ISO/IEC 29167-17:2015

Overview

ISO/IEC 29167-17:2015 specifies the cryptoGPS cryptographic suite for RFID air interfaces. It defines a lightweight, asymmetric security mechanism for Tag authentication on ISO/IEC 18000 air interfaces. The suite uses elliptic-curve based techniques (security tied to the difficulty of discrete logarithms on elliptic curves) and an efficient pre-computation approach using “coupons” to reduce on‑Tag computation. ISO/IEC 29167-17 provides message/response formatting, protocol states, and conformance rules for both Interrogators and Tags.

Key topics and requirements

• Scope and conformance
  • Applies to ISO/IEC 18000 air interface standards for RFID.
  • Defines obligations for Interrogators and Tags to claim conformance (implement message/response formats and avoid conflicting or proprietary commands).
• Asymmetric authentication
  • Lightweight unilateral authentication based on elliptic-curve discrete logarithm hardness.
  • Use of public/private key pairs, public domain parameters, challenges, and responses.
• Performance optimizations
  • Support for offline pre-computation (“coupons”) to lower Tag computational cost while maintaining security.
• Protocol structure
  • Parameter definitions, state diagram, initialization/reset, authentication flows.
  • Two authentication method variants: CCR variant (Method “00” = TAM1) and NTS variant (Method “01” = TAM2).
• Operational details
  • Message and response formatting, key table and key update procedures.
  • Normative annexes: state transition tables, error codes, cipher description, test vectors, and protocol-specific material.

Applications and who uses it

ISO/IEC 29167-17 is intended for:

• RFID tag and reader manufacturers implementing secure air‑interface authentication.
• System integrators and solution architects in logistics, supply chain, retail, asset tracking, and IoT who require lightweight cryptographic authentication for constrained devices.
• Security engineers and standards committees selecting interoperable crypto suites for air interface and application-layer standards. Practical uses include device authentication, anti‑cloning measures, and secure identification where low Tag computation and interoperability with ISO/IEC 18000 air interfaces are critical.

Related standards

• ISO/IEC 18000 (RFID air interface parameters)
• ISO/IEC 29167-1 (Security services for RFID air interfaces)
• ISO/IEC 9798-5 (Entity authentication - zero-knowledge techniques)
• ISO/IEC 15946-1 (Elliptic curve cryptography)
• ISO/IEC 19762 (AIDC vocabulary)
• Other parts of ISO/IEC 29167 (e.g., AES-128, PRESENT-80, ECDSA‑ECDH, Grain‑128A)

For implementers, ISO/IEC 29167-17 is a practical choice when you need lightweight RFID security, elliptic-curve based authentication, and standardized interoperability across ISO/IEC 18000 air interfaces.