ISO/IEC 13157-1:2014

Overview

ISO/IEC 13157-1:2014 specifies the NFC-SEC protocol services and Protocol Data Units (PDUs) used to secure NFCIP-1 communications. It defines two primary services - the Shared Secret Service (SSE) and the Secure Channel Service (SCH) - and the protocol mechanisms (PDUs and state machine) that peer NFC-SEC entities use to establish shared secrets, confirm keys, protect PDUs, and terminate secure sessions. This part is complemented by the NFC-SEC cryptography part (ISO/IEC 13157-2) that defines the underlying algorithms (e.g., ECDH/AES as used in the series).

Key topics and technical requirements

• Services defined
  • Shared Secret Service (SSE): Establishes a cryptographic shared secret between two NFC-SEC users for later use.
  • Secure Channel Service (SCH): Derives a link key from a shared secret and protects bi-directional communication across the channel.
• Protocol mechanisms
  • Key agreement: Performed using ACT_REQ / ACT_RES PDUs according to the selected Protocol Identifier (PID).
  • Key confirmation: Performed using VFY_REQ / VFY_RES PDUs to verify the agreed shared secret.
  • PDU security (SCH only): Uses ENC PDUs to provide sequence integrity, confidentiality, data integrity, and origin authentication as defined by the chosen NFC-SEC cryptography standard.
  • Termination: TMN PDUs to close SSE and SCH sessions.
• PDUs and protocol control
  • Specification of NFC-SEC-PDUs (SEP, PID, NFC-SEC payload, ERROR) and Protocol Control Information (PCI).
  • Protocol rules cover error handling, interworking, sequence integrity, and cryptographic processing.
• Conformance and scope
  • Implementations may support one or more services and must use the cryptographic mechanisms referenced by the PID.
  • Does not define application-level security for smart-card-specific use cases (ISO/IEC 7816 series remains applicable there).

Practical applications and target users

• Who uses this standard:
  • NFC device and chipset manufacturers, smartphone OEMs, secure element vendors
  • Payment, transit, and access-control solution providers implementing NFC-based secure channels
  • Security architects, protocol engineers, and integrators designing NFC communication stacks
  • Test labs and certification bodies validating NFC-SEC compliance
• Practical value:
  • Enables interoperable secure NFC connections over NFCIP-1
  • Standardizes PDU formats and lifecycle (establish, confirm, protect, terminate)
  • Facilitates reuse of cryptographic profiles (via PID) for consistent security across devices

Related standards

• ISO/IEC 13157-2 - NFC-SEC cryptography (ECDH and AES profiles)
• ISO/IEC 18092 - NFCIP-1 (NFC Interface and Protocol)
• ISO/IEC 7498-1 / ISO 7498-2 and ISO/IEC 11770-1 - OSI and key management references

Keywords: NFC security, NFC-SEC, NFCIP-1, secure channel, shared secret, PDU, key agreement, key confirmation, ENC PDU, NFC protocol.