NFC Encoding, Serialization and Provisioning Explained

Encoding is writing operational data to the chip’s memory. For product authentication, that data is structured as an NDEF (NFC Data Exchange Format) message, the standard payload format that every NFC-enabled smartphone reads natively. No app required: iPhone XS/XR and later read NDEF tags in the background, Android reads them with the screen on.

The NDEF message for an authentication chip typically contains a URL pointing to the brand’s verification platform. But the chip does more than store a static link. On NTAG 424 DNA chips (ISO/IEC 14443-A, NFC Forum Type 4, AES-128), the SUN (Secure Unique NFC) messaging protocol appends dynamic parameters to that URL on every tap: the chip’s unique hardware identifier (UID), a rolling tap counter, and a cryptographic authentication code computed from the chip’s secret key. These values change with each interaction. The URL structure written during encoding defines exactly where in the URL those dynamic fields appear.

Encoding also configures the chip’s memory access rules: which memory pages are freely readable by any NFC device, which require authenticated access, and whether the key storage area will be permanently locked after provisioning.

The critical distinction: encoding does not just write a link to the chip. It configures the chip’s behaviour, its authentication logic, its access controls, and the structure of every response it will ever produce.

Serialization assigns a unique identifier to each chip and binds it to a specific product record in the platform database. A chip without serialization is authenticated but anonymous. It can prove it is genuine, but it cannot tell you which product it belongs to.

The identifier structure matters. The two dominant standards for product-level serialization are GS1 SGTINs (Serialised Global Trade Item Numbers) and GS1 Digital Link URLs. Both encode the product’s GTIN plus a unique serial number in a format any standards-compliant system can parse without proprietary software. GS1 Digital Link is increasingly preferred because it doubles as a functional web URL, directly supporting the EU Digital Product Passport (DPP) data carrier requirements under ESPR (Regulation (EU) 2024/1781).

The serialization record created at commissioning includes, at minimum:

• Chip hardware UID
• Assigned product serial number
• Product SKU or GTIN
• Batch or lot number
• Production date and timestamp
• Production facility identifier

This record is the seed of the product’s digital identity. Every subsequent event, authentication taps, ownership transfers, warranty claims, secondary market transactions, connects back to this record. If the serialization is wrong, the entire downstream chain is wrong.

Key provisioning writes the secret cryptographic key into the chip’s hardware-protected memory. Of the three commissioning processes, this one carries the highest security sensitivity.

The key is what makes an NTAG 424 DNA chip’s authentication response unforgeable. Without the correct key, no device can produce valid SUN authentication codes. With a compromised key, an attacker can clone the chip’s authentication behaviour onto another chip. The security of the entire deployment reduces to the security of key provisioning.

The non-negotiable rule: a cryptographic key must never be transmitted in cleartext, stored in software-accessible memory, or handled by any system outside a hardware security boundary. A key provisioned through a software API over an unencrypted connection is, for practical purposes, a compromised key.

Key provisioning must occur inside dedicated encoding hardware equipped with a hardware security module (HSM). The HSM generates, stores, and injects keys without exposing them to the surrounding software environment, the network, or any operator. The ILM Station used in Selinko deployments implements this architecture: the key exists only inside the HSM and inside the chip. Nowhere else.

The six steps below represent the standard commissioning flow for cryptographic NFC authentication tags. The sequence is not arbitrary: each step depends on the one before it.

1. Chip arrives blank. Raw chips from the manufacturer contain only the factory-set UID and default configuration. No NDEF message, no key, no product association.

1. Key injection. The HSM inside the encoding station writes the secret key into the chip’s hardware-protected memory. The key never leaves the secure boundary of the encoding hardware.

1. NDEF configuration. The encoding station writes the NDEF message: URL structure, SUN/SDM parameter positions, and memory access rules. The chip is now configured to produce dynamic, authenticated responses on every tap.

1. Serialization and record creation. The station reads the chip’s UID and associates it with the assigned product serial number. A full product record is created in the platform database.

1. Verification. The encoding station performs a complete read-back: it triggers an authentication response from the chip and verifies the response against the expected value given the chip’s UID and the newly written key. Only chips that pass verification proceed.

1. Memory lock. For chips where the key area supports permanent locking, the station locks the key memory. This is irreversible. The key can no longer be read, changed, or overwritten. The chip enters its final authentication-ready state.

Steps 2 and 3 are sometimes combined in a single write operation, but conceptually they remain distinct: one is a security operation, the other is a data operation.

The relationship between encoding and product integration defines the commissioning architecture. Three models exist, each with different risk profiles.

The trade-off that matters: on-line commissioning eliminates the mismatch window entirely by associating chip and product at the moment of physical integration. Off-line commissioning introduces a gap between encoding and integration where errors can enter. Pre-provisioned chips reduce on-site security requirements but extend the key custody chain.

For programmes above 100,000 units annually, on-line commissioning with diversity keying (a unique derived key per chip, generated from a master key that never leaves the HSM) significantly reduces the blast radius of any single chip compromise. Below that scale, a well-managed shared key with strong physical security at the encoding station is typically adequate.

Most authentication failures that surface in the field trace back to commissioning errors, not chip defects. Four failure modes account for the majority.

Chip-product mismatch. A chip encoded for product A is physically integrated into product B. The consumer taps and sees authentication data for a different product. This happens when commissioning and integration are separated in time or process. On-line commissioning eliminates this failure mode entirely.

Key management errors. A key is provisioned incorrectly, or the platform expects a different key than the chip holds. Authentication fails for every affected chip. Prevention requires HSM-level audit logging of every key operation.

NDEF configuration errors. The URL structure written to the chip does not match what the platform expects: wrong domain, incorrect SUN parameter positions, missing authentication fields. The chip taps correctly but delivers a URL the platform cannot parse. The verification step catches this, but only if verification tests the full authentication flow, not just a raw NDEF read-back.

Memory lock omission. The key memory is left in a rewritable state after provisioning. An attacker with physical access and appropriate hardware could in principle overwrite the key. Standard commissioning procedures include locking as a mandatory final step, with audit logs confirming completion for each chip.

Different verticals impose different constraints on the commissioning process.

Wine and spirits. Chips are typically integrated into closures or capsules. The TagTamper variant of NTAG 424 DNA detects first opening, so the commissioning sequence must also configure the tamper detection loop. Liquid contents can affect NFC read range, requiring antenna tuning validation as part of the verification step.

Luxury goods and leather. Chips embedded in leather, fabric, or metal housings. Metal detuning is the primary physical challenge: on-metal tags with a ferrite layer solve it, but the commissioning station must verify read performance in the actual mounting configuration, not on a test bench in free air. Standard tags detune on metal surfaces and will produce inconsistent reads or complete failures.

Cosmetics and fragrance. High-volume lines with short cycle times. Commissioning throughput becomes a constraint. The encoding station must match the line speed, which typically means sub-second encoding cycles and parallel verification.

Watches. Metal cases require on-metal tag variants. The chip is often integrated into the case back or strap, with commissioning happening at a dedicated station separate from the main assembly line. Serialization records typically include movement serial numbers in addition to product identifiers.

The chip itself is only one component of commissioning cost. Published converter prices for NTAG 424 DNA-class labels cluster around $0.45 to $0.65 per unit at five-figure volumes, with on-metal variants adding 7 to 30 percent (public catalogues, 2026). At volumes above 50,000 units, pricing is quote-only.

The encoding hardware, HSM infrastructure, line integration, and platform licensing represent the larger investment. For brands evaluating NFC authentication, the per-unit chip cost is rarely the decisive factor. The commissioning architecture, how and where chips are encoded, is what drives total deployment cost.

By comparison, standard non-secure NFC tags (NTAG213-class) list around €0.19 to €0.23 at 1,000 to 10,000 units (public catalogues, 2026), but these chips lack the cryptographic capability required for authentication. A printed QR code adds near-zero marginal print cost, but the real cost is serialization and the platform behind it (industry sources, 2026).