1、BRITISH STANDARD BS ISO/IEC 11770-2:2008 Information technology Security techniques Key management Part 2: Mechanisms using symmetric techniques ICS 35.040 Incorporating corrigendum September 2009National foreword This British Standard is the UK implementation of ISO/IEC 11770-2:2008, incorporating
2、corrigendum September 2009. The start and finish of text introduced or altered by corrigendum is indicated in the text by tags. Text altered by ISO/IEC corrigendum September 2009 is indicated in the text by . The UK participation in its preparation was entrusted to Technical Committee IST/33, IT Sec
3、urity techniques. A list of organizations represented on this committee can be obtained on request to its secretary. This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. Compliance with a British Standard cannot c
4、onfer immunity from legal obligations. BS ISO/IEC 11770-2:2008 This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 July 2008 BSI 2010 Amendments/corrigenda issued since publication Date Comments 31 August 2010 Implementation of ISO/IEC corrige
5、ndum September 2009 ISBN 978 0 580 68076 2 Reference number ISO/IEC 11770-2:2008(E)INTERNATIONAL STANDARD ISO/IEC 11770-2 Second edition 2008-06-15 Information technology Security techniques Key management Part 2: Mechanisms using symmetric techniquesii iii Contents Page Foreword iv 1 Scope . 1 2 No
6、rmative references . 1 3 Terms and definitions. 2 4 Symbols and abbreviated terms . 3 5 Requirements 4 6 Point-to-point key establishment 5 6.1 Key Establishment Mechanism 1 5 6.2 Key Establishment Mechanism 2 5 6.3 Key Establishment Mechanism 3 6 6.4 Key Establishment Mechanism 4 7 6.5 Key Establis
7、hment Mechanism 5 7 6.6 Key Establishment Mechanism 6 8 7 Mechanisms using a Key Distribution Centre . 9 7.1 Key Establishment Mechanism 7 10 7.2 Key Establishment Mechanism 8 11 7.3 Key Establishment Mechanism 9 12 7.4 Key Establishment Mechanism 10 14 8 Mechanisms using a Key Translation Centre 15
8、 8.1 Key Establishment Mechanism 11 16 8.2 Key Establishment Mechanism 12 16 8.3 Key Establishment Mechanism 13 18 Annex A (normative) ASN.1 module. 21 Annex B (informative) Properties of key establishment mechanisms 23 Annex C (informative) Auxiliary techniques 25 Bibliography . 27 BS ISO/IEC 11770
9、-2:2008 ISO/IEC 11770-2:2008 (E)iv Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of Int
10、ernational Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liais
11、on with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint techn
12、ical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. Attention is d
13、rawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. ISO/IEC 11770-2 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommitt
14、ee SC 27, IT Security techniques. This second edition cancels and replaces the first edition (ISO/IEC 11770-2:1996), which has been technically revised. It also incorporates the Technical Corrigendum ISO/IEC 11770-2:1996/Cor.1:2005. ISO/IEC 11770 consists of the following parts, under the general ti
15、tle Information technology Security techniques Key management: Part 1: Framework Part 2: Mechanisms using symmetric techniques Part 3: Mechanisms using asymmetric techniques Part 4: Mechanisms based on weak secrets BS ISO/IEC 11770-2:2008 ISO/IEC 11770-2:2008 (E)1 Information technology Security tec
16、hniques Key management Part 2: Mechanisms using symmetric techniques 1 Scope The purpose of key management is to provide procedures for handling cryptographic keying material to be used in symmetric or asymmetric cryptographic algorithms according to the security policy in force. This part of ISO/IE
17、C 11770 defines key establishment mechanisms using symmetric cryptographic techniques. Key establishment mechanisms using symmetric cryptographic techniques can be derived from the entity authentication mechanisms of ISO/IEC 9798-2 and ISO/IEC 9798-4 by specifying the use of text fields available in
18、 those mechanisms. Other key establishment mechanisms exist for specific environments; see, for example, ISO 8732. Besides key establishment, the goals of such a mechanism might include unilateral or mutual authentication of the communicating entities. Further goals might be the verification of the
19、integrity of the established key, or key confirmation. This part of ISO/IEC 11770 addresses three environments for the establishment of keys: Point-to-Point, Key Distribution Centre (KDC), and Key Translation Centre (KTC). This part of ISO/IEC 11770 describes the required content of messages which c
20、arry keying material or are necessary to set up the conditions under which the keying material can be established. It does not indicate other information which can be contained in the messages or specify other messages such as error messages. The explicit format of messages is not within the scope o
21、f this part of ISO/IEC 11770. This part of ISO/IEC 11770 does not specify the means to be used to establish initial secret keys; that is, all the mechanisms specified in this part of ISO/IEC 11770 require an entity to share a secret key with at least one other entity (e.g. a TTP). For general guidan
22、ce on the key lifecycle see ISO/IEC 11770-1. This part of ISO/IEC 11770 does not explicitly address the issue of interdomain key management. This part of ISO/IEC 11770 also does not define the implementation of key management mechanisms; products complying with this part of ISO/IEC 11770 might not b
23、e compatible. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 1177
24、0-1, Information technology Security techniques Key management Part 1: Framework BS ISO/IEC 11770-2:2008 ISO/IEC 11770-2:2008 (E)2 3 Terms and definitions For the purposes of this document, the terms and definitions given in ISO/IEC 11770-1 and the following apply. 3.1 distinguishing identifier info
25、rmation which unambiguously distinguishes an entity 3.2 entity authentication corroboration that an entity is the one claimed ISO/IEC 9798-1 3.3 explicit key authentication from entity A to entity B assurance for entity B that entity A is the only other entity that is in possession of the correct ke
26、y ISO/IEC 11770-3 NOTE Implicit key authentication from A to B and key confirmation from A to B together imply explicit key authentication from A to B. 3.4 implicit key authentication from entity A to entity B assurance for entity B that entity A is the only other entity that can possibly be in poss
27、ession of the correct key ISO/IEC 11770-3 3.5 key confirmation from entity A to entity B assurance for entity B that entity A is in possession of the correct key ISO/IEC 11770-3 3.6 key control ability to choose the key, or the parameters used in the key computation 3.7 key generating function funct
28、ion which takes as input a number of parameters, at least one of which shall be secret, and which gives as output keys appropriate for the intended algorithm and application, and which has the property that it is computationally infeasible to deduce the output without prior knowledge of the secret i
29、nput 3.8 point-to-point key establishment direct establishment of keys between entities, without involving a third party 3.9 random number time variant parameter whose value is unpredictable 3.10 redundancy information that is known and can be checked BS ISO/IEC 11770-2:2008 ISO/IEC 11770-2:2008 (E)
30、3 3.11 sequence number time variant parameter whose value is taken from a specified sequence which is non-repeating within a certain time period 3.12 time variant parameter data item used to verify that a message is not a replay, such as a random number, sequence number, or a time stamp 4 Symbols an
31、d abbreviated terms d K (Z) result of decrypting data Z with a symmetric encryption algorithm using the secret key K e K (Z) result of encrypting data Z with a symmetric encryption algorithm using the secret key K f key generating function F keying material F Xkeying material originated by entity X
32、I Xthe distinguishing identifier of entity X KDC Key Distribution Centre KTC Key Translation Centre K XYsecret key associated with entities X and Y MAC Message Authentication Code MAC K (Z) result of applying a MAC function to data Z using the secret key K P Key Distribution Centre or Key Translatio
33、n Centre R random number R Xrandom number issued by entity X T/N time stamp or sequence number TVP Time Variant Parameter TVP XTime Variant Parameter issued by entity X T X /N Xtime stamp or sequence number issued by entity X X|Y The fields Text1, Text2, , specified in the mechanisms can contain opt
34、ional data for use in applications outside the scope of this part of ISO/IEC 11770 (they can be empty). Their relationship and contents depend upon the specific application. One such possible application is message authentication (see Annex C for an example). The result of the concatenation of data
35、items X and Y in the order specified. In cases where the result of concatenating two or more data items is encrypted as part of one of the mechanisms specified in this part of ISO/IEC 11770, this result shall be composed so that it can be uniquely resolved into its constituent data strings, i.e. so
36、that there is no possibility of ambiguity in interpretation. This latter property could be achieved in a variety of different ways, depending on the application. For example, it could be guaranteed by (a) fixing the length of each of the substrings throughout the domain of use of the mechanism, or (
37、b) encoding the sequence of concatenated strings using a method that guarantees unique decoding, e.g. using the distinguished encoding rules defined in ISO/IEC 8825-1 12. BS ISO/IEC 11770-2:2008 ISO/IEC 11770-2:2008 (E)4 5 Requirements The key establishment mechanisms specified in this part of ISO/I
38、EC 11770 make use of symmetric cryptographic techniques, more specifically, symmetric encryption algorithms, MACs, and/or key generating functions. The cryptographic algorithms and the key life-time shall be chosen such that it is computationally infeasible for a key to be deduced during its lifetim
39、e. If the following additional requirements are not met, the key establishment process may be compromised. a) For those mechanisms making use of a symmetric encryption algorithm, either assumption 1) or assumption 2) is required. 1) The encryption algorithm, its mode of operation, and the redundancy
40、 in the plaintext shall provide the recipient with the means to detect forged or manipulated data. 2) The integrity of the encrypted data shall be ensured by a MAC. Choices for encryption and integrity algorithms should be in accordance with the following. i) Assumption 1) above can be guaranteed if
41、 an authenticated encryption technique is used; use of one of the techniques standardized in ISO/IEC 19772 is recommended. ii) The choice for a symmetric encryption algorithm should be chosen from amongst those standardized in ISO/IEC 18033-3 and ISO/IEC 18033-4. iii) If a block cipher encryption al
42、gorithm is used, then the mode of operation employed should be one of those standardized in ISO/IEC 10116. iv) If a MAC is used, then the techniques shall be chosen from amongst those standardized in ISO/IEC 9797. NOTE 1 When a KDC or KTC is involved, assumptions 1) and 2) are not always equivalent
43、in terms of the ability to unambiguously detect on which link an active attack is being performed. See Annex C for examples. b) In each exchange specified in the mechanisms of clauses 6, 7 and 8, the recipient of a message shall know the claimed identity of the originator. If this is not the case, i
44、.e. if the context of use of the mechanism does not establish the claimed identity, then this could, for example, be achieved by the inclusion of identifiers in additional plaintext text fields of one or more of the messages. NOTE 2 The specifications of many of the mechanisms in this part of ISO/IE
45、C 11770 require the correctness of an identifier included in a message to be checked. This shall be done by comparing the received identifier with the expected identifier (as specified in the mechanism concerned). If the identifier in question is that of the originator of the message, then the recip
46、ient shall know the value of the expected identifier because of requirement b) above. c) Keying material may be established using either secure or insecure communication channels. When using only symmetric cryptographic techniques, at least the first key shall be exchanged between two entities using
47、 a secure channel in order to allow secure communications. d) The key establishment mechanisms in this part of ISO/IEC 11770 require the use of time variant parameters, such as time stamps, sequence numbers, or random numbers. In this context, the use of the term random number also includes unpredic
48、table pseudo-random numbers. The properties of these parameters, in particular that they are non-repeating, are important for the security of these mechanisms. For additional information on time variant parameters see Annex B of ISO/IEC 9798-1. For means of generating random numbers, see ISO/IEC 180
49、31. Likewise, optional plaintext text fields can be included as a prefix, or appended, to any of the messages. They have no security implications and are not explicitly included in the mechanisms specified in this part of ISO/IEC 11770. Data items that are optional in the mechanisms are shown in square brackets, thus. BS ISO/IEC 11770-2:2008 ISO/IEC 11770-2:2008 (E)5 6 Point-to-point key establishment Underlying every key management scheme is a point-to-point key e
