欢迎来到麦多课文档分享! | 帮助中心 海量文档,免费浏览,给你所需,享你所想!
麦多课文档分享
全部分类
  • 标准规范>
  • 教学课件>
  • 考试资料>
  • 办公文档>
  • 学术论文>
  • 行业资料>
  • 易语言源码>
  • ImageVerifierCode 换一换
    首页 麦多课文档分享 > 资源分类 > PDF文档下载
    分享到微信 分享到微博 分享到QQ空间

    BS ISO IEC 11770-2-2008 Information technology - Security techniques - Key management - Mechanisms using symmetric techniques《信息技术 安全技术 密钥管理 对称技术机制》.pdf

    • 资源ID:396251       资源大小:1,022KB        全文页数:34页
    • 资源格式: PDF        下载积分:5000积分
    快捷下载 游客一键下载
    账号登录下载
    微信登录下载
    二维码
    微信扫一扫登录
    下载资源需要5000积分(如需开发票,请勿充值!)
    邮箱/手机:
    温馨提示:
    如需开发票,请勿充值!快捷下载时,用户名和密码都是您填写的邮箱或者手机号,方便查询和重复下载(系统自动生成)。
    如需开发票,请勿充值!如填写123,账号就是123,密码也是123。
    支付方式: 支付宝扫码支付    微信扫码支付   
    验证码:   换一换

    加入VIP,交流精品资源
     
    账号:
    密码:
    验证码:   换一换
      忘记密码?
        
    友情提示
    2、PDF文件下载后,可能会被浏览器默认打开,此种情况可以点击浏览器菜单,保存网页到桌面,就可以正常下载了。
    3、本站不支持迅雷下载,请使用电脑自带的IE浏览器,或者360浏览器、谷歌浏览器下载即可。
    4、本站资源下载后的文档和图纸-无水印,预览文档经过压缩,下载后原文更清晰。
    5、试题试卷类文档,如果标题没有明确说明有答案则都视为没有答案,请知晓。

    BS ISO IEC 11770-2-2008 Information technology - Security techniques - Key management - Mechanisms using symmetric techniques《信息技术 安全技术 密钥管理 对称技术机制》.pdf

    1、BRITISH STANDARD BS ISO/IEC 11770-2:2008 Information technology Security techniques Key management Part 2: Mechanisms using symmetric techniques ICS 35.040 Incorporating corrigendum September 2009National foreword This British Standard is the UK implementation of ISO/IEC 11770-2:2008, incorporating

    2、corrigendum September 2009. The start and finish of text introduced or altered by corrigendum is indicated in the text by tags. Text altered by ISO/IEC corrigendum September 2009 is indicated in the text by . The UK participation in its preparation was entrusted to Technical Committee IST/33, IT Sec

    3、urity techniques. A list of organizations represented on this committee can be obtained on request to its secretary. This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. Compliance with a British Standard cannot c

    4、onfer immunity from legal obligations. BS ISO/IEC 11770-2:2008 This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 July 2008 BSI 2010 Amendments/corrigenda issued since publication Date Comments 31 August 2010 Implementation of ISO/IEC corrige

    5、ndum September 2009 ISBN 978 0 580 68076 2 Reference number ISO/IEC 11770-2:2008(E)INTERNATIONAL STANDARD ISO/IEC 11770-2 Second edition 2008-06-15 Information technology Security techniques Key management Part 2: Mechanisms using symmetric techniquesii iii Contents Page Foreword iv 1 Scope . 1 2 No

    6、rmative references . 1 3 Terms and definitions. 2 4 Symbols and abbreviated terms . 3 5 Requirements 4 6 Point-to-point key establishment 5 6.1 Key Establishment Mechanism 1 5 6.2 Key Establishment Mechanism 2 5 6.3 Key Establishment Mechanism 3 6 6.4 Key Establishment Mechanism 4 7 6.5 Key Establis

    7、hment Mechanism 5 7 6.6 Key Establishment Mechanism 6 8 7 Mechanisms using a Key Distribution Centre . 9 7.1 Key Establishment Mechanism 7 10 7.2 Key Establishment Mechanism 8 11 7.3 Key Establishment Mechanism 9 12 7.4 Key Establishment Mechanism 10 14 8 Mechanisms using a Key Translation Centre 15

    8、 8.1 Key Establishment Mechanism 11 16 8.2 Key Establishment Mechanism 12 16 8.3 Key Establishment Mechanism 13 18 Annex A (normative) ASN.1 module. 21 Annex B (informative) Properties of key establishment mechanisms 23 Annex C (informative) Auxiliary techniques 25 Bibliography . 27 BS ISO/IEC 11770

    9、-2:2008 ISO/IEC 11770-2:2008 (E)iv Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of Int

    10、ernational Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liais

    11、on with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint techn

    12、ical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. Attention is d

    13、rawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. ISO/IEC 11770-2 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommitt

    14、ee SC 27, IT Security techniques. This second edition cancels and replaces the first edition (ISO/IEC 11770-2:1996), which has been technically revised. It also incorporates the Technical Corrigendum ISO/IEC 11770-2:1996/Cor.1:2005. ISO/IEC 11770 consists of the following parts, under the general ti

    15、tle Information technology Security techniques Key management: Part 1: Framework Part 2: Mechanisms using symmetric techniques Part 3: Mechanisms using asymmetric techniques Part 4: Mechanisms based on weak secrets BS ISO/IEC 11770-2:2008 ISO/IEC 11770-2:2008 (E)1 Information technology Security tec

    16、hniques Key management Part 2: Mechanisms using symmetric techniques 1 Scope The purpose of key management is to provide procedures for handling cryptographic keying material to be used in symmetric or asymmetric cryptographic algorithms according to the security policy in force. This part of ISO/IE

    17、C 11770 defines key establishment mechanisms using symmetric cryptographic techniques. Key establishment mechanisms using symmetric cryptographic techniques can be derived from the entity authentication mechanisms of ISO/IEC 9798-2 and ISO/IEC 9798-4 by specifying the use of text fields available in

    18、 those mechanisms. Other key establishment mechanisms exist for specific environments; see, for example, ISO 8732. Besides key establishment, the goals of such a mechanism might include unilateral or mutual authentication of the communicating entities. Further goals might be the verification of the

    19、integrity of the established key, or key confirmation. This part of ISO/IEC 11770 addresses three environments for the establishment of keys: Point-to-Point, Key Distribution Centre (KDC), and Key Translation Centre (KTC). This part of ISO/IEC 11770 describes the required content of messages which c

    20、arry keying material or are necessary to set up the conditions under which the keying material can be established. It does not indicate other information which can be contained in the messages or specify other messages such as error messages. The explicit format of messages is not within the scope o

    21、f this part of ISO/IEC 11770. This part of ISO/IEC 11770 does not specify the means to be used to establish initial secret keys; that is, all the mechanisms specified in this part of ISO/IEC 11770 require an entity to share a secret key with at least one other entity (e.g. a TTP). For general guidan

    22、ce on the key lifecycle see ISO/IEC 11770-1. This part of ISO/IEC 11770 does not explicitly address the issue of interdomain key management. This part of ISO/IEC 11770 also does not define the implementation of key management mechanisms; products complying with this part of ISO/IEC 11770 might not b

    23、e compatible. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 1177

    24、0-1, Information technology Security techniques Key management Part 1: Framework BS ISO/IEC 11770-2:2008 ISO/IEC 11770-2:2008 (E)2 3 Terms and definitions For the purposes of this document, the terms and definitions given in ISO/IEC 11770-1 and the following apply. 3.1 distinguishing identifier info

    25、rmation which unambiguously distinguishes an entity 3.2 entity authentication corroboration that an entity is the one claimed ISO/IEC 9798-1 3.3 explicit key authentication from entity A to entity B assurance for entity B that entity A is the only other entity that is in possession of the correct ke

    26、y ISO/IEC 11770-3 NOTE Implicit key authentication from A to B and key confirmation from A to B together imply explicit key authentication from A to B. 3.4 implicit key authentication from entity A to entity B assurance for entity B that entity A is the only other entity that can possibly be in poss

    27、ession of the correct key ISO/IEC 11770-3 3.5 key confirmation from entity A to entity B assurance for entity B that entity A is in possession of the correct key ISO/IEC 11770-3 3.6 key control ability to choose the key, or the parameters used in the key computation 3.7 key generating function funct

    28、ion which takes as input a number of parameters, at least one of which shall be secret, and which gives as output keys appropriate for the intended algorithm and application, and which has the property that it is computationally infeasible to deduce the output without prior knowledge of the secret i

    29、nput 3.8 point-to-point key establishment direct establishment of keys between entities, without involving a third party 3.9 random number time variant parameter whose value is unpredictable 3.10 redundancy information that is known and can be checked BS ISO/IEC 11770-2:2008 ISO/IEC 11770-2:2008 (E)

    30、3 3.11 sequence number time variant parameter whose value is taken from a specified sequence which is non-repeating within a certain time period 3.12 time variant parameter data item used to verify that a message is not a replay, such as a random number, sequence number, or a time stamp 4 Symbols an

    31、d abbreviated terms d K (Z) result of decrypting data Z with a symmetric encryption algorithm using the secret key K e K (Z) result of encrypting data Z with a symmetric encryption algorithm using the secret key K f key generating function F keying material F Xkeying material originated by entity X

    32、I Xthe distinguishing identifier of entity X KDC Key Distribution Centre KTC Key Translation Centre K XYsecret key associated with entities X and Y MAC Message Authentication Code MAC K (Z) result of applying a MAC function to data Z using the secret key K P Key Distribution Centre or Key Translatio

    33、n Centre R random number R Xrandom number issued by entity X T/N time stamp or sequence number TVP Time Variant Parameter TVP XTime Variant Parameter issued by entity X T X /N Xtime stamp or sequence number issued by entity X X|Y The fields Text1, Text2, , specified in the mechanisms can contain opt

    34、ional data for use in applications outside the scope of this part of ISO/IEC 11770 (they can be empty). Their relationship and contents depend upon the specific application. One such possible application is message authentication (see Annex C for an example). The result of the concatenation of data

    35、items X and Y in the order specified. In cases where the result of concatenating two or more data items is encrypted as part of one of the mechanisms specified in this part of ISO/IEC 11770, this result shall be composed so that it can be uniquely resolved into its constituent data strings, i.e. so

    36、that there is no possibility of ambiguity in interpretation. This latter property could be achieved in a variety of different ways, depending on the application. For example, it could be guaranteed by (a) fixing the length of each of the substrings throughout the domain of use of the mechanism, or (

    37、b) encoding the sequence of concatenated strings using a method that guarantees unique decoding, e.g. using the distinguished encoding rules defined in ISO/IEC 8825-1 12. BS ISO/IEC 11770-2:2008 ISO/IEC 11770-2:2008 (E)4 5 Requirements The key establishment mechanisms specified in this part of ISO/I

    38、EC 11770 make use of symmetric cryptographic techniques, more specifically, symmetric encryption algorithms, MACs, and/or key generating functions. The cryptographic algorithms and the key life-time shall be chosen such that it is computationally infeasible for a key to be deduced during its lifetim

    39、e. If the following additional requirements are not met, the key establishment process may be compromised. a) For those mechanisms making use of a symmetric encryption algorithm, either assumption 1) or assumption 2) is required. 1) The encryption algorithm, its mode of operation, and the redundancy

    40、 in the plaintext shall provide the recipient with the means to detect forged or manipulated data. 2) The integrity of the encrypted data shall be ensured by a MAC. Choices for encryption and integrity algorithms should be in accordance with the following. i) Assumption 1) above can be guaranteed if

    41、 an authenticated encryption technique is used; use of one of the techniques standardized in ISO/IEC 19772 is recommended. ii) The choice for a symmetric encryption algorithm should be chosen from amongst those standardized in ISO/IEC 18033-3 and ISO/IEC 18033-4. iii) If a block cipher encryption al

    42、gorithm is used, then the mode of operation employed should be one of those standardized in ISO/IEC 10116. iv) If a MAC is used, then the techniques shall be chosen from amongst those standardized in ISO/IEC 9797. NOTE 1 When a KDC or KTC is involved, assumptions 1) and 2) are not always equivalent

    43、in terms of the ability to unambiguously detect on which link an active attack is being performed. See Annex C for examples. b) In each exchange specified in the mechanisms of clauses 6, 7 and 8, the recipient of a message shall know the claimed identity of the originator. If this is not the case, i

    44、.e. if the context of use of the mechanism does not establish the claimed identity, then this could, for example, be achieved by the inclusion of identifiers in additional plaintext text fields of one or more of the messages. NOTE 2 The specifications of many of the mechanisms in this part of ISO/IE

    45、C 11770 require the correctness of an identifier included in a message to be checked. This shall be done by comparing the received identifier with the expected identifier (as specified in the mechanism concerned). If the identifier in question is that of the originator of the message, then the recip

    46、ient shall know the value of the expected identifier because of requirement b) above. c) Keying material may be established using either secure or insecure communication channels. When using only symmetric cryptographic techniques, at least the first key shall be exchanged between two entities using

    47、 a secure channel in order to allow secure communications. d) The key establishment mechanisms in this part of ISO/IEC 11770 require the use of time variant parameters, such as time stamps, sequence numbers, or random numbers. In this context, the use of the term random number also includes unpredic

    48、table pseudo-random numbers. The properties of these parameters, in particular that they are non-repeating, are important for the security of these mechanisms. For additional information on time variant parameters see Annex B of ISO/IEC 9798-1. For means of generating random numbers, see ISO/IEC 180

    49、31. Likewise, optional plaintext text fields can be included as a prefix, or appended, to any of the messages. They have no security implications and are not explicitly included in the mechanisms specified in this part of ISO/IEC 11770. Data items that are optional in the mechanisms are shown in square brackets, thus. BS ISO/IEC 11770-2:2008 ISO/IEC 11770-2:2008 (E)5 6 Point-to-point key establishment Underlying every key management scheme is a point-to-point key e


    注意事项

    本文(BS ISO IEC 11770-2-2008 Information technology - Security techniques - Key management - Mechanisms using symmetric techniques《信息技术 安全技术 密钥管理 对称技术机制》.pdf)为本站会员(jobexamine331)主动上传,麦多课文档分享仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对上载内容本身不做任何修改或编辑。 若此文所含内容侵犯了您的版权或隐私,请立即通知麦多课文档分享(点击联系客服),我们立即给予删除!




    关于我们 - 网站声明 - 网站地图 - 资源地图 - 友情链接 - 网站客服 - 联系我们

    copyright@ 2008-2019 麦多课文库(www.mydoc123.com)网站版权所有
    备案/许可证编号:苏ICP备17064731号-1 

    收起
    展开