Case study · Logistics & distribution
A sealed carton changes hands three times before its customer opens it. Each time, someone takes it on trust.
Proving a carton was never opened
A proof of concept for a distributor of high-value goods: a tamper-evident NFC seal any phone can read, and a backend that won't take the tap on trust.
Chapter 01 / The ask
Three handoffs. Zero proof.
At the warehouse, with the carrier and at delivery, nobody could quickly tell whether a carton had been opened, its contents swapped or a counterfeit put in its place. The customer had no way to check either.
The distributor asked for proof that each unit reached its customer unopened and genuine.
Five constraints, set before choosing any hardware
- No dedicated readers Staff and customers use their own phones
- No power The seal runs only during a tap
- Permanent record Once an opening is recorded, it can't be cleared
- No fakes, no replays Every tap is authenticated and accepted once
- One seal, one unit Bound to a single unit and shipment
Chapter 02 / The chip
The cheaper chip would have tested the wrong system.
NXP makes two NFC chips with a tamper loop built in. As sensors they're alike: both notice a broken loop and keep the record permanently. The difference is whether anyone can fake the report.
https://verify.example.com/s?uid=04A23F6A2B5E80&ctr=00003E&tt=OO CC
Anyone who reads a genuine seal can copy or type the address and change “opened” back to “closed”. The backend can't tell.
https://ntag.nxp.com/424?e=EF963FF7828658A599F3041510671E88&c=94EED9EE65337086
The reading is encrypted and signed with a key inside the chip. Change one character and the signature check fails.
A cheaper pilot couldn't test whether fakes are rejected, and the backend would change with the move. It would have proved a different system. We built on the 424 DNA TT from the start.
Chapter 03 / Threats first
The loop breaks. The antenna doesn't.
A seal is a security device, so we wrote the threat model before anything else and gave each threat to the layer that answers it: the seal, the chip or the backend.
One choice mattered more than it looks. The loop runs across the flap seam as a narrow tail, so opening the carton breaks the loop and leaves the antenna whole. A seal that goes silent when opened can't be told apart from a damaged seal or a missed read. A seal that keeps answering can say what happened.
A destructible face that tears on removal
Loop across the seam, latched permanently in the chip
Status kept inside the encrypted, signed data
A key unique to each chip
A read counter that must always rise
Seal bound to one unit and shipment at packing
Chapter 04 / What we built
A backend that questions every tap.
Each tap gives the phone a fresh web address with an encrypted reading and a signature. The backend runs six checks in a fixed order. The order matters: the tamper status means nothing until the signature proves the reading came from our chip.
- Decrypt identity and counterWhich chip, and how many times it has been readShared key
- Find the sealLook it up in the registry by its serial numberRegistry
- Verify the signatureRecompute it with that chip's own keyPer-chip key
- Reject old readingsThe counter must beat the last one acceptedAtomic
- Read the tamper statusClosed, opened, or opened and repairedCC / OO / OC
- Check the bindingThe seal belongs to a unit in this shipmentShipment
- All pass → verdictAny fail → Not verified
Keys
Every chip leaves the factory with five keys set to zeros. Handy for testing, alarming for anything else.
- Each chip gets its own key, derived from a master key and its serial number
- A key pulled from one seal is useless against the next
- The master key sits in a cloud key management service; phones hold no keys
The counter
A copied address stays genuine, so the counter is what stops it being used twice. Checking and storing it is one step, so two copies sent together can't both pass.
Last accepted 61, next arrives as 64: accepted, and flagged. The seal was read twice somewhere else.
Chapter 05 / Verdicts
Four verdicts. One action each.
The people at a handoff don't need cryptography. They need to know whether the unit moves on.
CCGenuine, unopenedSignature, counter and binding all check out, and the loop has never broken.
ContinueOOOpenedThe chip found the loop broken. The reading is genuine, so the verdict is too.
Hold the unitOCOpened, possibly resealedBroken once, closed now. Someone has bridged the loop.
Hold and inspectII / ×Not verifiedA failed check, or a chip with tamper detection switched off. A genuine seal of ours always has it on.
HoldA tap that fails to read gives no verdict at all. The app asks for another tap rather than falling back to “genuine”.
Chapter 06 / One carton
Follow one carton from packing to the customer.
Every tap produces a new address with a higher counter, so each reading can be used once. If the carton is opened on the way, the next tap says so.
60CC61CC62CC63CCThe flap tears the seal and breaks the loop. At the carrier's tap the chip reports 62 OO, and the signature still passes because the reading is genuine.
Opened. The unit is held before it reaches the customer.
Counter 61 comes from NXP's published example. The other counters and statuses are illustrative.
Proof on published numbers
We checked the logic against NXP's own example.
NXP publishes a reading for this chip. With NXP's test keys, it decrypts to a chip serial number and counter 61, and the recomputed signature matches NXP's value. We confirmed both with a script.
Chapter 07 / Limits and next steps
Tamper-evident. Not tamper-proof.
A seal reports what happened. It doesn't stop it. We wrote down where this design stops working, because a seal that promises too much is worse than no seal.
A loop bridged before the next tap isn't measured as open. The torn face shows the repair.
A reading taken with someone else's reader can be replayed once from a device imitating the chip.
A live reading can be relayed to a phone elsewhere. The chip can't detect it.
A customer's phone can't check the signature, so a counterfeit seal could point to a fake page.
A cut through the side leaves the loop intact. Tamper-evident tape covers the other seams.
Metal behind the seal cuts read range, and some label materials need a day to bond fully.
What a pilot on real shipments needs.
The proof of concept built the verification backend. These five were designed alongside it and are the scope of a pilot.
- Seals
Produced with a label converter: destructible face, loop routed across the seam
- Staff app
Reads the chip directly and refuses pasted addresses
- Customer check
A page opened by a background tap on iPhone and Android
- Custody dashboard
A timeline per unit, tamper events and counter jumps by route
- Mutual authentication
If captured-reading replays are in scope for your goods
What other teams can take from it
Pilot the system you mean to deploy.
The proof of concept showed that an ordinary phone tap can become evidence, as long as the system behind it questions every reading it receives.
- Pilot the system you mean to deploy. A cheaper pilot that can't be attacked the same way proves nothing about security.
- Start from the threat model. Give each threat to the seal, the chip or the backend before the first chip is programmed. Some settings can't be undone.
- Say what it can't do. “Tamper-evident” is a promise you can keep. “Tamper-proof” isn't.
Need proof your goods arrive unopened and genuine?
Let's map your handoffs to the threats that matter.
A conversation with the engineers who built this proof of concept. Bring your route, your goods and the losses you're trying to stop. We'll tell you plainly whether a seal is the right answer, and what it can and can't prove.