How to Choose the Right Authentication Chip for Your Product

Most hardware selection goes wrong because it starts with the radio. The frequency is an outcome, not a decision. Four questions settle which chip a product needs, and they are answered by the job rather than by the datasheet.

• Who reads it? A customer with a phone, or your own equipment.
• From how far? Touch, across a room, or anywhere in the world.
• Does it have to prove anything? Counting stock and proving authenticity are different problems.
• Does it carry its own power? Passive tags last indefinitely; active ones report on their own.

Answer those and the chip picks itself from the Cifr range.

The four questions, in order

1. Who reads it

If the person verifying is a customer, an inspector or a dealer, the answer is NFC, because the reader is already in their pocket. No app, no dedicated hardware, no appointment.

If the reader is your own equipment — a warehouse portal, a handheld, a dock-door scanner — then UHF RFID is available to you, and with it bulk reading at range.

This question alone eliminates most of the range. A tag a consumer must verify cannot be UHF-only, no matter how convenient the read range would be for your operations.

2. From how far

Read range is a system property, not a chip property. The published bands are:

• Touch — a deliberate tap against a specific object.
• Touch to metres — a dual-interface tag that answers both a phone and a reader.
• Tens of metres — UHF, with hundreds of tags resolved per second and no line of sight.
• Network wide — an active device reporting its own position over a cellular network.

Treat these as the published figures for each technology class rather than as measurements of a specific part. Antenna design, mounting surface and environment move them considerably, and metal and liquid move them most.

3. Does it have to prove anything

This is the question most often skipped, and it is the expensive one to get wrong.

Counting is not proving. A plain tag presents an identifier. Anyone who reads it can reproduce it, which is fine for stock control of your own goods and useless the moment someone has a financial incentive to forge it.

Proving requires a secure element — a private key generated on-chip that cannot be exported, answering a fresh random challenge with a signature on every read. A clone copies the readable identifier but not the key, so it fails on the first verification.

If returns fraud, counterfeiting, warranty abuse, diversion or resale value are live risks in your category, you need the second kind. Retrofitting it means re-tagging everything you have already made.

4. Does it carry its own power

Passive tags draw power from the reader. They have no battery, no service life limit and the lowest unit cost, but they only speak when spoken to.

An active device has its own power and reports on its own schedule. That buys continuous position for things that move independently, at the cost of a battery life, a larger form factor and a unit price an order of magnitude higher.

Which chip answers which job

Cifr Max — when assurance is the requirement

The flagship. Asymmetric cryptography on a patented secure element, built to hold against quantum attack, answering every tap with a response that cannot be replayed.

Choose it when the item is high value, long-lived, or both: luxury goods, regulated product, anything where a forged verification would be a serious commercial or safety event. It is the only part in the range specified as quantum resistant, which matters when the product will still be in the field in a decade.

Cifr Lite — when unit cost decides

Cifr firmware on low-cost chips, keeping asymmetric cryptography intact. The volume option when a tag has to cost cents.

Choose it when you need genuine cryptographic verification across very large volumes and the per-unit budget is measured in pennies. The important point is what it does not drop: the asymmetric cryptography survives, so a Lite tag still cannot be cloned. You are trading the quantum-resistant headroom of Max, not the security model.

Cifr Duo — when the warehouse and the customer need the same answer

NFC and RFID on one die under a unified UID, so the warehouse and the customer read the same identity.

Choose it when one item has two jobs. This is the common case teams solve badly by applying two separate tags and then reconciling two identities. Duo is one part with one identity: your scanner reads it at range for stock, your customer taps it with a phone for proof.

Cifr TensorTag — when you need range and volume

RFID for logistics: stackable, read at long distance, and with the TensorWave reader, readable across tens of metres.

Choose it when the problem is counting, not proving — stock audits, dock-door events, asset registers, cycle counting. Stackability matters here: it is specified to read through a pile rather than requiring presentation one at a time. Note the trade: asymmetric cryptography is not part of this specification, which is the correct trade for inventory and the wrong one for authenticity.

Cifr DeltaWave — when the item moves on its own

An active tracker in a small form factor: GPS for position, LTE to report it, BLE for anything in the room.

Choose it when you need to know where something is without anyone scanning it: goods in transit, returnable transport assets, high-value equipment. DeltaWave is the only part here that carries a battery, which is the whole point and also its main constraint.

The range side by side

	Max	Lite	Duo	TensorTag	DeltaWave
Interface	NFC	NFC	NFC + RFID	RFID	GPS, LTE, BLE
Asymmetric crypto	Yes	Yes	Yes	—	Yes
Quantum resistant	Yes	—	—	—	—
Read range	Touch	Touch	Touch / metres	Tens of metres	Network wide
Needs a battery	No	No	No	No	Yes
Read by a phone	Yes	Yes	Yes	No	Yes
Best at	Assurance	Volume	Both jobs at once	Counting at range	Live position

Bands and ranges are the published figures for each technology class, not measurements of specific parts.

Combinations that work

Most real deployments use more than one part, and the pairings are predictable.

Max on the product, TensorTag on the carton. The item proves itself to a customer; the case and pallet are counted in bulk through the supply chain. Two parts, two jobs, no conflict.

Duo where the item is also the stock unit. Apparel, accessories and boxed goods where the same unit is both inventory and a consumer touchpoint. One tag avoids the reconciliation problem entirely.

Lite across the long tail, Max on the hero lines. A range rarely needs uniform assurance. Put the quantum-resistant part where the value and the counterfeit risk concentrate, and the volume part everywhere else — the identity model is the same, so the platform does not fork.

DeltaWave on the container, passive tags on the contents. The shipment reports its own position; the items inside are verified on arrival.

Frequently asked questions

Can one chip do everything? Duo comes closest, covering both phone verification and reader-range counting on one die. Nothing passive gives you live position, and nothing active gives you a cents-level unit cost.

Why can’t my phone read UHF RFID? Phones carry an NFC radio at 13.56 MHz, not a UHF one. Reading UHF needs a handheld, a fixed reader or a phone accessory.

Is NFC less secure than RFID? Neither is secure or insecure by frequency. Security comes from whether the part carries a secure element with a non-exportable key.

Do we have to commit to one part across the whole range? No, and most customers do not. The identity model is shared, so mixed deployments report into one system.

What if we choose wrong? Changing the radio means re-tagging physical stock, which is why the proving question matters more than the range question. Range problems can be solved with readers; a copyable tag cannot be fixed after the fact.

Start from the job, not the datasheet

If you can answer who reads it, from how far, whether it must prove anything and whether it needs its own power, the selection is usually obvious in one conversation.

Talk to our team about part selection and a site survey, or compare the full chip range.