EdgeNFC
EdgeNFC
Free tool · no signup
Diversify a master key with a tag UID and get the per-tag key — plus the two-block input the algorithm actually MACs, and a published NXP known-answer vector to check your own implementation against. A wrong diversified key does not throw; it just quietly fails to verify, on every tag, forever.
Nothing leaves your browser. The key derivation runs locally in this tab, in the same Rust/WebAssembly core EdgeNFC verifies production taps with. Your key is never uploaded, never logged, never stored — the only request this page makes is fetching that core.
Why this tool exists
AN10922 AES-128 looks like CMAC over 0x01 ‖ M. It is not, and the difference is invisible until nothing verifies.
Standard AES-CMAC pads its message to whole blocks and uses subkey K1 when the last block is exactly full, or K2 when it had to pad. A short message means one block.
AN10922 builds d = 0x01 ‖ M and then grows it to exactly 32 bytes — two AES blocks — appending 0x80 then zeros if needed. M is capped at 31 bytes so it can never need a third.
When 1 + len(M) ≤ 16 a stock CMAC produces one block and AN10922 produces two, so the answers differ. EdgeNFC's own M is 8 bytes (role label + 7-byte UID) — squarely inside the divergent range.
Both paths return a well-formed 16-byte key. Nothing raises. You write it to a chip, and every subsequent tap fails its MAC check for a reason that looks like anything except key derivation. That is why the known-answer test below is worth ten seconds.
Calculator
Master key plus diversification input, straight through the published core. The construction is shown alongside the answer.
Never paste a production master key into any web tool — including this one. Use a test key. This field is memory-only: it is not stored, not put in the URL, and is wiped when you leave the page. That is enforced by the code, but the habit matters more than any one page's promise.
Ready. Press Diversify.
Using the same master key above, model the tap itself — the session key is derived from this tag's diversified key, the counter is MAC'd, and you get the exact SUN URL a genuine read would produce. Paste it into the decoder to close the loop.
Known-answer test
Two published vectors. Run them here, run them through your own code, compare the hex. If the second one disagrees, you have a generic CMAC where AN10922 belongs.
Only published test vectors ever appear on this site. The master key in both is NXP's own example value from AN10922 — it is not a key, it is documentation.
Reference
AES-128 diversification, exactly as EdgeNFC's core implements it.
The role label is an EdgeNFC convention, not part of AN10922. AN10922 defines the construction over whatever M you give it. Prefixing the UID with a role byte (0x01 file-read, 0x02 meta-read) is how one master key yields two independent per-tag keys. Whatever you choose, the provisioning app and the verifier must choose the same thing, byte for byte.
Built by EdgeNFC, which does this for a living: hosted NTAG 424 verification with unlimited scans, or an on-premise core if the keys must never leave your building. Free tier, no card.