Identification
CMAC
Cipher-based Message Authentication Code
The cryptographic primitive (AES-CMAC) used by authentication-grade NFC chips to prove a URL was produced by a specific chip.
CMAC is a symmetric MAC built on AES. The NFC chip and the verifying server share a secret key; the chip computes a short MAC over the tap counter and other fields, the server recomputes it and compares.
Because the key never leaves the chip and the MAC changes on every tap, copying a printed URL or sniffing an earlier tap doesn't help an attacker.
CMAC is what makes 'every scan is unique and verifiable' possible at the price point of a passive NFC tag.
