Apple Wallet NFC encryptionPublicKey

Question

In Apple's documentation for the keys available for a Wallet pass, there's an option for a dictionary for NFC-related data. I understand that use of this key requires special permission from Apple. Regardless ...

message is straight forward -- it's the data passed to a NFC terminal (usually a unique identifier for the customer).

encryptionPublicKey, however, has me confused. Apple states it is the public encryption key used by the Value Added Services protocol. Use a Base64 encoded X.509 SubjectPublicKeyInfo structure containing a ECDH public key for group P256.

Can anyone explain what this second sentence means and/or what a developer would have to do to generate this? From what would one even generate the public/private keys from?

Answer 1

You'll need the following to generate the public and private key. The private key is used by the merchant hardware when reading the pass and decoding the payload.

The compressed public key is what goes into your pass.json.

openssl ecparam -name prime256v1 -genkey -noout -out nfcKey.pem
openssl ec -in nfcKey.pem -pubout -out nfcPubkey.pem -conv_form compressed
cat nfcPubkey.pem

Outputs:

-----BEGIN PUBLIC KEY-----
MDkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDIgAC/Bu9nyAtG1DQe7t7jszLb+dZ1GbX
oR8G0rIXoak67NM=
-----END PUBLIC KEY---

You'll need Base64 key (without the newline) for the encryptionPublicKey field.

E.g. MDkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDIgAC/Bu9nyAtG1DQe7t7jszLb+dZ1GbXoR8G0rIXoak67NM=