ISO/IEC 9797-3:2011

Overview

ISO/IEC 9797-3:2011 - "Information technology - Security techniques - Message Authentication Codes (MACs) - Part 3: Mechanisms using a universal hash-function" - specifies MAC algorithms that combine a secret key with a universal hash-function to produce an m‑bit authentication tag. The standard defines four mechanisms: UMAC, Badger, Poly1305‑AES, and GMAC, and ties their use to the block ciphers in ISO/IEC 18033‑3 and the stream ciphers in ISO/IEC 18033‑4.

Key topics and technical requirements

• Algorithms covered: UMAC, Badger, Poly1305‑AES, GMAC - all MACs built on universal hashing.
• Inputs and outputs: Each MAC requires a master key (K), a nonce (N), and a message (M) to produce an m‑bit MAC/tag.
• Two-stage processing model:
  • Key preprocessing - derive a hash key (K_H) and an encryption key (K_E) from the master key.
  • Message preprocessing and hashing - encode the message into the hash-function input and compute the universal-hash result (n bits), then finalize to an m‑bit MAC.
• Security dependencies: MAC strength depends on key secrecy and length, the n‑bit hash output, the MAC length (m), the chosen universal hash‑function, and the underlying cipher security.
• Normative and informative material:
  • Normative references (e.g., ISO/IEC 9797‑1, ISO/IEC 18031, ISO/IEC 18033 series).
  • Annex A: Object Identifiers.
  • Annex B: Test vectors for implementation validation.
  • Annex C: Security information and guidance.
• Notation and primitives: Standard defines precise bit/byte operations, padding (zeropad), truncation rules, arithmetic operations, and field multiplication (GF(2^128)) used by GMAC.

Practical applications and users

• Use cases:
  • Message integrity and authentication in network protocols, secure messaging, and data storage.
  • High-performance authentication for large or streaming data (UMAC, GMAC).
  • Authenticated encryption constructions and secure transport layers.
• Who should use it:
  • Cryptographic engineers, protocol designers, and software/hardware implementers who need standardized MACs.
  • Security architects evaluating or integrating MAC-based integrity services.
  • Test labs and interoperability teams using the provided test vectors and object identifiers.
• Why choose universal-hash MACs: They offer provable security under assumptions about the encryption primitive and are suitable where efficient, high-speed authentication is required.

Related standards

• ISO/IEC 9797‑1 (block cipher MAC mechanisms)
• ISO/IEC 18033‑3 (block ciphers) and ISO/IEC 18033‑4 (stream ciphers)
• ISO/IEC 18031 (random bit generation)

Keywords: ISO/IEC 9797‑3:2011, MAC, universal hash-function, UMAC, Badger, Poly1305‑AES, GMAC, message authentication, integrity, nonce, tag, block cipher, stream cipher.