ISO/IEC 29192-4:2013

Overview

ISO/IEC 29192-4:2013 - Information technology - Security techniques - Lightweight cryptography - Part 4: Mechanisms using asymmetric techniques - specifies three lightweight asymmetric cryptographic mechanisms tailored for constrained environments. The document defines:

• a unilateral authentication mechanism based on discrete logarithms on elliptic curves (often referenced as cryptoGPS);
• an authenticated lightweight key exchange (ALIKE) mechanism for unilateral authentication and session-key establishment (based on a variant of RSA);
• an identity-based signature mechanism that simplifies key management by deriving signer keys from identities.

The standard targets low-resource devices (e.g., RFID tags, sensors, embedded IoT nodes) where computation, memory and power are limited.

Key Topics and Requirements

ISO/IEC 29192-4 defines technical requirements and procedures for each mechanism, including:

• Security requirements for the environment - guidance on assumptions and threat models for constrained deployments.
• Key production - processes for generating and distributing asymmetric pairs, master secret keys (for identity-based schemes), and claimant/signer parameters.
• Authentication exchanges and formats - detailed procedures for unilateral authentication, ALIKE exchanges, and sign/verify operations.
• Session-key derivation - how session keys are derived and handled following ALIKE authenticated exchanges.
• Performance-oriented techniques - support for pre-computation (“coupons”), memory-computation trade-offs (Annex B), and numerical examples (Annex C) to aid implementation in tight-resource contexts.
• Object identifiers and interoperability elements (Annex A) for integration into broader systems.

Normative references include ISO/IEC 15946-1 (elliptic-curve cryptography) and ISO/IEC 29192-1 (lightweight cryptography general).

Practical Applications

ISO/IEC 29192-4 is practical for:

• IoT and RFID device authentication - lightweight unilateral authentication (cryptoGPS) enables identification of constrained provers with minimal runtime cost using offline coupons.
• Secure session establishment - ALIKE provides unilateral authentication plus session-key agreement in environments where full asymmetric protocols are too heavy.
• Simplified signing and verification - identity-based signatures reduce certificate and PKI overhead by deriving signing keys from identities, useful for large fleets of constrained devices.

Typical use-cases: asset tracking, sensor networks, access control, device onboarding, and other low-power embedded systems requiring asymmetric security primitives.

Who Should Use This Standard

• Security architects and engineers designing IoT/RFID systems
• Embedded and firmware developers implementing lightweight cryptography
• Product managers and compliance teams evaluating secure options for constrained devices
• Standards and interoperability bodies aligning device authentication and key-management practices

Related standards and notes

• See ISO/IEC 29192-1 (Lightweight cryptography - General) and ISO/IEC 15946-1 (ECC fundamentals).
• Patent notice: the standard may reference patented techniques; holders identified in the document (e.g., France Telecom, Gemalto, A*STAR/Exploit Technologies) have declared licensing terms. Consult ISO and IEC patent databases for current information.