ISO/IEC 25185-1 INTERNATIONAL STANDARD First edition 2016-01-15 Identification cards Integrated circuit card authentication protocols - Papt@col for Lightweight Authentication of Identity Cartesd'identificationIntegrated circuitprotocoles d'authentification par carte- Partie 1:Protocole pour I'authentification de I'identite leger Reference number IEC IS0/IEC25185-1:2016(E) @IS0/IEC2016 IS0/IEC25185-1:2016(E) COPYRIGHTPROTECTEDDOCUMENT IS0/IEC 2016, Published in Switzerland AHbyghty raeansedlalestronicotherwipemifieldlanilaitdfitdisgpplbbicatbpyimgyoltqnsthgintprndtioedntnttiaiaet) otimeamyisowithout prior written permission. Permission can be requested from either ISO at the address below or ISo's member body in the country of the requester. fsodeBparigbt Afics 3·CP401 CH-1214 Vernier, Geneva, Switzerland Tel. +41 22 749 01 11 Fax +41 22 749 09 [email protected] www.iso.org ii @IS0/IEC 2016- All rights reserved IS0/IEC25185-1:2016(E) Contents Page Foreword iv Iptroduction. Scope 1 2 Normative references 1 3 Terms and definitions 2 4 Symbols and abbreviated terms 2 5 Data dictionary. 3 6 Authentication Protocol Description 5 6.1 Step1-INITIALAUTHENTICATE command 6 6.2 Step 2-INITIALAUTHENTICATE command evaluation 7 6.3 Step3-INITIALAUTHENTICATEresponse 6.4 4 6.5 Step5-FINALAUTHENTICATEcommand 7 6.6 Step6-FINALAUTHENTICATEcommandevaluation 8 7 Application identification 9 8 Commandset 6 9 Status bytes and error handling 9 10 Key diversification 10 11 Session key generation 10 12 Defaultmode 10 Annex A (normative) Test vectors .11 AnnexB (informative)Keymanagementpolicy 12 Annex C (informative) Keyset management .13 AnnexD(informative)Referenceimplementation ..14 AnnexE (informative)Identityleakage considerations .15 AnnexF (informative)Operational modemanagement .16 Annex G (informative)PLAID securityfeatures ..17 Bibliography 20 IS0/IEC2016-Allrightsreserved iii