ISO/IEC 11770-2:2018

Overview

ISO/IEC 11770-2:2018 - "IT Security techniques - Key management - Part 2: Mechanisms using symmetric techniques" defines standardized key establishment mechanisms using symmetric cryptography. The standard covers three operational environments for secure key setup: Point-to-Point, Key Distribution Centre (KDC) and Key Translation Centre (KTC). It specifies the required content of messages that carry keying material or set conditions under which keys are established, and describes 13 named mechanisms (mechanisms 1–13) for these environments.

Key topics and technical requirements

• Symmetric techniques: mechanisms use symmetric encryption, Message Authentication Codes (MACs) and Key Derivation Functions (KDFs) rather than public-key operations.
• Environments addressed:
  • Point-to-Point key establishment (direct between entities).
  • KDC-based distribution (centralized key distribution).
  • KTC-based translation (central authority translates keys between domains).
• Message content: the standard defines required fields carrying keying material and time-variant parameters (random numbers, sequence numbers, timestamps - TVPs) to prevent replay and support key confirmation.
• Authentication and confirmation: mechanisms can provide entity authentication, implicit/explicit key authentication and key confirmation.
• Auxiliary material: annexes include object identifiers, properties of mechanisms and auxiliary techniques (e.g., format guidance), but explicit message encoding and transport formats are out of scope.
• Scope limitations: ISO/IEC 11770-2:2018 does not define how initial long‑term secrets are established, does not mandate message encoding, and does not explicitly address inter‑domain key management or implementation compatibility.

Practical applications and users

• Who uses it: security architects, cryptographic protocol designers, system integrators, product vendors, evaluators and auditors who implement or assess symmetric key management.
• Practical uses: designing secure session key distribution in closed systems, implementing KDC/KTC-based enterprise key services, specifying message contents for secure symmetric key exchange, and aligning product features with international best practices for symmetric key establishment.
• Benefits: ensures standardized message content, supports mutual authentication and key confirmation, and helps reduce protocol design errors when relying on symmetric primitives.

Related standards (brief)

• ISO/IEC 11770-1 - Key management framework and lifecycle guidance.
• ISO/IEC 9798 series - Entity authentication mechanisms (from which some symmetric key establishment methods are derived).

Keywords: ISO/IEC 11770-2:2018, key management, symmetric techniques, key establishment, KDC, KTC, point-to-point, KDF, MAC, key confirmation, cryptographic key lifecycle.