Overview
ISO/IEC 11770-4:2017/Amd 2:2021 is an amendment to Part 4 of the ISO/IEC 11770 key-management series. It adds formal support for leakage-resilient password‑authenticated key agreement with additional stored secrets - a class of mechanisms that establish shared cryptographic keys when one party holds a weak, password‑based secret plus an additional stored secret that may be exposed or altered. The amendment defines two mechanisms (LKAM1 and LKAM2), operational modes (DL and EC), and detailed functions and workflows for initialization, token exchange, key derivation and confirmation.
Key technical topics and requirements
- Leakage‑resilience model: Protects against either compromise of the client’s stored secret or compromise of the server’s verification data - not both simultaneously. Prevents offline dictionary attacks except when the client’s stored secret is obtained.
- Mechanisms added: LKAM1 and LKAM2 for password‑authenticated key agreement with additional stored secrets; LKAM1 is specified in detail and supports both Discrete Log (DL) and Elliptic Curve (EC) settings.
- Core operations:
- Initialization: Agreement on domain parameters, key‑derivation parameters and functions; registration of verification data and stored secrets.
- Key establishment process: (a) generate/exchange key tokens (including entangled key tokens that bind password and stored secret), (b) validate tokens, (c) derive shared secret values and apply a key derivation function, (d) perform key confirmation and update stored secrets (mandatory).
- Defined functional primitives: Verification element derivation (J), key token generation (D), entangled key token generation (C), token checking (T), secret value derivation (V), and key derivation (K). Mechanisms reference specific cryptographic building blocks and modes (DL multiplicative group or EC additive group).
- Interoperability and references: Uses standard hash‑functions, MACs, authenticated encryption and key‑derivation primitives. Referenced standards include ISO/IEC 10118, 29192‑5, 9797, 29192‑6, 11770‑6, 18033‑2 and 19772.
Practical applications and users
- Client‑server authentication where clients store an extra secret on a portable device (smartphone, smart card, USB token) or shared network storage.
- Systems requiring resistance to leakage of client-side stored data or server-side verification data (e.g., mobile banking, enterprise single sign‑on, secure remote access).
- Who should use it: Security architects, protocol designers, implementers of authentication servers, smart‑card and token manufacturers, and organizations designing leakage‑resilient PAKE solutions.
- Benefits: Preserves user password privacy from servers, mitigates offline dictionary attacks unless stored secret is exposed, and provides explicit key authentication and optional mutual authentication.
Related standards
Keywords: ISO/IEC 11770-4:2017/Amd 2:2021, leakage-resilient, password-authenticated key agreement, stored secrets, weak secrets, LKAM1, entangled key token, key management, PAKE, elliptic curve, discrete log.
Open preview (PDF)Information technology — Security techniques — Key management — Part 4: Mechanisms based on weak secrets — Amendment 2: Leakage-resilient password-authenticated key agreement with additional stored secrets
