Overview
ISO/IEC TS 29167-15:2017 specifies a crypto suite based on the exclusive OR (XOR) operation for air interface communications in RFID systems. Designed to align with ISO/IEC 18000 air interfaces, the technical specification defines how XOR can be used to hide plain data in identity authentication and secure communication procedures between an interrogator (reader) and an RFID tag. The document makes tag authentication mandatory while other services (secure communication, key update) are optional.
Key topics and technical requirements
- XOR-based coding suite: Uses bitwise XOR as the primary operation for simple, lightweight obfuscation of data. The spec includes cipher description and examples (see Annex C and D).
- Authentication procedures: Multiple authentication methods are defined; authentication is mandatory and supports mutual, interrogator-only or tag-only modes. Parameters include 64-bit random numbers (RN), key identifiers (Key ID), and payload/CRC formats.
- Message and command formats: Defines command/response structures, payload lengths (extensive bit vectors), header fields (AuthType, AuthStep), and parameter definitions such as CRC-16.
- Conformance rules: Interrogators and tags must implement mandatory commands, may implement optional ones, and must not require proprietary commands to meet the specification.
- State management: Includes state diagrams, initialization/reset behavior, state transition tables and error handling (Annex A, B).
- Optional services: Secure communication and key update mechanisms are specified as optional; implementations can support a subset of options but must declare supported features.
- Security considerations: The specification acknowledges XOR’s limitations (vulnerability to known-plaintext and frequency analysis) and provides informative guidance (Annex G).
Applications and practical value
- Low‑to‑light security RFID systems: Ideal where computational simplicity and low cost are prioritized over strong cryptographic resistance (e.g., basic item management, inventory, asset tracking).
- Interoperable air interface security: Enables consistent lightweight security features across devices conformant with ISO/IEC 18000 families.
- Manufacturers and integrators: Useful for tag and reader firmware developers who need a standardized, easy-to-implement obfuscation/authentication option.
- Test and compliance: Contains test vectors and protocol pseudo-code to assist validation and conformance testing.
Who should use this standard
- RFID tag designers and interrogator (reader) manufacturers
- System integrators and solution architects for supply chain and inventory systems
- Test labs and certification bodies validating ISO/IEC 18000-compatible air interface security
- Product managers seeking a lightweight security profile for constrained devices
Related standards
Note: ISO/IEC TS 29167-15:2017 is intended for lightweight security use cases. Implementers should weigh XOR’s simplicity against its cryptographic limitations and consult Annex G for security considerations.