ISO/IEC 29167-22:2026

Overview

ISO/IEC 29167-22:2026 is an international standard developed by ISO and IEC, specifying security services for radio frequency identification (RFID) devices using a SPECK-based cryptographic suite. SPECK is a family of lightweight block ciphers designed for resource-constrained environments, offering flexibility through the support of various data block and key length parameters. This standard forms a part of the ISO/IEC 18000 series for RFID air interface communication, enabling enhanced security for data exchange between RFID Tags and RFID Interrogators.

Key Topics

• SPECK Block Cipher Usage: Supports multiple block/key length combinations (64/96, 96/96, 64/128, 128/128, 128/256 bits), providing tailored security for devices with varying computational capabilities.
• Security Services: Defines cryptographic authentication mechanisms including Tag authentication, Interrogator (reader) authentication, and Mutual authentication, using efficient challenge-response protocols.
• Conformance Requirements: Specifies mandatory and optional commands for both RFID Tags and Interrogators to ensure interoperability and compliance with ISO/IEC 18000 standards.
• Protocol Integration: Ensures compatibility with existing air interface specifications and designates procedures for error handling, state management, and command formatting.
• Parameterization and Flexibility: Allows implementers to select supported cipher variant(s) according to application risk profiles and device constraints.
• Key Management: Specifies the structure for key storage and updates, acknowledging that secure key management strategies are critical but defined outside the scope of this standard.

Applications

ISO/IEC 29167-22:2026 is applicable wherever there is a need for secure identification and data capture over RFID air interfaces, particularly in environments where device resources are limited. Practical use cases include:

• Supply Chain Management: Securing item identification and tracking information to prevent tampering or unauthorized data access.
• Asset Management: Protecting sensitive asset identification data during RFID scanning in logistics, healthcare, or industrial contexts.
• Access Control Systems: Enabling secure, cryptographically protected communication between RFID badges and reader devices.
• Retail and Inventory: Authenticating products and tags for anti-counterfeiting and loss prevention with fast, lightweight cryptography suitable for mass-deployed tags.
• IoT Device Security: Providing lightweight security options in Internet of Things (IoT) applications utilizing RFID or AIDC (automatic identification and data capture) technologies.

Related Standards

• ISO/IEC 18000 Series: Framework for air interface communications and parameters for RFID-based item management.
• ISO/IEC 18000-63: Specifies parameters for RFID air interface communications in the ultra-high frequency (UHF) band.
• ISO/IEC 19762: Vocabulary and terms for automatic identification and data capture standards.
• Other ISO/IEC 29167 Parts: Defines different cryptographic suites (e.g., AES, PRESENT) for RFID and AIDC technologies, allowing implementers to select the cryptography best suited for their application.
• ISO/IEC JTC 1/SC 31: Technical subcommittee managing international standards for automatic identification and data capture techniques.

Practical Value

Implementing ISO/IEC 29167-22:2026 enables organizations to:

• Deploy RFID systems with built-in, standardized security for privacy, authentication, and anti-cloning.
• Achieve regulatory and industry compliance for secure data exchange in supply chains, retail, and healthcare.
• Adapt security strength and performance by selecting appropriate SPECK cipher parameters to match device and threat profiles.
• Interoperate globally with vendors and systems that adhere to the ISO/IEC 29167 and ISO/IEC 18000 standards, ensuring broad compatibility and future-proofing investments in RFID technology.

By aligning with this standard, stakeholders can achieve robust security for RFID and automatic identification environments with minimal impact on device cost, power, or processing resources.