Overview
ISO/IEC 9797-3:2011 - "Information technology - Security techniques - Message Authentication Codes (MACs) - Part 3: Mechanisms using a universal hash-function" - specifies MAC algorithms that combine a secret key with a universal hash-function to produce an m‑bit authentication tag. The standard defines four mechanisms: UMAC, Badger, Poly1305‑AES, and GMAC, and ties their use to the block ciphers in ISO/IEC 18033‑3 and the stream ciphers in ISO/IEC 18033‑4.
Key topics and technical requirements
- Algorithms covered: UMAC, Badger, Poly1305‑AES, GMAC - all MACs built on universal hashing.
- Inputs and outputs: Each MAC requires a master key (K), a nonce (N), and a message (M) to produce an m‑bit MAC/tag.
- Two-stage processing model:
- Key preprocessing - derive a hash key (K_H) and an encryption key (K_E) from the master key.
- Message preprocessing and hashing - encode the message into the hash-function input and compute the universal-hash result (n bits), then finalize to an m‑bit MAC.
- Security dependencies: MAC strength depends on key secrecy and length, the n‑bit hash output, the MAC length (m), the chosen universal hash‑function, and the underlying cipher security.
- Normative and informative material:
- Normative references (e.g., ISO/IEC 9797‑1, ISO/IEC 18031, ISO/IEC 18033 series).
- Annex A: Object Identifiers.
- Annex B: Test vectors for implementation validation.
- Annex C: Security information and guidance.
- Notation and primitives: Standard defines precise bit/byte operations, padding (zeropad), truncation rules, arithmetic operations, and field multiplication (GF(2^128)) used by GMAC.
Practical applications and users
- Use cases:
- Message integrity and authentication in network protocols, secure messaging, and data storage.
- High-performance authentication for large or streaming data (UMAC, GMAC).
- Authenticated encryption constructions and secure transport layers.
- Who should use it:
- Cryptographic engineers, protocol designers, and software/hardware implementers who need standardized MACs.
- Security architects evaluating or integrating MAC-based integrity services.
- Test labs and interoperability teams using the provided test vectors and object identifiers.
- Why choose universal-hash MACs: They offer provable security under assumptions about the encryption primitive and are suitable where efficient, high-speed authentication is required.
Related standards
Keywords: ISO/IEC 9797‑3:2011, MAC, universal hash-function, UMAC, Badger, Poly1305‑AES, GMAC, message authentication, integrity, nonce, tag, block cipher, stream cipher.
Open preview (PDF)Information technology — Security techniques — Message Authentication Codes (MACs) — Part 3: Mechanisms using a universal hash-function