ISO/IEC 9798-4:1999

Overview

ISO/IEC 9798-4:1999 - "Information technology - Security techniques - Entity authentication - Part 4: Mechanisms using a cryptographic check function" specifies standardized mechanisms for proving the identity of an entity by computing a cryptographic check value (e.g., a MAC) over selected data with a shared secret key. The part covers both unilateral and mutual authentication and requires use of time‑variant parameters (time stamps, sequence numbers, or random numbers) to prevent replay and reuse of valid authentication tokens.

Key topics and requirements

• Authentication types
  • Unilateral authentication: one entity (claimant) authenticated to a verifier.
    • With time stamps/sequence numbers: one pass.
    • With challenge/response (random numbers): two passes.
  • Mutual authentication: both entities authenticate each other.
    • With time stamps/sequence numbers: two passes.
    • With challenge/response: three passes.
• Cryptographic check function
  • The claimant demonstrates knowledge of a secret authentication key by producing a check value f(X) using that key. Examples of check functions are referenced in ISO/IEC 9797 (Message Authentication Codes).
• Time‑variant parameters
  • Use of time stamps, sequence numbers, or random nonces ensures timeliness/uniqueness and prevents replay attacks; selection depends on environment and device capabilities.
• Security requirements
  • Shared secret key must be established before authentication; key distribution is out of scope.
  • Key secrecy and appropriate key length, check‑value length, and function choice determine strength.
• Optional elements
  • Text fields and distinguishing identifiers (A/B) can be included to bind messages and mitigate reflection/replay attacks; their use depends on application needs.

Applications and who uses it

• Useful for protocol designers, security architects, and implementers of authentication systems in:
  • Banking and payment systems (card-to-terminal authentication)
  • Network authentication (VPNs, secure sessions)
  • Smart cards and embedded devices (IoT device authentication)
  • Telecom authentication and subscriber verification
• Applies where lightweight symmetric-key verification (MAC-style check functions) is preferred over digital signatures, and where protection against replay/reflection is required.

Related standards

• ISO/IEC 9797 - Message Authentication Codes (MACs) - examples of suitable cryptographic check functions.
• ISO/IEC 9798-1 - Entity authentication - General (definitions and notation).
• Other parts of ISO/IEC 9798 (Parts 2, 3, 5) describe alternative mechanisms (symmetric encipherment, digital signatures, zero-knowledge).

ISO/IEC 9798-4:1999 is a practical specification for secure, time‑aware symmetric authentication mechanisms and is commonly referenced when designing protocols that require efficient, replay-resistant entity authentication.