ISO/IEC 9798-2:2008 信息技术 安全技术 实体鉴别 第2部分：采用对称加密算法的机制

标准编号：ISO/IEC 9798-2:2008

中文名称：信息技术 安全技术 实体鉴别 第2部分：采用对称加密算法的机制

英文名称：Information technology — Security techniques — Entity authentication — Part 2: Mechanisms using symmetric encipherment algorithms

发布日期：2008-12

标准范围

ISO/IEC 9798-2:20 08规定了使用对称加密算法的实体认证机制。其中四种机制提供不涉及可信第三方的两个实体之间的实体认证；其中两个是向另一个实体单方面认证一个实体的机制，而另外两个是用于两个实体相互认证的机制。其余机制需要可信第三方来建立公共密钥，并实现相互或单方面的实体认证。ISO/IEC 9798-2:20 08中规定的机制使用诸如时间戳、序列号或随机数的时变参数来防止在稍后时间或不止一次地接受有效的认证信息。如果不涉及可信第三方，使用时间戳或序列号，则需要通过一次才能实现单边认证，而实现相互认证则需要通过两次。如果不涉及可信第三方，并且使用采用随机数的质询和响应方法，则需要两次通过进行单边认证，而需要三次通过来实现相互认证。如果涉及可信第三方，则实体和可信第三方之间的任何附加通信都需要在通信交换中进行两次额外的传递。

ISO/IEC 9798-2:2008 specifies entity authentication mechanisms using symmetric encipherment algorithms. Four of the mechanisms provide entity authentication between two entities where no trusted third party is involved; two of these are mechanisms to unilaterally authenticate one entity to another, while the other two are mechanisms for mutual authentication of two entities. The remaining mechanisms require a trusted third party for the establishment of a common secret key, and realize mutual or unilateral entity authentication.

The mechanisms specified in ISO/IEC 9798-2:2008 use time variant parameters such as time stamps, sequence numbers, or random numbers to prevent valid authentication information from being accepted at a later time or more than once.

If no trusted third party is involved and a time stamp or sequence number is used, one pass is needed for unilateral authentication, while two passes are needed to achieve mutual authentication. If no trusted third party is involved and a challenge and response method employing random numbers is used, two passes are needed for unilateral authentication, while three passes are required to achieve mutual authentication. If a trusted third party is involved, any additional communication between an entity and the trusted third party requires two extra passes in the communication exchange.

标准预览图