ISO/IEC 9798-3:2019

Overview

ISO/IEC 9798-3:2019 - IT Security techniques: Entity authentication, Part 3: Mechanisms using digital signature techniques specifies entity authentication mechanisms that rely on digital signatures and asymmetric cryptography. The standard defines ten concrete mechanisms for proving identity: the first five operate without an on-line trusted third party (TTP) and the last five use an on-line TTP. In each category there are mechanisms for unilateral and mutual authentication. Annex A assigns object identifiers (OIDs) to the mechanisms and Annex B/C provide guidance on usage and text-field conventions.

Key topics and technical requirements

• Digital-signature-based authentication: claimants prove identity by signing specific data with a private signature key; verifiers use the claimant’s public verification key to validate signatures.
• Mechanism taxonomy: ten mechanisms (two unilateral and three mutual in each category), differentiated by message pass counts and whether a TTP is involved.
• Time-variant parameters: use of time stamps, sequence numbers or nonces to prevent replay attacks; choice affects the number of message passes needed for unilateral vs mutual authentication.
• Tokens and signed/unsigned data: tokens are structured as unsigned fields plus a signature over signed data; when message-recovery signature schemes are used (see ISO/IEC 9796) some signed data can be omitted from the unsigned portion.
• Core requirements:
  • Verifier must possess a valid public key for the claimant (certificates or trusted distribution).
  • Claimant must securely hold a private signature key used only for authentication.
  • Signature keys used for these mechanisms must be distinct from other keys.
  • Signed data must be composed to avoid ambiguity or interchangeability.
• Interoperability & identifiers: OIDs defined for each mechanism to support protocol and certificate integration.

Applications

ISO/IEC 9798-3:2019 is practical for:

• Designing PKI-based authentication in enterprise systems, e‑government services, payment systems, smart cards and secure tokens.
• Protocol architects specifying mutual or unilateral entity authentication in networked applications.
• Developers implementing authentication modules that require signed challenge/response, time-variant protections, or integration with an on-line trusted third party.
• Security assessors, auditors and compliance teams evaluating whether authentication mechanisms meet best-practice asymmetric signature requirements.

Who should use this standard

• Security architects, protocol designers, PKI operators, smart-card designers, and implementers of authentication services seeking a standardized, interoperable set of digital-signature authentication mechanisms.

Related standards

• ISO/IEC 9798‑1 - Entity authentication: General (concepts and terminology)
• ISO/IEC 14888 - Digital signatures with appendix
• ISO/IEC 9796 - Digital signature schemes giving message recovery

Keywords: ISO/IEC 9798-3:2019, entity authentication, digital signature, asymmetric techniques, mutual authentication, unilateral authentication, trusted third party, PKI, tokens, time-variant parameters.