ISO/IEC 9797:1994

INTERNATIONAL
lSO/IEC
STANDARD
9797
Second edition
1994-04-l 5
Information technology - Security
techniques - Data integrity mechanism
using a cryptographic check function
employing a block cipher algorithm
Technologies de I’information - Techniques de s&wit6 - Mkanisme
d’int6grit6 des donndes utilisant une fonction de conWe ctyptographique
emplo yant un algorithme de chiffrement par bloc
Reference number
ISO/I EC 9797: 1994(E)

---------------------- Page: 1 ----------------------
ISO/IEC 9797: 1994 (E)
Foreword
IS0 (the International Organization for Standardization) and IEC (the International Elec-
trotechnical Commission) form the specialized system for worldwide standardization. Na-
tional bodies that are members of IS0 or IEC participate in the development of Interna-
tional Standards through technical committees established by the respective organization
to deal with particular fields of technical activity. IS0 and IEC technical committees col-
laborate in fields of mutual interest. Other international organizations, governmental and
non-governmental, in liaison with IS0 and IEC, also take part in the work.
In the field of information technology, IS0 and IEC have established a joint technical com-
mittee, ISO/IEC JTC 1. Draft International Standards adopted by the joint technical
committee are circulated to national bodies for voting. Publication as an International
Standard requires approval by at least 75% of the national bodies casting a vote.
International Standard ISO/IEC 9797 was prepared by Joint Technical Committee ISO/IEC
JTC 1, Information technology, Sub-Committee SC27, IT Security techniques.
This second edition cancels and replaces the first edition (ISO/IEC 9797: 1989) which has
been revised and extended to include an additional padding method, an additional method
for the optional process as well as a new annex containing examples.
Annex A forms an integral part of this International Standard. Annexes B and C are for
information only.
0 ISO/IEC 1994
All rights reserved. Unless otherwise specified, no part of this publication may be
reproduced or utilized in any form or by any means, electronic or mechanical, including
photocopying and microfilm, without permission in writing from the publisher.
ISO/IEC Copyright Office l Case postale 56 l CH-1211 Geneve 20 l Switzerland
Printed in Switzerland
11

---------------------- Page: 2 ----------------------
@ ISO/IEC
ISO/IEC 9797: 1994 (E)
Introduction
The mechanism specified in this International Standard is similar to that used in IS0 8731-1,
IS0 9807 and in the ANSI X9.9 standard, except that it is defined in terms of an algorithm
using n-bit data blocks and an m-bit check value, and that an additional padding method
is specified.
The calculation of cryptographic check values as described in IS0 8731-1, ANSI X9.9 and
ANSI X9.19 is a specific case of this International Standard when 12 = 64 and m = 32, when
padding method 1 specified in 5.1 is used, and when DEA (see ANSI X3.92: 1981) is used.
. . .
111

---------------------- Page: 3 ----------------------
This page intentionally left blank

---------------------- Page: 4 ----------------------
ISO/IEC 9797: 1994 (E)
INTERNATIONAL STANDARD @ lSo’JEC
Information technology - Security techniques - Data integrity
mechanism using a cryptographic check function employing a
block cipher algorithm
1 Scope 3.1.1 cryptographic check value: Information which
is derived by performing a cryptographic transformation
on the data unit.
This International Standard specifies a method of using
a key and an n-bit block cipher algorithm to calculate an
3.1.2 data integrity: The property that data has not
m-bit cryptographic check value. This method can be
been altered or destroyed in an unauthorized manner.
used as a data integrity mechanism to detect that data
has not been altered in an unauthorised manner. The
3.1.3 n-bit block cipher algorithm: A block cipher
strength of the data integrity mechanism is dependent
algorithm with the property that plaintext blocks and
on the key length and its secrecy, on the nature of the
ciphertext blocks are n bits in length.
cryptographic algorithm, and on m., the length of the
check value.
3.2 Notation
This International Standard can be applied to the se-
This International Standard refers to the cryptographic
curity services of any security architecture, process, or
check value as a Message Authentication Code (MAC).
application.
In contexts where the terms “most significant bit/byte”
and “least significant bit/byte” have a meaning, e.g.,
2 Normative references
where strings of bits are treated as numerical values,
then the leftmost bits of a block shall be the most sig-
The following standards contain provisions which,
nificant.
through reference in this text, constitute provisions of
this International Standard. At the time of publica-
4 Requirements
tion, the editions indicated were valid. All standards
are subject to revision, and parties to agreements based
The length (m) of the MAC will be less than or equal to
on this International Standard are encouraged to investi-
the block length (n). The result of the calculation and
gate the possibility of applying the most recent editions
of any optional process is an information block of length
of the standards indicated below. Members of IEC and
n. The m. leftmost bits of the final n-bit block form the
IS0 maintain registers of currently valid International
MAC.
Standards.
IS0 7498-2: 1989, Information processing systems -
5 MAC calculation
Open Systems Interconnection - Basic Reference Model
- Part 2: Security Architecture.
5.1 Padding and blocking
ISO/IEC 10116: 1991, Information technology - Modes
of operation for an n-bit block cipher algorithm. The generation of a MAC requires the selection of one of
two padding methods. The way in which the selection is
made is beyond the scope of this International Standard.
3 Definitions and notation
Method 1
The data for which the MAC is to be calculated shall
3.1 Definitions
be appended with as few (possibly none) ‘0’ bits as nec-
essary to obtain a data string whose length (in bits) is
This International Standard makes use of the following
an integer multiple of n.
terms defined in IS0 7498-2 and ISO/IEC 10116.
1

---------------------- Page: 5 ----------------------
@ ISO/IEC
ISO/IEC 9797: 1994 (E)
5.4 Subsequent stages
Method 2
The data for which the MAC is to be calculated shall be
The next n bits of data (Dz) are bitwise exclusive or’ed
appended with a single ‘1’ bit. The resulting data shall
with the n bits of the output register (01) and the result
then be appended with as few (possibly none) ‘0’ bits as
is loaded into the input register of the next stage (12).
necessary to obtain a data string whose length (in bits)
The contents of the input register (12) is passed through
is an integer multiple of 72.
the algorithm (A), which uses the key (I<) to produce
n bits in the output register (02).
NOTE - If the length of data is not known by a verifier
then padding method 2 should be used, since it permits
This operation continues until all blocks have been pro-
a verifier to detect the addition or deletion of trailing
cessed. The result will be the final output block (0,).
‘0' bits.
5.5 Optional Process
The resulting data is divided into n-bit blocks (Dr , 02,
l . l , Dp). The bits which are padded to the original data,
The final output block (0,) may be subjected to op-
according to the chosen padding method, are only used
tional processing to increase the strength of the MAC.
for calculating and verifying the MAC. Consequently,
The optional process (if used) shall be selected from
the padding bits (if any) need not be stored or trans-
those specified in normative annex A.
mitted with the data. The verifier shall know whether
or not the padding bits have been stored or transmitted,
5.6 The MAC
and which padding method is in use.
The nz leftmost bits of the final n-bit block form the
5.2 The cryptographic key
MAC.
The key should be randomly or pseudo-randomly gener-
NOTE - Use of the optional process specified in A.1
ated. If the same algorithm is used for encipherment of
of annex A reduces the threat of exhaustive search at-
the message, the key used for the
...