ISO/IEC 11770-5:2020

Overview

ISO/IEC 11770-5:2020 - Information security - Key management - Part 5: Group key management specifies standardized mechanisms for establishing shared symmetric keys among groups of entities. The standard focuses on group key establishment with the assistance of a Key Distribution Centre (KDC) and on logical key structures (tree-based) and key chains that provide group forward secrecy, group backward secrecy, or both. It describes the required content of messages that carry keying material and defines rekeying approaches; it does not prescribe explicit message formats, initial secret provisioning, key lifecycle management, or interdomain key management.

Key topics and technical requirements

• KDC-based symmetric key mechanisms: procedures to distribute shared secret keys from a trusted KDC to multiple entities.
• Logical key hierarchies / tree-based structures: general tree, d-ary trees, and star topologies to organise key encryption keys (KEKs), ancestor/child keys, and the shared secret key.
• Rekeying methods:
  • Individual rekeying - update keys immediately when a member joins or leaves, providing group forward and backward secrecy.
  • Batch rekeying - periodic updates using interval T, providing forward/backward secrecy with intervals (trade-off between performance and security).
• Key chain approaches: forward, backward, or combined secrecy using one-way functions to derive sequences of keys.
• Security properties: clear definitions of group forward secrecy, group backward secrecy, and forward/backward secrecy with intervals; selection depends on application security policy.
• Message content: required fields for messages that carry keying material (content specified; explicit encoding/out-of-scope).
• Cryptographic primitives: symmetric encryption algorithms and key derivation functions referenced (normative references include ISO/IEC 19772 and ISO/IEC 11770-6).

Practical applications

ISO/IEC 11770-5 is applicable to systems that require securely shared symmetric keys for group communication, including:

• Secure multicast and broadcast services
• Conferencing and collaborative platforms (VoIP, video conferencing)
• Group messaging and secure chat systems
• IoT device groups and edge computing clusters
• Enterprise group access control and distributed services

The standard helps architects balance security (immediate rekeying) versus scalability and performance (batch rekeying or tree-based KEK pruning).

Who should use this standard

• Security architects and protocol designers building group key management
• System integrators implementing KDC-based or hierarchical key systems
• Product teams for secure conferencing, IoT platforms, and multicast services
• Standards compliance and security assessment professionals

Related standards

• ISO/IEC 19772 - Authenticated encryption primitives (referenced for symmetric encryption)
• ISO/IEC 11770-6 - Key derivation (used for key derivation function specifications)

Keywords: ISO/IEC 11770-5:2020, group key management, KDC, tree-based key establishment, key chain, group forward secrecy, group backward secrecy, rekeying, symmetric key.