Can I emulate a tag using the PN532 without a secure IC?

Question

I'm trying to emulate a tag on the PN532. I need this to interface with a device that only support tags in its API, but no LLCP or other P2P protocol.

I want to handle the read/writes using the host controller. Any emulated tag type would be OK (Mifare, Felica, etc.) but my solution does not include a secure element.

I think Mifare Ultralight would be ideal. As it does not include any encryption (just plain read and writes) it may be possible to emulate easily than any other?

In short, is it possible to emulate a tag that can reply to read/write commands from an initiator/reader without using a secure IC on the PN532?

Answer 1

A secure IC will not help you very much in emulating tags, because they usually work at ISO14443 level 4, where tags only process 14443-3 commands. The only exception is mifare which is supported on some secure elements, but some secret keys will be needed to program them.

Generally speaking most NFC chips support tag emulation but do not expose this with APIs. It might be worth digging through the libnfc-nxp or libnfc-nci source code to see if they can be used to do this.

Answer 2

Yes, the PN532 supports both, card emulation with a secure element and host card emulation.

The commands (see the PN532 user manual ) that you are looking for are TgInitAsTarget (to bring the PN532 into host card emulation mode) and TgGetData / TgSetData to then exchange data with the reader (see this answer on how to bring the PN532 into HCE mode).

If you want to read and write NDEF messages using this approach, you could either emulate an NFC Forum Type 4 tag (ISO/IEC 14443-4 Type A) or an NFC Forum Type 3 tag (FeliCa). In either case, you would need to implement the Tag Operation specification for that specific tag type.