Retrofitting cheap and low storage NTAG203/213 with Elliptic Curve Digital Signature Algorithm (ECDSA)!
- Generate an ECC private key and a self-signed ECC public certificate
Read: How to generate ECC keys/certificates
- Run EcdsaSigner.java in KeyGenerator Project to sign an URL with your ECC private key
- [OPTIONAL] Run EcdsaVerifier.java in KeyGenerator Project to verify the signed URL with your ECC public certificate
- Write the signed URL to a NFC tag
- Update AndroidManifest.xml to include new signed domain
- Rename your ECC public certificate to your fully qualified domain name i.e. isteps.comp.nus.edu.sg
- Copy the renamed ECC public certificate the asserts/certs folder
AndroidApp/app/src/main/assets/certs/
- Deploy the Android application to a Android phone with NFC
- Test it out and have fun!
First, pick a named curve that fits your security requirements and NFC storage space.
openssl ecparam -list_curves
The following command assumes that prime256v1 is chosen.
openssl ecparam -genkey -name prime256v1 -noout -out tmp.pem
Discard this later as we need a PKCS#8 padded private key Read: Known Issues
openssl pkcs8 -topk8 -nocrypt -in tmp.pem -out key.pem
Keep this as the ECC private key
openssl req -new -sha256 -key key.pem -out csr.csr
Create a certificate signing request (CSR)
openssl req -x509 -sha256 -days 365 -key key.pem -in csr.csr -out certificate.pem
Keep this as the ECC public certifcate
The following commands can be used to print the content of key and certifcate.
openssl x509 -in certificate.pem -text -noout
openssl x509 -in key.pem -text -noout
EcdsaSigner.java uses BouncyCastle crypto library for ECDSA.
In line 42, it uses a PKCS8EncodedKeySpec wrap a PemObject instance.
As for now, the conversion to PKCS#8 is needed as I have not figured out another way to inflate ECC private key yet.
In our school project, we assume that the companies can create their own signer (and not bound to any programming languages) as ECDSA is an open and well-defined. The only thing we have to agree on is which secure hash to use and we are using SHA384.
Link to line 42 of EcdsaSigner.java
Link to StackOverflow solution: https://stackoverflow.com/questions/22963581/reading-elliptic-curve-private-key-from-file-with-bouncycastle#comment71074675_23369629
Ralf Wondratschek for his awesome guide on Android NFC Programming
Link https://code.tutsplus.com/tutorials/reading-nfc-tags-with-android--mobile-17278