ISO/IEC 9798-2:2008
(Main)Information technology — Security techniques — Entity authentication — Part 2: Mechanisms using symmetric encipherment algorithms
Information technology — Security techniques — Entity authentication — Part 2: Mechanisms using symmetric encipherment algorithms
ISO/IEC 9798-2:2008 specifies entity authentication mechanisms using symmetric encipherment algorithms. Four of the mechanisms provide entity authentication between two entities where no trusted third party is involved; two of these are mechanisms to unilaterally authenticate one entity to another, while the other two are mechanisms for mutual authentication of two entities. The remaining mechanisms require a trusted third party for the establishment of a common secret key, and realize mutual or unilateral entity authentication. The mechanisms specified in ISO/IEC 9798-2:2008 use time variant parameters such as time stamps, sequence numbers, or random numbers to prevent valid authentication information from being accepted at a later time or more than once. If no trusted third party is involved and a time stamp or sequence number is used, one pass is needed for unilateral authentication, while two passes are needed to achieve mutual authentication. If no trusted third party is involved and a challenge and response method employing random numbers is used, two passes are needed for unilateral authentication, while three passes are required to achieve mutual authentication. If a trusted third party is involved, any additional communication between an entity and the trusted third party requires two extra passes in the communication exchange.
Technologies de l'information — Techniques de sécurité — Authentification d'entité — Partie 2: Mécanismes utilisant des algorithmes de chiffrement symétriques
General Information
Relations
Standards Content (Sample)
INTERNATIONAL ISO/IEC
STANDARD 9798-2
Third edition
2008-12-15
Information technology — Security
techniques — Entity authentication —
Part 2:
Mechanisms using symmetric
encipherment algorithms
Technologies de l'information — Techniques de sécurité —
Authentification d'entité —
Partie 2: Mécanismes utilisant des algorithmes de chiffrement
symétriques
Reference number
ISO/IEC 9798-2:2008(E)
©
ISO/IEC 2008
---------------------- Page: 1 ----------------------
ISO/IEC 9798-2:2008(E)
PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but
shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In
downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat
accepts no liability in this area.
Adobe is a trademark of Adobe Systems Incorporated.
Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation
parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In
the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below.
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2008
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
ISO's member body in the country of the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2008 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 9798-2:2008(E)
Contents Page
Foreword. iv
1 Scope . 1
2 Normative references . 1
3 Terms and definitions. 2
4 Symbols and notation . 3
5 Requirements . 3
6 Mechanisms not involving a trusted third party. 4
6.1 Unilateral authentication. 4
6.1.1 Mechanism 1 — One-pass authentication. 5
6.1.2 Mechanism 2 — Two-pass authentication . 5
6.2 Mutual authentication. 6
6.2.1 Mechanism 3 — Two-pass authentication . 6
6.2.2 Mechanism 4 — Three-pass authentication. 7
7 Mechanisms involving a trusted third party .8
7.1 Mechanism 5 — Four-pass authentication . 8
7.2 Mechanism 6 — Five-pass authentication . 10
Annex A (normative) OIDs and ASN.1 syntax . 12
Annex B (informative) Use of text fields . 14
Annex C (informative) Properties of entity authentication mechanisms. 15
Bibliography . 16
© ISO/IEC 2008 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC 9798-2:2008(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members of
ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information
technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as
an International Standard requires approval by at least 75 % of the national bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this International Standard may be the
subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
ISO/IEC 9798-2 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
This third edition cancels and replaces the second edition (ISO/IEC 9798-2:1999), which has been technically
revised. It also incorporates the Technical Corrigendum ISO/IEC 9798-2:1999/Cor.1:2004. Note that
implementations which conform to the second edition will conform to the third edition.
ISO/IEC 9798 consists of the following parts, under the general title Information technology — Security
techniques — Entity authentication:
⎯ Part 1: General
⎯ Part 2: Mechanisms using symmetric encipherment algorithms
⎯ Part 3: Mechanisms using digital signature techniques
⎯ Part 4: Mechanisms using a cryptographic check function
⎯ Part 5: Mechanisms using zero-knowledge techniques
⎯ Part 6: Mechanisms using manual data transfer
Further parts may follow.
iv © ISO/IEC 2008 – All rights reserved
---------------------- Page: 4 ----------------------
INTERNATIONAL STANDARD ISO/IEC 9798-2:2008(E)
Information technology — Security techniques — Entity
authentication —
Part 2:
Mechanisms using symmetric encipherment algorithms
1 Scope
This part of ISO/IEC 9798 specifies entity authentication mechanisms using symmetric encipherment
algorithms. Four of the mechanisms provide entity authentication between two entities where no trusted third
party is involved; two of these are mechanisms to unilaterally authenticate one entity to another, while the
other two are mechanisms for mutual authentication of two entities. The remaining mechanisms require a
trusted third party for the establishment of a common secret key, and realize mutual or unilateral entity
authentication.
The mechanisms specified in this part of ISO/IEC 9798 use time variant parameters such as time stamps,
sequence numbers, or random numbers to prevent valid authentication information from being accepted at a
later time or more than once.
If no trusted third party is involved and a time stamp or sequence number is used, one pass is needed for
unilateral authentication, while two passes are needed to achieve mutual authentication. If no trusted third
party is involved and a challenge and response method employing random numbers is used, two passes are
needed for unilateral authentication, while three passes are required to achieve mutual authentication. If a
trusted third party is involved, any additional communication between an entity and the trusted third party
requires two extra passes in the communication exchange.
2 Normative references
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
ISO/IEC 9798-1, Information technology — Security techniques — Entity authentication — Part 1: General
© ISO/IEC 2008 – All rights reserved 1
---------------------- Page: 5 ----------------------
ISO/IEC 9798-2:2008(E)
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 9798-1 and the following apply.
3.1
authenticated encryption
(reversible) transformation of data by a cryptographic algorithm to produce ciphertext that cannot be altered by
an unauthorized entity without detection, i.e. it provides data confidentiality, data integrity, and data origin
authentication
1)
[ISO/IEC 19772:— ]
3.2
ciphertext
data which has been transformed to hide its information content
[ISO/IEC 10116:2006]
3.3
claimant
entity whose identity can be authenticated, including the functions and the private data necessary to engage in
authentication exchanges on behalf of a principal
[ISO/IEC 9798-5:2004]
3.4
message authentication code
MAC
string of bits which is the output of a MAC algorithm
NOTE A MAC is sometimes called a cryptographic check value.
[ISO/IEC 9797-1:1999]
3.5
message authentication code (MAC) algorithm
algorithm for computing a function which maps strings of bits and a secret key to fixed-length strings of bits,
satisfying the following two properties:
⎯ for any key and any input string the function can be computed efficiently;
⎯ for any fixed key, and given no prior knowledge of the key, it is computationally infeasible to compute the
function value on any new input string, even given knowledge of the set of input strings and
corresponding function values, where the value of the ith input string may have been chosen after
observing the value of the first i − 1 function values.
NOTE 1 A MAC algorithm is sometimes called a cryptographic check function (see for example ISO 7498-2).
NOTE 2 Computational feasibility depends on the user’s specific security requirements and environment.
[ISO/IEC 9797-1:1999]
3.6
time stamp
time variant parameter which denotes a point in time with respect to a common time reference
[ISO/IEC 18014-1:2008]
1) To be published.
2 © ISO/IEC 2008 – All rights reserved
---------------------- Page: 6 ----------------------
ISO/IEC 9798-2:2008(E)
3.7
trusted third party
TTP
security authority, or its agent, trusted by other entities with respect to security-related activities
[ISO/IEC 18014-1:2008]
4 Symbols and notation
A, B Labels used for the entities participating in a mechanism.
d An authenticated decipherment process using secret key K.
K
e An authenticated encipherment process performed using secret key K.
K
e (X) A result of the encipherment process for data X with a symmetric encipherment algorithm
K
using a key K.
I A distinguishing identifier of entity U.
U
K A secret key used with the encipherment and decipherment processes.
K A secret key shared between entities U and V used only in symmetric encipherment
UV
techniques.
N A sequence number issued by entity U.
U
P A symbol used to represent the trusted third party.
R A random number issued by entity U.
U
TN A time variant parameter originated by entity U which is either a time stamp T or a
U U
sequence number N .
U
Token A token sent from entity U to entity V.
UV
T A time stamp issued by entity U.
U
TVP A time variant parameter originated by entity U which is a time stamp T , a sequence
U U
number N or a random number R .
U U
X || Y The result of the concatenation of the data items X and Y in that order. (See NOTE.)
NOTE The concatenation process should incorporate any necessary encoding to ensure that there is no ambiguity in
the interpretation of the concatenated string.
5 Requirements
In the authentication mechanisms specified in this part of ISO/IEC 9798 an entity to be authenticated
corroborates its identity by demonstrating its knowledge of a secret authentication key. This is achieved by the
entity using its secret key to encipher specific data. The enciphered data can be deciphered by anyone
sharing the entity's secret authentication key. The deciphered data must include a time variant parameter. The
parameter can be verified in the following ways.
1. If it is a random number, then the recipient should make sure it is identical to the random challenge sent
to the claimant. As for creation and use of random numbers, refer to ISO/IEC 18031.
2. If it is a time stamp, the recipient should verify the validity of the time stamp.
© ISO/IEC 2008 – All rights reserved 3
---------------------- Page: 7 ----------------------
ISO/IEC 9798-2:2008(E)
3. If it is a sequence number, then the recipient must be able to compare it with previously received or
stored sequence number(s) to make sure it is not a replay.
The authentication mechanisms have the following requirements. If any of these is not met then the
authentication process may be compromised or it cannot be implemented.
a) A claimant authenticating itself to a verifier shall share a common secret authentication key with that
verifier, in which case the mechanisms of Clause 6 apply, or each entity shall share a secret
authentication key with a common trusted third party, in which case the mechanisms of Clause 7 apply.
Such keys shall be known to the involved parties prior to the commencement of any particular occurrence
of an authentication mechanism. The method by which this is achieved is beyond the scope of this part of
ISO/IEC 9798. Guidance on the management of shared secret keys is provided in ISO/IEC 11770-1 and
ISO/IEC 11770-2.
b) If a trusted third party is involved, it shall be trusted by both the claimant and the verifier.
c) The secret authentication key shared by a claimant and a verifier, or by an entity and a trusted third party,
shall be known only to those two parties and, possibly, to other entities which they both trust not to
misuse the key, e.g. to masquerade as one of the parties.
NOTE The encipherment algorithm and the key lifetime should be chosen so that it is computationally infeasible for
a key to be deduced during its lifetime. In addition, the key lifetime should be chosen to prevent known plaintext or
chosen plaintext attacks.
d) The tokens used in the mechanisms must be unforgeable even with the knowledge of old tokens. In other
words, old tokens must not be reusable in any way (in part or in full) to construct new tokens. For every
possible secret key K, the encipherment function e and its corresponding decipherment function d shall
K K
have the following property. The decipherment process d , when applied to a string e (X), shall enable
K K
the recipient of that string to detect forged or manipulated data, i.e. only the possessor of the secret key K
shall be capable of generating strings which will be ‘accepted’ when subjected to the decipherment
process d .
K
NOTE In practice, this can be achieved in many ways. The recommended approach is to use the secret key K with
an authenticated encryption technique that provides both confidentiality and integrity protection, as standardised in
ISO/IEC 19772.
e) The mechanisms in this part of ISO/IEC 9798 require the use of time variant parameters such as time
stamps, sequence numbers or random numbers. The properties of these parameters, in particular that it
is most unlikely for them to repeat within the lifetime of a secret authentication key, are important for the
security of these mechanisms. For additional information see Annex B of ISO/IEC 9798-1:1997.
6 Mechanisms not involving a trusted third party
In these authentication mechanisms the entities A and B shall share a common secret authentication key K
AB
or two unidirectional secret keys K and K prior to the commencement of any particular occurrence of the
AB BA
authentication mechanisms. In the latter case the unidirectional keys K and K are used respectively for the
AB BA
authentication of A by B and of B by A.
All text fields specified in the following mechanisms are available for use in applications outside the scope of
this part of ISO/IEC 9798 (they may be empty). Their relationship and contents depend upon the specific
application. See Annex B for information on the use of text fields.
6.1 Unilateral authentication
Unilateral authentication means that only one of the two entities is authenticated by use of the mechanism.
4 © ISO/IEC 2008 – All rights reserved
---------------------- Page: 8 ----------------------
ISO/IEC 9798-2:2008(E)
6.1.1 Mechanism 1 — One-pass authentication
In this authentication mechanism the claimant A initiates the process and is authenticated by the verifier B.
Uniqueness/timeliness is controlled by generating and checking a time stamp or a sequence number (see
Annex B of ISO/IEC 9798-1:1997). The authentication mechanism is illustrated in Figure 1.
(1) Token
AB
(2)
B
A
Figure 1 — Mechanism 1 — One-pass authentication
The form of the token (Token ), sent by the claimant A to the verifier B is:
AB
Token = Text || e ( TN || I || Text )
AB 2 A B 1
K
AB
where the claimant A uses a time variant parameter TN which is a time stamp T or a sequence number N .
A A A
The choice depends on the technical capabilities of the claimant and the verifier as well as on the environment.
The inclusion of the distinguishing identifier I in Token is optional.
B AB
NOTE Distinguishing identifier I is included in Token to prevent the reuse of Token on entity A by an adversary
B AB AB
masquerading as entity B. Its inclusion is made optional so that, in environments where such attacks cannot occur, it may
be omitted. The distinguishing identifier I may also be omitted if a unidirectional key is used.
B
The following is a description of Mechanism 1 — One-pass authentication:
(1) A generates and sends Token to B.
AB
(2) On receipt of the message containing Token , B verifies Token by deciphering the enciphered part
AB AB
[where deciphering implies that the requirements given in Clause 5 d) are met] and then checking the
correctness of the distinguishing identifier I , if present, as well as the time stamp or the sequence
B
number.
6.1.2 Mechanism 2 — Two-pass authentication
In this authentication mechanism the claimant A is authenticated by the verifier B that initiates the process.
Uniqueness/timeliness is controlled by generating and checking a random number R (see Annex B of
B
ISO/IEC 9798-1:1997). The authentication mechanism is illustrated in Figure 2.
(1) R || Text
B 1
A
B
(2) Token
AB
(3)
Figure 2 — Mechanism 2 — Two-pass authentication
The form of the token (Token ), sent by the claimant A to the verifier B is:
AB
Token = Text || e ( R || I || Text )
AB 3 B B 2
K
AB
The inclusion of the distinguishing identifier I in Token is optional.
B AB
© ISO/IEC 2008 – All rights reserved 5
---------------------- Page: 9 ----------------------
ISO/IEC 9798-2:2008(E)
NOTE 1 In order to prevent the possibility of a chosen plaintext attack, i.e. a cryptanalytic attack where the cryptanalyst
knows the complete plaintext for one or more ciphertext strings, entity A may include a random number R in Text .
A 2
NOTE 2 Distinguishing identifier I is included in Token to prevent any party from using Token as Token . The
B AB AB BA
inclusion of the distinguishing identifier I is made optional so that, in environments where such attacks cannot occur, it
B
may be omitted. The distinguishing identifier I may also be omitted if a unidirectional key is used.
B
The following is a description of Mechanism 2 — Two-pass authentication:
(1) B generates a random number R and sends it and, optionally, a text field Text to A.
B 1
(2) A generates and sends Token to B.
AB
(3) On receipt of the message containing Token , B verifies Token by deciphering the enciphered part
AB AB
[where deciphering implies that the requirements given in Clause 5 d) are
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.