ISO/IEC 20009-2:2013 PDF

Overview

ISO/IEC 20009-2:2013 - Information technology - Security techniques - Anonymous entity authentication - Part 2: Mechanisms based on signatures using a group public key - defines anonymous authentication mechanisms that rely on group signatures (anonymous signatures using a group public key). The standard specifies how a verifier can confirm that a claimant is an authorized member of a group without learning the claimant’s identity. It covers general models, key generation, membership issuing, and optional operations such as opening and linking of group signatures.

Key topics and technical requirements

• Group signature-based authentication: Tokens are generated as group signatures; verifiers validate the signature against a group public key without identifying the signer.
• Group membership processes: Procedures for issuing and managing group membership and group public key certificates.
• Mechanisms without an online TTP: Flows for unilateral and mutual anonymous authentication where no trusted third party is required online.
• Mechanisms involving an online TTP: Variants that use an online Trusted Third Party to support issuance, authentication, or revocation.
• Optional opening and linking: Definitions of the group membership opening process (to reveal identity under controlled conditions) and group signature linking (to detect multiple signatures from the same member), including local linking and linking-key approaches.
• Binding-property support: Mechanisms that bind authentication tokens to session-specific data (messages, ephemeral keys) to prevent replay or misuse.
• Key management and cryptographic context: Key generation and key derivation functions, group public key certificates, ephemeral key pairs, and references to cryptographic assumptions (e.g., groups where the DDH problem is hard).
• Normative references: Integrates with ISO/IEC 20008 series (anonymous signatures) and ISO/IEC 20009-1 (general).

Note: the standard draws attention to possible patent-encumbered methods; implementers should review patent statements and licensing.

Practical applications and who uses it

ISO/IEC 20009-2:2013 is relevant for:

• Security architects and system integrators designing privacy-preserving authentication for online services.
• Identity providers and certification authorities that manage group public keys and membership issuance.
• Developers of privacy-enhancing technologies such as anonymous credential systems, e-voting, privacy-preserving access control, and anonymous audit/logging.
• Vendors of authentication platforms requiring anonymous or pseudonymous user proof-of-membership.
• Regulatory and standards teams assessing privacy and accountability trade-offs (e.g., optional opener for lawful disclosure).

Related standards

• ISO/IEC 20009-1: General anonymous entity authentication
• ISO/IEC 20008-2: Anonymous digital signatures - Mechanisms using a group public key
• Future parts (blind signatures, weak secrets) expand alternative anonymous authentication mechanisms

Keywords: ISO/IEC 20009-2:2013, anonymous entity authentication, group public key, group signature, anonymous authentication, security techniques, Trusted Third Party, group membership, binding-property.