Overview
ISO/IEC 25185-1:2016 specifies PLAID (Protocol for Lightweight Authentication of IDentity) - an interoperable authentication protocol for integrated circuit cards (ICCs / smartcards). The standard targets physical and logical access control use-cases, especially contactless environments that require faster, privacy-preserving authentication than full PKI-only approaches. PLAID is a hybrid protocol using both symmetric and asymmetric cryptography and relies on standards-based algorithms: AES‑128, RSA‑2048, and SHA‑256.
The document defines PLAID in sufficient detail for multiple independent implementations to interoperate. It focuses on the authentication exchange (INITIAL AUTHENTICATE / FINAL AUTHENTICATE), session key derivation, key diversification and command semantics, but does not specify key distribution, credential record management (including revocation) or the operational handling of payload entities such as PINs or biometric templates.
Key topics and technical requirements
- Protocol flow: Stepwise exchanges including INITIAL AUTHENTICATE and FINAL AUTHENTICATE commands and responses to establish mutual authentication and secure session keys.
- Cryptography: Use of AES‑128 (symmetric), RSA‑2048 (asymmetric) and SHA‑256 (hashing) per referenced standards.
- Key diversification & session keys: Procedures and data objects (e.g., DivData, FAKey, IAKey, KeySetID) to avoid single-key compromise and derive per-card keys.
- Data objects & TLV mapping: Defined data dictionary for payloads, ACSRecord, OpModeID and other PLAID objects.
- Command set, status bytes & error handling: APDU-style command definitions and handling aligned with ICC conventions (ISO/IEC 7816 family).
- Interoperability aids: Normative test vectors, reference implementation and informative annexes covering key management policy, identity leakage considerations and PLAID security features.
Practical applications
- Physical access control systems (PACS): Fast, privacy-aware authentication for contactless door entry and turnstiles.
- Logical access control systems (LACS): Secure workstation or network logon where smartcard-based authentication is required.
- Embedded & mobile readers: Scenarios needing low-latency cryptographic authentication on constrained devices.
- Transit, stadium, campus and event systems: Use-cases where speed and limited data exposure are priorities.
Who should use this standard
- Card and terminal manufacturers implementing ICC authentication protocols.
- System integrators and access control solution providers seeking interoperable, contactless-capable authentication.
- Security architects selecting standards-based cryptographic protocols for card-to-reader authentication.
- Test labs and certification bodies validating PLAID implementations.
Related standards & references
Normative references include ISO/IEC 7816-4 / 7816-5, ASN.1 (ISO/IEC 8824-1), block-cipher modes and MAC standards, RSA/PKCS#1 (RFC 3447), and related ISO cryptography parts (AES, RSA, SHA). PLAID’s intellectual‑property is made available under a perpetual, royalty‑free licence from the Australian Commonwealth (see ISO/IEC 25185-1 introduction for contact details).
Keywords: ISO/IEC 25185-1, PLAID, ICC authentication, smartcard protocol, AES-128, RSA-2048, SHA-256, contactless access control, key diversification, session key.