Overview
ISO/IEC 9798-3:2019 - IT Security techniques: Entity authentication, Part 3: Mechanisms using digital signature techniques specifies entity authentication mechanisms that rely on digital signatures and asymmetric cryptography. The standard defines ten concrete mechanisms for proving identity: the first five operate without an on-line trusted third party (TTP) and the last five use an on-line TTP. In each category there are mechanisms for unilateral and mutual authentication. Annex A assigns object identifiers (OIDs) to the mechanisms and Annex B/C provide guidance on usage and text-field conventions.
Key topics and technical requirements
- Digital-signature-based authentication: claimants prove identity by signing specific data with a private signature key; verifiers use the claimant’s public verification key to validate signatures.
- Mechanism taxonomy: ten mechanisms (two unilateral and three mutual in each category), differentiated by message pass counts and whether a TTP is involved.
- Time-variant parameters: use of time stamps, sequence numbers or nonces to prevent replay attacks; choice affects the number of message passes needed for unilateral vs mutual authentication.
- Tokens and signed/unsigned data: tokens are structured as unsigned fields plus a signature over signed data; when message-recovery signature schemes are used (see ISO/IEC 9796) some signed data can be omitted from the unsigned portion.
- Core requirements:
- Verifier must possess a valid public key for the claimant (certificates or trusted distribution).
- Claimant must securely hold a private signature key used only for authentication.
- Signature keys used for these mechanisms must be distinct from other keys.
- Signed data must be composed to avoid ambiguity or interchangeability.
- Interoperability & identifiers: OIDs defined for each mechanism to support protocol and certificate integration.
Applications
ISO/IEC 9798-3:2019 is practical for:
- Designing PKI-based authentication in enterprise systems, e‑government services, payment systems, smart cards and secure tokens.
- Protocol architects specifying mutual or unilateral entity authentication in networked applications.
- Developers implementing authentication modules that require signed challenge/response, time-variant protections, or integration with an on-line trusted third party.
- Security assessors, auditors and compliance teams evaluating whether authentication mechanisms meet best-practice asymmetric signature requirements.
Who should use this standard
- Security architects, protocol designers, PKI operators, smart-card designers, and implementers of authentication services seeking a standardized, interoperable set of digital-signature authentication mechanisms.
Related standards
Keywords: ISO/IEC 9798-3:2019, entity authentication, digital signature, asymmetric techniques, mutual authentication, unilateral authentication, trusted third party, PKI, tokens, time-variant parameters.
Open preview (PDF)IT Security techniques — Entity authentication — Part 3: Mechanisms using digital signature techniques