ISO/IEC 9797-1

ISO/IEC 9797-1Information technology – Security techniques – Message Authentication Codes (MACs) – Part 1: Mechanisms using a block cipheris aninternational standardthat defines methods for calculating amessage authentication code(MAC) over data.

Rather than defining one specific algorithm, the standard defines a general model from which a variety of specific algorithms can be constructed. The model is based on ablock cipherwith a secretsymmetric key.

Because the standard describes a model rather than a specific algorithm, users of the standard mustspecify all of the particular options and parameter to be used,to ensure unambiguous MAC calculation.

Model

The model for MAC generation comprises six steps:

1. Paddingof the data to a multiple of thecipher block size
2. Splittingof the data into blocks
3. Initial transformationof the first block of data
4. Iterationthrough the remaining blocks of data
5. Output transformationof the result of the last iteration
6. Truncationof the result to the required length

For most steps, the standard provides several options from which to choose, and/or allows some configurability.

Padding

The input data must be padded to a multiple of the cipher block size, so that each subsequent cryptographic operation will have a complete block of data. Three padding methods are defined. In each casenis the block length (inbits):

Padding method 1

If necessary, add bits with value 0 to the end of the data until the padded data is a multiple ofn.(If the original data was already a multiple ofn,no bits are added.)

Padding method 2

Add a single bit with value 1 to the end of the data. Then if necessary add bits with value 0 to the end of the data until the padded data is a multiple ofn.

Padding method 3

The padded data comprises (in this order):

• The length of the unpadded data (in bits) expressed inbig-endianbinary innbits (i.e. one cipher block)
• The unpadded data
• As many (possibly none) bits with value 0 as are required to bring the total length to a multiple ofnbits

It is not necessary to transmit or store the padding bits, because the recipient can regenerate them, knowing the length of the unpadded data and the padding method used.

Splitting

The padded dataDis split intoqblocksD₁,D₂,...D_q,each of lengthn,suitable for the block cipher.

Initial transformation

A cryptographic operation is performed on the first block (D₁), to create an intermediate blockH₁.Two initial transformations are defined:

Initial transformation 1

D₁is encrypted with the keyK:

H₁= e_K(D₁)

Initial transformation 2

D₁is encrypted with the keyK,and then by a second keyK′′:

H₁= e_K′′(e_K(D₁))

Iteration

BlocksH₂...H_qare calculated by encrypting, with the keyK,thebitwiseexclusive-orof the corresponding data block and the previousHblock.

fori= 2 toq

H_i= e_K(D_i⊕H_i-1)

If there is only one data block (q=1), this step is omitted.

Output transformation

A cryptographic operation is (optionally) performed on the last iteration output blockH_qto produce the blockG.Three output transformations are defined:

Output transformation 1

H_qis used unchanged:

G=H_q

Output transformation 2

H_qis encrypted with the keyK′:

G= e_K′(H_q)

Output transformation 3

H_qis decrypted with the keyK′ and the result encrypted with the keyK:

G= e_K(d_K′(H_q))

Truncation

The MAC is obtained by truncating the blockG(keeping the leftmost bits, discarding the rightmost bits), to the required length.

Specific algorithms

The general model nominally allows for any combination of options for each of the padding, initial transformation, output transformation, and truncation steps. However, the standard defines four particular combinations of initial and output transformation and (where appropriate) key derivation, and two further combinations based on duplicate parallel calculations. The combinations are denoted by the standard as "MAC Algorithm 1" through "MAC Algorithm 6".

MAC algorithm 1

This algorithm uses initial transformation 1 and output transformation 1.

Only one key is required,K.

(When the block cipher isDES,this is equivalent to the algorithm specified inFIPS PUB 113Computer Data Authentication.)

Algorithm 1 is commonly known asCBC-MAC.

MAC algorithm 2

This algorithm uses initial transformation 1 and output transformation 2.

Two keys are required,KandK′, butK′ may be derived fromK.

MAC algorithm 3

This algorithm uses initial transformation 1 and output transformation 3.

Two independent keys are required,KandK′.

Algorithm 3 is also known asRetail MAC.

MAC algorithm 4

This algorithm uses initial transformation 2 and output transformation 2.

Two independent keys are required,KandK′, with a third keyK′′ derived fromK′.

MAC algorithm 5

MAC algorithm 5 comprises two parallel instances of MAC algorithm 1. The first instance operates on the original input data. The second instance operates on two key variants generated from the original key via multiplication in aGalois field.The final MAC is computed by the bitwiseexclusive-orof the MACs generated by each instance of algorithm 1.

Algorithm 5 is also known asCMAC.

MAC algorithm 6

This algorithm comprises two parallel instances of MAC algorithm 4. The final MAC is the bitwise exclusive-or of the MACs generated by each instance of algorithm 4.

Each instance of algorithm 4 uses a different key pair (KandK′) but those four keys are derived from two independent base keys.

Key derivation

MAC algorithms 2 (optionally), 4, 5 and 6 require deriving one or more keys from another key. The standard does not mandate any particular method of key derivation, although it does generally mandate that derived keys be different from each other.

The standard gives some examples of key derivation methods, such as "complement alternate substrings of four bits ofKcommencing with the first four bits. "This is equivalent to bitwise exclusive-oring eachbyteof the key with F0 (hex).

Complete specification of the MAC calculation

To completely and unambiguously define the MAC calculation, a user of ISO/IEC 9797-1 must select and specify:

• The block cipher algorithme
• The padding method (1 to 3)
• The specific MAC algorithm (1 to 6)
• The length of the MAC
• The key derivation method(s) if necessary, for MAC algorithms 2, 4, 5 or 6

Security analysis of the algorithms

Annex B of the standard is a security analysis of the MAC algorithms. It describes various cryptographic attacks on the algorithms – includingkey-recovery attack,brute force key recovery,andbirthday attack– and analyses the resistance of each algorithm to those attacks.