1、INCITS/ISO/IEC 11770-4:20062008(ISO/IEC 11770-4:2006, IDT) Information technology Security techniques Key management Part 4: Mechanisms based on weak secretsINCITS/ISO/IEC 11770-4:20062008(ISO/IEC 11770-4:2006, IDT)INCITS/ISO/IEC 11770-4:20062008 ii ITIC 2008 All rights reserved PDF disclaimer This
2、PDF file may contain embedded typefaces. In accordance with Adobes licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept there
3、in the responsibility of not infringing Adobes licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the
4、 PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. Adopted by INCITS (InterNa
5、tional Committee for Information Technology Standards) as an American National Standard. Date of ANSI Approval: 7/2/2008 Published by American National Standards Institute, 25 West 43rd Street, New York, New York 10036 Copyright 2008 by Information Technology Industry Council (ITI). All rights reser
6、ved. These materials are subject to copyright claims of International Standardization Organization (ISO), International Electrotechnical Commission (IEC), American National Standards Institute (ANSI), and Information Technology Industry Council (ITI). Not for resale. No part of this publication may
7、be reproduced in any form, including an electronic retrieval system, without the prior written permission of ITI. All requests pertaining to this standard should be submitted to ITI, 1250 Eye Street NW, Washington, DC 20005. Printed in the United States of America INCITS/ISO/IEC 11770-4:20062008 ITI
8、C 2008 All rights reserved iii Contents Page Foreword iv 1 Scope . 1 2 Normative references 2 3 Terms and definitions . 2 4 Symbols and notation . 6 5 Requirements 8 6 Password-authenticated key agreement 9 6.1 Key Agreement Mechanism 1 10 6.1.1 Prior shared parameters 10 6.1.2 Functions 10 6.1.3 Ke
9、y agreement operation . 12 6.2 Key Agreement Mechanism 2 13 6.2.1 Prior shared parameters 14 6.2.2 Functions 14 6.2.3 Key agreement operation . 16 6.3 Key Agreement Mechanism 3 17 6.3.1 Prior shared parameters 17 6.3.2 Functions 17 6.3.3 Key agreement operation . 20 7 Password-authenticated key retr
10、ieval 21 7.1 Key Retrieval Mechanism 1 22 7.1.1 Prior shared parameters 22 7.1.2 Functions 22 7.1.3 Key retrieval operation . 23 Annex A (normative) Functions for Data Type Conversion 24 Annex B (normative) ASN.1 Module . 28 Annex C (informative) Guidance on Choice of Parameters 30 Bibliography 32 I
11、NCITS/ISO/IEC 11770-4:20062008 iv ITIC 2008 All rights reserved Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC particip
12、ate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental a
13、nd non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The
14、 main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies c
15、asting a vote. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. ISO/IEC 11770-4 was prepared by Joint Technical Committee ISO/IEC JTC 1, Subco
16、mmittee SC 27, IT Security techniques. ISO/IEC 11770 consists of the following parts, under the general title Information technology Security techniques Key management: Part 1: Framework Part 2: Mechanisms using symmetric techniques Part 3: Mechanisms using asymmetric techniques Part 4: Mechanisms b
17、ased on weak secrets Further parts may follow. AMERICAN NATIONAL STANDARD INCITS/ISO/IEC 11770-4:20062008 ITIC 2008 All rights reserved 1 Information technology Security techniques Key management Part 4: Mechanisms based on weak secrets 1 Scope This part of ISO/IEC 11770 defines key establishment me
18、chanisms based on weak secrets, i.e., secrets that can be readily memorized by a human, and hence secrets that will be chosen from a relatively small set of possibilities. It specifies cryptographic techniques specifically designed to establish one or more secret keys based on a weak secret derived
19、from a memorized password, while preventing off-line brute-force attacks associated with the weak secret. More specifically, these mechanisms are designed to achieve one of the following three goals. 1) Balanced password-authenticated key agreement: Establish one or more shared secret keys between t
20、wo entities that share a common weak secret. In a balanced password-authenticated key agreement mechanism, the shared secret keys are the result of a data exchange between the two entities, the shared secret keys are established if and only if the two entities have used the same weak secret, and nei
21、ther of the two entities can predetermine the values of the shared secret keys. 2) Augmented password-authenticated key agreement: Establish one or more shared secret keys between two entities A and B, where A has a weak secret and B has verification data derived from a one-way function of As weak s
22、ecret. In an augmented password-authenticated key agreement mechanism, the shared secret keys are the result of a data exchange between the two entities, the shared secret keys are established if and only if the two entities have used the weak secret and the corresponding verification data, and neit
23、her of the two entities can predetermine the values of the shared secret keys. NOTE This type of key agreement mechanism is unable to protect As weak secret being discovered by B, but only increases the cost for an adversary to get As weak secret from B. Therefore it is normally used between a clien
24、t (A) and a server (B). 3) Password-authenticated key retrieval: Establish one or more secret keys for an entity, A, associated with another entity, B, where A has a weak secret and B has a strong secret associated with As weak secret. In an authenticated key retrieval mechanism, the secret keys, re
25、trievable by A (not necessarily derivable by B), are the result of a data exchange between the two entities, and the secret keys are established if and only if the two entities have used the weak secret and the associated strong secret. However, although Bs strong secret is associated with As weak s
26、ecret, the strong secret does not (in itself) contain sufficient information to permit either the weak secret or the secret keys established in the mechanism to be determined. NOTE This type of key retrieval mechanism is used in those applications where A does not have secure storage for a strong se
27、cret, and requires Bs assistance to retrieve the strong secret for her. It is normally used between a client (A) and a server (B). This part of ISO/IEC 11770 does not cover aspects of key management such as lifecycle management of weak secrets, strong secrets and established secret keys; mechanisms
28、to store, archive, delete, destroy, etc. weak secrets, strong secrets, and established secret keys. INCITS/ISO/IEC 11770-4:20062008 2 ITIC 2008 All rights reserved NOTE The keys generated or retrieved through the use of weak secrets cannot be more secure against exhaustion than the sum of the weak s
29、ecrets themselves. With this proviso, the mechanisms specified in this part of ISO/IEC 11770 are recommended for practical use in low-security environments. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only th
30、e edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 10118-3:2004, Information technology Security techniques Hash-functions Part 3: Dedicated hash-functions ISO/IEC 11770-1:1996, Information technology Security te
31、chniques Key management Part 1: Framework 3 Terms and definitions For the purposes of this document, the following terms and definitions apply. 3.1 augmented password-authenticated key agreement password-authenticated key agreement where entity A uses a password-based weak secret and entity B uses v
32、erification data derived from a one-way function of As weak secret to negotiate and authenticate one or more shared secret keys 3.2 balanced password-authenticated key agreement password-authenticated key agreement where two entities A and B use a shared common password-based weak secret to negotiat
33、e and authenticate one or more shared secret keys 3.3 brute-force attack attack on a cryptosystem that employs an exhaustive search of a set of keys, passwords or other data 3.4 collision-resistant hash-function hash-function satisfying the following property: it is computationally infeasible to fin
34、d any two distinct inputs which map to the same output NOTE Computational feasibility depends on the specific security requirements and environment. ISO/IEC 10118-1:2000 3.5 dictionary attack (on a password-based system) attack on a cryptosystem that employs a search of a given list of passwords NOT
35、E A dictionary attack on a password-based system can use a stored list of specific password values or a stored list of words from a natural language dictionary. 3.6 domain parameter data item which is common to and known by or accessible to all entities within the domain NOTE The set of domain param
36、eters may contain data items such as hash-function identifier, length of the hash-token, length of the recoverable part of the message, finite field parameters, elliptic curve parameters, or other parameters specifying the security policy in the domain. ISO/IEC 9796-3:2000 INCITS/ISO/IEC 11770-4:200
37、62008 ITIC 2008 All rights reserved 3 3.7 explicit key authentication from A to B assurance for entity B that A is the only other entity that is in possession of the correct key NOTE - Implicit key authentication from A to B and key confirmation from A to B together imply explicit key authentication
38、 from A to B. ISO/IEC 11770-3:1999 3.8 hash-function function which maps strings of bits to fixed-length strings of bits, satisfying the following two properties. It is computationally infeasible to find for a given output, an input which maps to this output. It is computationally infeasible to find
39、 for a given input, a second input which maps to the same output. NOTE Computational feasibility depends on the specific security requirements and environment. ISO/IEC 10118-1:2000 3.9 hashed password result of applying a hash-function to a password 3.10 implicit key authentication from A to B assur
40、ance for entity B that A is the only other entity that can possibly be in possession of the correct key ISO/IEC 11770-3:1999 3.11 key sequence of symbols that controls the operation of a cryptographic transformation (e.g. encipherment, decipherment, cryptographic check function computation, signatur
41、e calculation, or signature verification) ISO/IEC 11770-3:1999 3.12 key agreement process of establishing a shared secret key between entities in such a way that neither of them can predetermine the value of that key ISO/IEC 11770-1:1996 3.13 key confirmation from A to B assurance for entity B that
42、entity A is in possession of the correct key ISO/IEC 11770-3:1999 3.14 key control ability to choose the key, or the parameters used in the key computation ISO/IEC 11770-1:1996 3.15 key derivation function function that utilizes shared secrets and other mutually known parameters as inputs, and outpu
43、ts one or more shared secrets, which can be used as keys INCITS/ISO/IEC 11770-4:20062008 4 ITIC 2008 All rights reserved 3.16 key establishment process of making available a shared secret key to one or more entities; key establishment includes key agreement, key transport and key retrieval 3.17 key
44、management administration and use of the generation, registration, certification, deregistration, distribution, installation, storage, archiving, revocation, derivation and destruction of keying material in accordance with a security policy ISO/IEC 11770-1:1996 3.18 key retrieval process of establis
45、hing a key for one or more entities known as the retrieving entities with the involvement of one or more other entities who are not necessarily able to access the key after the process, and which normally requires authentication of the retrieving entity/entities by the other entity/entities 3.19 key
46、 token key establishment message sent from one entity to another entity during the execution of a key establishment mechanism 3.20 key token check function function that utilizes a key token and other publicly known parameters as input, and outputs a Boolean value during the execution of a key estab
47、lishment mechanism 3.21 key token factor value that is kept secret and that is used, possibly in conjunction with a weak secret, to create a key token 3.22 key token generation function function that utilizes a key token factor and other parameters as input, and outputs a key token during the execut
48、ion of a key establishment mechanism 3.23 mutual key authentication assurance for two entities that only the other entity can possibly be in possession of the correct key 3.24 one-way function function with the property that it is easy to compute the output for a given input but it is computationall
49、y infeasible to find for a given output an input which maps to this output ISO/IEC 11770-3:1999 3.25 password secret word, phrase, number or character sequence used for entity authentication, which is a memorized weak secret 3.26 password-authenticated key agreement process of establishing one or more shared secret keys between two entities using prior shared password-based information (which means that either both of them have the same shared password or one h
