ISO/IEC 9798-1:1991

I NTERNAT I O NAL
ISOJIEC
STAN DAR D 9798-3
First edition
1993-1 1-15
O
Information technology - Security
techniques - Entity authentication
mechanisms -
Part 3:
Entity authentication using a public key
algorithm
Technologies de l'information - Techniques de sécurité -
Mécanismes d'authentification d'entité -
Partie 3: Authentification d'entité utilisant un algorithme à clé
publique
O
Reference number
ISO/IEC 9798-3: 1993(E)
ISO/IEC 9798-3:1993(E)
Foreword
IS0 (the International Organization for Standardization) and IEC (the Inter-
national Electrotechnical Commission) form the specialized system for worldwide
standardization. National bodies that are members of IS0 or IEC participate in
the development of International Standards through technical committees estab-
lished by the respective organization to deal with particular fields of technical
activity. IS0 and IEC technical committees collaborate in fields of mutual inter-
est. Other international organizations, governmental and non-governmental, in
liaison with IS0 and IEC, also take part in the work.
In the field of information technology, IS0 and IEC have established a joint
technical committee, ISOAEC JTC 1. Draft International Standards adopted by
the joint technical committee are circulated to national bodies for voting. Publi-
cation as an International Standard requires approval by at least 75 % of the na-
tional bodies casting a vote.
International Standard ISOAEC 9798-3 was prepared by Joint Technical Com-
mittee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Se-
curity techniques.
ISO/IEC 9798 consists of the following parts, under the general title Information
technology - Security techniques - Entity authentication mechanisms:
- Part 1: General model
- Part 2: Entity authentication using symmetric techniques
- Part 3: Entity authentication using a public key algorithm
Further parts may follow.
Annexes A, B, C and D of this part of ISOAEC 9798 are for information only.
Q ISO/IEC 1993
A11 rights reserved. Unless otherwise specified, no part of this publication may be
reproduced or utilized in any form or by any means, electronic or mechanical, including
photocopying and microfilm, without permission in writing from the publisher.
ISO/IEC Copyright Office Case postale 56 CH-1211 Genève 20 Switzcrland
Printed in Switzerland
Il
O lSO/iEC
INTERNATIONAL STANDARD ISO/IEC 9798-3:1993(E)
Information technology - Security techniques -
Entity authentication mechanisms -
Part 3: Entity authentication using a public key algorithm
3 Definitions and notation
1 Scope
For the purposes of this part of TSO/IEC 9798 the defini-
This part of ISO/TEC 9798 specifies entity authentica-
tions and notation described in ISO/IEC 9798-1 apply.
tion mechanisms using a public key algorithm. Two
a
mechanisms are concerned with the authentication of
single entity (unilateral authentication), while the re-
4 Requirements
maining are mechanisms for mutual authentication of
two entities. A digital signature is used to verify the
In the authentication mechanisms specified in this part
identity of an entity. A trusted third party may be in-
of ISO/IEC 0798 an entity to be authenticated corrob-
volved.
orates its identiy by demonstrating its knowledge of its
The mechanisms specified in this part of ISO/IEC 9798
secret signat,ure key. This is achieved by the entity us-
use time variant parameters such as time stamps, se-
ing its secret signature key to sign specific data. The
quence numbers, or random numbers, to prevent valid
signature can be verified hy anyone using the entity's
authentication information from being accepted at a
public verification key.
later time.
The authentication mechanisms have the following re-
If a time stamp or a sequence number is used, one pass quirements. If any of these is not met then the authen-
is needed for unilateral authentication, while two passes tication process may be compromised or it cannot be
are needed to achieve mutual authentication. If a chal- implemented.
lenge and response method employing random numbers
a) A verifier shall possess the valid public key of the
is used, two passes are needed for unilateral authen-
claimant.
tication, while three or four passes (depending on the
mechanism employed) are required to achieve mutual
b) A claimant, shall have a secret signature key known
a authentication.
and used only by itself.
NOTE - One way of obtaining a valid public key is by
2 Normative reference
means of a certificate (see annex B). The generation,
distribii tion, and revocation of certificates are outside
The following standard contains provisions which,
scope of this part of ISO/IEC 9798. There may exist
the
through reference in this text, constitute provisions of a trusted third party for this purpose. Another way of
this part of ISO/IEC 9798. At the time of publica- obtaining a valid public key is by trusted courier.
tion, the edition indicated was valid. All standards are
subject to revision, and parties to agreements based on
5 Mechanisms
this part of ISO/IEC 9798 are encouraged to investi-
gate the possibility of applying the most recent edition
of the standard indicated below. Members of IEC and
The specified ent,ity authentication mechanisms make
IS0 maintain registers of currently valid International use of time variant parameters such as time stamps, se-
Standards. quence numbers or random numbers (see annex c).
In this part of ISO/IEC 9798, given a token defined as
ISO/TEC 9798-1: 1001, Information technology - Se-
curity techniques - Entity aufhentication mechanisms -
Pari 1: General model.
@ ISO/IEC
ISO/IEC 9798-3: 1993 (E)
TokenAB is necessary to prevent the token from being
the “signed data” refers to ‘‘Yl(1 .II%” used as input
accepted by anyone other than the intended verifier.
to the signature scheme and the “unsigned data” refers
to “xl I I . . . I 1~~77.
2 In general, Text2 is not authenticated by this pro-
cess.
If information contained in the signed data of the token
3 One application of this mechanism could be key dis-
can be recovered from the signature, then it need not
tribution (see annex A).
be contained in the unsigned data of the token (see, for
example, ISO/IEC 9796).
(1) A sends TokenAB and, optionally, its certificate to
If information in the signed data of the token (e. g., a
B.
random number) is already known to the verifier, then it
need not be contained in the unsigned data of the token (2) On receipt of the message containing TokenAB, B
sent by the claimant. performs the following steps:
All text fields specified in the following mechanisms are (i) It ensures that it is in possession of a valid
public key of A either by verifying the certifi-
available for use in applications outside the scope of this
part of ISO/IEC 9798 (they may be empty). Their re- cate of A or by some other means.
lationship and contents depend upon the specific appli-
(ii) It verifies TokenAB by checking the time
cation. See annex A for information on the use of text
stamp or the sequence number, by verifying
fields.
e
the signature of A contained in the token and
by checking that the value of the identifier field
NOTE - As the distribution of certificates is outside
(B) in the signed data of TokenAB is equal to
the scope of this part of ISO/IEC 9798, the sending of
entity R’s distinguishing identifier.
certificates is optional in all mechanisms.
5.1 Unilateral authentication
Unilateral authentication means that only one of the
two entities is authenticated by use of the mechanism.
5.1.1 One pass authentication
In this authentication mechanism the claimant A initi-
ates the process and is authenticated by the verifier B.
Uniqueness / timeliness is controlled by generating and
- (1) RgIITextl
checking a time stamp or a sequence number (see annex
A c B (3)
(2) Cert AllTokenAB
Cl.
The authentication mechanism is illustrated in figure 1.
(1) Cert A I ITokenA B
B (2)
A c
Figure 1
The inclusion of the parameter B in TokenAB is op-
The form of the token (TokenAB), sent by the claimant
tional. It depends on the environment in which this
A to the verifier B is:
authentication mechanism is used.
NOTE - The random number RA is present in Token
AB to prevent R from obtaining the signature of A on
B prior to the start of the authenti-
where the claimant A uses either a sequence number data chosen by
cation mechanism. This prevention may be required,
NA or a time stamp TA as the time variant parameter.
for example, when the same key is used by A for other
The choice depends on the technical capabilities of the
purposes in addition to entity authentication.
claimant and the verifier as well as on the environment.
NOTES
(1) B sends a random number RB and, optionally, a
1 The inclusion of the identifier B in the signed dat,a of text field Text1 to A.
@ ISO/IEC ISO/IEC 9798-3: 1993 (E)
(2) A sends TokenAB and, optionally, its certificate to NOTE 1 - The inclusion of identifiers A and B in the
signed dat,a of TokenBA and TokenAB, respectively, is
B.
necessary to prevent the tokens from being accepted by
(3) On receipt of the message containing TokenAB, B anyone other than the intended verifier.
performs the following steps:
Steps (1) and (2) are identical to those specified in 5.1.1,
(i) It ensures that it is in possession of a valid
one pass authentication.
public key of A either by verifying the certifi-
cate of A or by some other means.
(3) B sends TokenBA and, optionally, its certificate to
(ii) It verifies TokenAB by checking the signature
A.
of A contained in the token and by checking
(4) The message in step (3) is handled in a manner
that the random number RB, sent to A in step
analogous to step (2) of 5.1.1.
(l), agrees with the random number contained
in the signed data of TokenAB.
NOTE 2 - The two messages of this mechanism are
not bound together in any way, other than implicitly
by timeliness; the mechanism involves independent use
5.2 Mutual authentication
of mechanism 5.1.1 twice. If it is desired to bind these
messages further, appropriate use could be made of text
Mutual authentication means that the two communicat-
fields (see annex A).
0 ing entities are authenticated to each other by use of the
mechanism.
5.2.2 Three pass authentication
The two mechanisms described in 5.1.1 and 5.1.2 are
In this authent,ication mechanism uniqueness / timeli-
extended in 5.2.1 and 5.2.2, respectively, to achieve mu-
ness is controlled by generating and checking random
tual authentication. This is done by transmitting one
numbers (see annex C).
further message resulting in two additional steps.
The authenticatmion mechanism is illustrated in figure 4.
(1) RsllTextl
2) CertAllTokenAB
(5) A B (3)
Figure 4
The tokens are of the following form:
c
(4) A 4 B (2)
The inclusion of t4he parameter B in TokenAB and the
(3) CertBllTokenBA
inclusion of t,he parameter A in TokenBA are optional.
They depend on the environment in which this authen-
tication mechanism is used.
NOTE - The random number RA is present in
TokenAB to prevent B from obtaining the signature
of A on data chosen by B prior to the start of the au-
thentication mechanism. This prevention may be re-
quired, for example, when the same key is used by A
The form of the token (TokenBA), sent by B to A, is:
for other piirposes in addition to entity authentication.
For similar reasons the random number RB is present
in TokenBA. Furthermore, checking that this random
number is the same as the random number in the first
message is necessary for security considerations.
The choice of using either time stamps or sequence num-
bers in this mechanism depends on the technical capa-
(1) B sends a random number RB and, optionally, a
bilities of the claimant and the verifier as well as on the
environment. text field Text1 to A.
@ TSO/IEC
ISO/IEC 9798-3: 1993 (E)
The inclusion of the parameter B in TokenAB and the
(2) A sends TokenAB and, optionally, its certificate to
B. inclusion of the parameter A in TokenBA are optional.
They depend on the environment in which this authen-
(3) On receipt of the message containing TokenAB, B
tication mechanism is used.
performs the following steps:
NOTE 1 - The random number RA is present in
a valid
(i) It ensures that it is in possession of
TokenAB to prevent B from obtaining the signature
...