ISO/IEC 9798-1:2010

Overview - ISO/IEC 9798-1:2010 (Entity authentication - General)

ISO/IEC 9798-1:2010 defines the authentication model, terminology, and general requirements for entity authentication mechanisms that use security techniques. It specifies how an entity (the claimant) proves its identity by demonstrating knowledge of a secret, via standardized exchanges (tokens) between entities and, where required, with a trusted third party (TTP). Detailed protocol mechanisms are covered in subsequent parts of ISO/IEC 9798 (Parts 2–6).

Keywords: ISO/IEC 9798-1:2010, entity authentication, security techniques, authentication model, tokens, trusted third party, PKI.

Key topics and technical requirements

• Authentication model and roles
  • Defines claimant, verifier, trusted third party, tokens, and message flows.
  • Supports unilateral and mutual authentication.
• Exchange structure
  • Tokens exchanged between entities; at least one token for unilateral, at least two for mutual authentication.
  • Additional passes may be required for challenges or TTP involvement.
• Time-variant parameters
  • Use of random numbers, time stamps, and sequence numbers to prevent replay attacks (see Annex B).
• Security properties to consider
  • Prevention of replay, reflection, and interleaving attacks; forced-delay concerns.
  • Choice of protocol depends on threats and whether a pre-established secret or TTP is available.
• Data composition and uniqueness
  • Concatenation of data fields must be unambiguous so constituents can be uniquely resolved (e.g., fixed lengths or canonical encoding).
• Terminology and primitives
  • Defines symmetric/asymmetric techniques, cryptographic check functions, public key certificates, tokens, and signature/encryption terminology.
• Scope constraints
  • Part 1 specifies requirements and model only; concrete mechanisms and content are in Parts 2–6. Establishment of underlying infrastructure (e.g., PKI) is out of scope.

Practical applications

• Designing and evaluating authentication protocols for:
  • Secure network access, client-server authentication, and mutual TLS-style flows.
  • Smart cards, IoT device authentication, payment systems, and secure remote services.
• Implementing challenge–response and token-based authentication where robust replay/reflection protections are required.
• Specifying interoperability requirements between systems and vendors for authentication exchanges.

Who should use this standard

• Security architects, protocol designers, system integrators, PKI implementers, product vendors, and compliance auditors working on authentication solutions and secure communications.

Related standards

• ISO/IEC 9798 (Parts 2–6) - concrete mechanisms using symmetric encipherment, digital signatures, cryptographic check functions, zero-knowledge techniques, and manual transfer.
• ISO/IEC 8825-1 referenced for unambiguous encoding (distinguished encoding rules).

This standard is essential when you need a formal, interoperable model and general requirements to design secure entity authentication mechanisms and to reason about threats such as replay and man-in-the-middle attacks.