop up saved NDEF data and link you to a site or give you access to a door. Some door tags and fobs store only a fixed ID. That ID can be copied to any number of compatible tags. Counterfeits can be hard to tell apart from genuine products and are often made in the same factories or nearby ones. On each read, our chip increments its counter and derives a session key from its secret key and counter to generate an AES-CMAC authentication code. Our service checks the code and rejects previously validated counters; valid future codes require the tag's secret key. NFC Proof checks NXP's static signature over the chip's UID on your device, but that signature can be replayed. These checks authenticate the tag, not the attached item.
Every tag we use is verified using NXP's factory-programmed ECC signatures before being minted. We trust our official NXP suppliers, but we verify each tag ourselves in our mint process. There is no trust without a default level of distrust.
Where the Boundary Is
A genuine tag proves the tag is genuine. It does not prove that the tag is still attached to the item it was applied to, and it does not inspect the item. A tag is also a bearer instrument, so whoever holds it can tap it. We build the seals, the counters, and the records to make misuse visible, and we tell you plainly where the boundary is.