ANSI INCITS ISO IEC 9798-2-2008 Information technology - Security techniques - Entity authentication - Part 2 Mechanisms using symmetric encipherment algorithms.pdf

1、 INCITS/ISO/IEC 9798-2:20082010 (ISO/IEC 9798-2:2008, IDT) Information technology - Security techniques - Entity authentication - Part 2: Mechanisms using symmetric encipherment algorithms Reaffirmed as INCITS/ISO/IEC 9798-2:2008 R2015INCITS/ISO/IEC 9798-2:20082010 PDF disclaimer This PDF file may c

2、ontain embedded typefaces. In accordance with Adobes licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept therein the respons

3、ibility of not infringing Adobes licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation

4、parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. Adopted by INCITS (InterNational Committ

5、ee for Information Technology Standards) as an American National Standard. Date of ANSI Approval: 2/22/10 Published by American National Standards Institute, 25 West 43rd Street, New York, New York 10036 Copyright 2010 by Information Technology Industry Council (ITI). All rights reserved. These mate

6、rials are subject to copyright claims of International Standardization Organization (ISO), International Electrotechnical Commission (IEC), American National Standards Institute (ANSI), and Information Technology Industry Council (ITI). Not for resale. No part of this publication may be reproduced i

7、n any form, including an electronic retrieval system, without the prior written permission of ITI. All requests pertaining to this standard should be submitted to ITI, 1101 K Street NW, Suite 610, Washington DC 20005. Printed in the United States of America ii ITIC 2010 All rights reserved ISO/IEC 9

8、798-2:2008(E) ISO/IEC 2008 All rights reserved iiiContents Page Foreword iv 1 Scope . 1 2 Normative references . 1 3 Terms and definitions. 2 4 Symbols and notation 3 5 Requirements 3 6 Mechanisms not involving a trusted third party 4 6.1 Unilateral authentication 4 6.1.1 Mechanism 1 One-pass authen

9、tication 5 6.1.2 Mechanism 2 Two-pass authentication . 5 6.2 Mutual authentication. 6 6.2.1 Mechanism 3 Two-pass authentication . 6 6.2.2 Mechanism 4 Three-pass authentication. 7 7 Mechanisms involving a trusted third party 8 7.1 Mechanism 5 Four-pass authentication 8 7.2 Mechanism 6 Five-pass authe

10、ntication . 10 Annex A (normative) OIDs and ASN.1 syntax . 12 Annex B (informative) Use of text fields 14 Annex C (informative) Properties of entity authentication mechanisms 15 Bibliography . 16 ISO/IEC 9798-2:2008(E) iv ISO/IEC 2008 All rights reservedForeword ISO (the International Organization f

11、or Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective o

12、rganization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information tech

13、nology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standar

14、ds adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. Attention is drawn to the possibility that some of the elements of this International Standard

15、may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. ISO/IEC 9798-2 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques. This third edition cancels and rep

16、laces the second edition (ISO/IEC 9798-2:1999), which has been technically revised. It also incorporates the Technical Corrigendum ISO/IEC 9798-2:1999/Cor.1:2004. Note that implementations which conform to the second edition will conform to the third edition. ISO/IEC 9798 consists of the following p

17、arts, under the general title Information technology Security techniques Entity authentication: Part 1: General Part 2: Mechanisms using symmetric encipherment algorithms Part 3: Mechanisms using digital signature techniques Part 4: Mechanisms using a cryptographic check function Part 5: Mechanisms

18、using zero-knowledge techniques Part 6: Mechanisms using manual data transfer Further parts may follow. INTERNATIONAL STANDARD ISO/IEC 9798-2:2008(E) ISO/IEC 2008 All rights reserved 1Information technology Security techniques Entity authentication Part 2: Mechanisms using symmetric encipherment alg

19、orithms 1 Scope This part of ISO/IEC 9798 specifies entity authentication mechanisms using symmetric encipherment algorithms. Four of the mechanisms provide entity authentication between two entities where no trusted third party is involved; two of these are mechanisms to unilaterally authenticate o

20、ne entity to another, while the other two are mechanisms for mutual authentication of two entities. The remaining mechanisms require a trusted third party for the establishment of a common secret key, and realize mutual or unilateral entity authentication. The mechanisms specified in this part of IS

21、O/IEC 9798 use time variant parameters such as time stamps, sequence numbers, or random numbers to prevent valid authentication information from being accepted at a later time or more than once. If no trusted third party is involved and a time stamp or sequence number is used, one pass is needed for

22、 unilateral authentication, while two passes are needed to achieve mutual authentication. If no trusted third party is involved and a challenge and response method employing random numbers is used, two passes are needed for unilateral authentication, while three passes are required to achieve mutual

23、 authentication. If a trusted third party is involved, any additional communication between an entity and the trusted third party requires two extra passes in the communication exchange. 2 Normative references The following referenced documents are indispensable for the application of this document.

24、 For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 9798-1, Information technology Security techniques Entity authentication Part 1: General ISO/IEC 9798-2:2008(E) 2 ISO/IEC 2008 All

25、rights reserved3 Terms and definitions For the purposes of this document, the terms and definitions given in ISO/IEC 9798-1 and the following apply. 3.1 authenticated encryption (reversible) transformation of data by a cryptographic algorithm to produce ciphertext that cannot be altered by an unauth

26、orized entity without detection, i.e. it provides data confidentiality, data integrity, and data origin authentication ISO/IEC 19772:1) 3.2 ciphertext data which has been transformed to hide its information content ISO/IEC 10116:2006 3.3 claimant entity whose identity can be authenticated, including

27、 the functions and the private data necessary to engage in authentication exchanges on behalf of a principal ISO/IEC 9798-5:2004 3.4 message authentication code MAC string of bits which is the output of a MAC algorithm NOTE A MAC is sometimes called a cryptographic check value. ISO/IEC 9797-1:1999 3

28、.5 message authentication code (MAC) algorithm algorithm for computing a function which maps strings of bits and a secret key to fixed-length strings of bits, satisfying the following two properties: for any key and any input string the function can be computed efficiently; for any fixed key, and gi

29、ven no prior knowledge of the key, it is computationally infeasible to compute the function value on any new input string, even given knowledge of the set of input strings and corresponding function values, where the value of the ith input string may have been chosen after observing the value of the

30、 first i 1 function values. NOTE 1 A MAC algorithm is sometimes called a cryptographic check function (see for example ISO 7498-2). NOTE 2 Computational feasibility depends on the users specific security requirements and environment. ISO/IEC 9797-1:1999 3.6 time stamp time variant parameter which de

31、notes a point in time with respect to a common time reference ISO/IEC 18014-1:2008 1) To be published. ISO/IEC 9798-2:2008(E) ISO/IEC 2008 All rights reserved 33.7 trusted third party TTP security authority, or its agent, trusted by other entities with respect to security-related activities ISO/IEC

32、18014-1:2008 4 Symbols and notation A, B Labels used for the entities participating in a mechanism. dKAn authenticated decipherment process using secret key K. eKAn authenticated encipherment process performed using secret key K. eK(X) A result of the encipherment process for data X with a symmetric

33、 encipherment algorithm using a key K. IUA distinguishing identifier of entity U. K A secret key used with the encipherment and decipherment processes. KUVA secret key shared between entities U and V used only in symmetric encipherment techniques. NUA sequence number issued by entity U. P A symbol u

34、sed to represent the trusted third party. RUA random number issued by entity U. TNUA time variant parameter originated by entity U which is either a time stamp TUor a sequence number NU.TokenUVA token sent from entity U to entity V. TU A time stamp issued by entity U. TVPUA time variant parameter or

35、iginated by entity U which is a time stamp TU, a sequence number NUor a random number RU. X | Y The result of the concatenation of the data items X and Y in that order. (See NOTE.) NOTE The concatenation process should incorporate any necessary encoding to ensure that there is no ambiguity in the in

36、terpretation of the concatenated string. 5 Requirements In the authentication mechanisms specified in this part of ISO/IEC 9798 an entity to be authenticated corroborates its identity by demonstrating its knowledge of a secret authentication key. This is achieved by the entity using its secret key t

37、o encipher specific data. The enciphered data can be deciphered by anyone sharing the entitys secret authentication key. The deciphered data must include a time variant parameter. The parameter can be verified in the following ways. 1. If it is a random number, then the recipient should make sure it

38、 is identical to the random challenge sent to the claimant. As for creation and use of random numbers, refer to ISO/IEC 18031. 2. If it is a time stamp, the recipient should verify the validity of the time stamp. ISO/IEC 9798-2:2008(E) 4 ISO/IEC 2008 All rights reserved3. If it is a sequence number,

39、 then the recipient must be able to compare it with previously received or stored sequence number(s) to make sure it is not a replay. The authentication mechanisms have the following requirements. If any of these is not met then the authentication process may be compromised or it cannot be implement

40、ed. a) A claimant authenticating itself to a verifier shall share a common secret authentication key with that verifier, in which case the mechanisms of Clause 6 apply, or each entity shall share a secret authentication key with a common trusted third party, in which case the mechanisms of Clause 7

41、apply. Such keys shall be known to the involved parties prior to the commencement of any particular occurrence of an authentication mechanism. The method by which this is achieved is beyond the scope of this part of ISO/IEC 9798. Guidance on the management of shared secret keys is provided in ISO/IE

42、C 11770-1 and ISO/IEC 11770-2. b) If a trusted third party is involved, it shall be trusted by both the claimant and the verifier. c) The secret authentication key shared by a claimant and a verifier, or by an entity and a trusted third party, shall be known only to those two parties and, possibly,

43、to other entities which they both trust not to misuse the key, e.g. to masquerade as one of the parties. NOTE The encipherment algorithm and the key lifetime should be chosen so that it is computationally infeasible for a key to be deduced during its lifetime. In addition, the key lifetime should be

44、 chosen to prevent known plaintext or chosen plaintext attacks. d) The tokens used in the mechanisms must be unforgeable even with the knowledge of old tokens. In other words, old tokens must not be reusable in any way (in part or in full) to construct new tokens. For every possible secret key K, th

45、e encipherment function eKand its corresponding decipherment function dKshall have the following property. The decipherment process dK, when applied to a string eK(X), shall enable the recipient of that string to detect forged or manipulated data, i.e. only the possessor of the secret key K shall be

46、 capable of generating strings which will be accepted when subjected to the decipherment process dK. NOTE In practice, this can be achieved in many ways. The recommended approach is to use the secret key K with an authenticated encryption technique that provides both confidentiality and integrity pr

47、otection, as standardised in ISO/IEC 19772. e) The mechanisms in this part of ISO/IEC 9798 require the use of time variant parameters such as time stamps, sequence numbers or random numbers. The properties of these parameters, in particular that it is most unlikely for them to repeat within the life

48、time of a secret authentication key, are important for the security of these mechanisms. For additional information see Annex B of ISO/IEC 9798-1:1997. 6 Mechanisms not involving a trusted third party In these authentication mechanisms the entities A and B shall share a common secret authentication

49、key KABor two unidirectional secret keys KABand KBAprior to the commencement of any particular occurrence of the authentication mechanisms. In the latter case the unidirectional keys KABand KBA are used respectively for the authentication of A by B and of B by A. All text fields specified in the following mechanisms are available for use in applications outside the scope of this part of ISO/IEC 9798 (they