ISO/IEC 9797-1:2011 PDF

Information technology — Security techniques — Message Authentication Codes (MACs) — Part 1: Mechanisms using a block cipher

First page of standard ISO/IEC 9797-1:2011

Open preview (PDF)

Title (English):

ISO/IEC 9797-1:2011

Information technology — Security techniques — Message Authentication Codes (MACs) — Part 1: Mechanisms using a block cipher

Document status:: Active
Format:: Electronic (PDF)
Number of pages:: 40
Publication date:: March 1, 2011
Edition:: ISO/IEC IS 9797 edition 2 version 1
ICS:: 35.030

Delivery type:

Full version25 €Read online 24h10 €Read online 72h15 €

Document language:

enru

Delivery time:Immediate download

Price:25 €

Description (English):

ISO/IEC 9797-1:2011 specifies six MAC algorithms that use a secret key and an n-bit block cipher to calculate an m-bit MAC. ISO/IEC 9797-1:2011 can be applied to the security services of any security architecture, process, or application. Key management mechanisms are outside the scope of ISO/IEC 9797-1:2011. ISO/IEC 9797-1:2011 specifies object identifiers that can be used to identify each mechanism in accordance with ISO/IEC 8825-1. Numerical examples and a security analysis of each of the six specified algorithms are provided, and the relationship of ISO/IEC 9797-1:2011 to previous standards is explained.

Technical details

Technical committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
SKU: ISO/IEC 9797-1:2011

Abstract

Overview

ISO/IEC 9797-1:2011 - Information technology - Security techniques - Message Authentication Codes (MACs) - Part 1: Mechanisms using a block cipher specifies six standardized MAC algorithms that compute an m‑bit MAC from a message and a secret key using an n‑bit block cipher. The standard is applicable to security services across architectures, processes, and applications that require data integrity and message authentication. It includes algorithm models, numerical examples, object identifiers, and a security analysis; key management is explicitly outside its scope.

Key topics and technical requirements

Six MAC algorithms based on an n‑bit block cipher (the first being the well‑known CBC‑MAC and five related variants).
Algorithm model steps documented in detail:
- Key derivation (two methods)
- Padding (four methods)
- Splitting, iteration, final iteration
- Output transformation (three methods)
- Truncation
Variants and recommendations:
- MAC Algorithm 4: transformation at start and end; suited where MAC key length is twice the block cipher key length.
- MAC Algorithm 5: optimized for minimal encryptions - single block‑cipher key setup but requires a longer internal key.
- MAC Algorithm 6: optimized variant of Algorithm 2 for efficiency.
Normative and informative material:
- Object identifiers for each mechanism (per ISO/IEC 8825‑1).
- Numerical examples (Annex B) and a security analysis (Annex C).
- Comparison with previous standards (Annex D).
Referenced standards: e.g., ISO/IEC 18033‑3 (block ciphers) is referenced for underlying cipher requirements.

Applications and who uses it

ISO/IEC 9797-1:2011 is used wherever authenticated integrity of messages is required:

Security architects and systems designers incorporating MACs into protocols and applications.
Cryptographic library and secure software developers implementing MAC algorithms (CBC‑MAC and variants).
Hardware vendors building secure modules (HSMs, TPMs) that provide MAC services.
Certification bodies and compliance teams specifying standard object identifiers and validated algorithms.
Network, payment, and IoT solution providers that require interoperable message authentication.

Practical applications include transaction authentication, firmware integrity checks, secure logging, protocol message protection, and any service requiring efficient block‑cipher‑based MACs.

Related standards

ISO/IEC 9797‑2 (MACs using dedicated hash functions)
ISO/IEC 9797‑3 (MACs using universal hash functions)
ISO/IEC 18033‑3 (block cipher specifications)
ISO/IEC 8825‑1 (object identifier encoding)

Keywords: ISO/IEC 9797-1:2011, Message Authentication Codes, MAC, CBC‑MAC, block cipher, data integrity, security standard, ISO.

Related standards

Standards mentioned in the description

Abstract

Overview

Key topics and technical requirements

Six MAC algorithms based on an n‑bit block cipher (the first being the well‑known CBC‑MAC and five related variants).
Algorithm model steps documented in detail:
- Key derivation (two methods)
- Padding (four methods)
- Splitting, iteration, final iteration
- Output transformation (three methods)
- Truncation
Variants and recommendations:
- MAC Algorithm 4: transformation at start and end; suited where MAC key length is twice the block cipher key length.
- MAC Algorithm 5: optimized for minimal encryptions - single block‑cipher key setup but requires a longer internal key.
- MAC Algorithm 6: optimized variant of Algorithm 2 for efficiency.
Normative and informative material:
- Object identifiers for each mechanism (per ISO/IEC 8825‑1).
- Numerical examples (Annex B) and a security analysis (Annex C).
- Comparison with previous standards (Annex D).
Referenced standards: e.g., ISO/IEC 18033‑3 (block ciphers) is referenced for underlying cipher requirements.

Applications and who uses it

ISO/IEC 9797-1:2011 is used wherever authenticated integrity of messages is required:

Security architects and systems designers incorporating MACs into protocols and applications.
Cryptographic library and secure software developers implementing MAC algorithms (CBC‑MAC and variants).
Hardware vendors building secure modules (HSMs, TPMs) that provide MAC services.
Certification bodies and compliance teams specifying standard object identifiers and validated algorithms.
Network, payment, and IoT solution providers that require interoperable message authentication.

Practical applications include transaction authentication, firmware integrity checks, secure logging, protocol message protection, and any service requiring efficient block‑cipher‑based MACs.

Related standards

ISO/IEC 9797‑2 (MACs using dedicated hash functions)
ISO/IEC 9797‑3 (MACs using universal hash functions)
ISO/IEC 18033‑3 (block cipher specifications)
ISO/IEC 8825‑1 (object identifier encoding)

Keywords: ISO/IEC 9797-1:2011, Message Authentication Codes, MAC, CBC‑MAC, block cipher, data integrity, security standard, ISO.

ISO/IEC 9797-1:2011 PDF

Technical details

Abstract

Overview

Key topics and technical requirements

Applications and who uses it

Related standards

Related standards

Abstract

Overview

Key topics and technical requirements

Applications and who uses it

Related standards

Related standards

Information technology — ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encodin…

Information technology — Security techniques — Encryption algorithms — Part 3: Block ciphers

Information technology — Security techniques — Message Authentication Codes (MACs) — Part 2: Mechanisms using…

Information technology — Security techniques — Message Authentication Codes (MACs) — Part 3: Mechanisms using…