Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 09797 โ Message Authentication Codes (MACs) Mechanisms Series
Information technology โ Security techniques โ Message Authentication Codes (MACs) (2011)
๐ BS ISO/IEC 9797 is the British Standards Institution (BSI) adoption of ISO/IEC 9797, a series under the general title Information technology โ Security techniques โ Message Authentication Codes (MACs), developed by ISO/IEC JTC 1/SC 27 (Information security), with UK participation through IST/33 (IT security techniques). A message authentication code appends a key-derived authentication tag to a message, allowing the receiver to verify message integrity and source authenticity โ a widely used mechanism in network protocols, payment systems, financial messages, and data exchange.
๐ก MAC vs. digital signature: a MAC uses a symmetric key shared between generator and verifier, is fast and low-overhead, but cannot be used for third-party arbitration; a digital signature uses public-key cryptography and provides non-repudiation.
1. Structure and Scope of the Series ๐
The BS ISO/IEC 9797 series is divided by underlying primitive into three parts, each for a different MAC construction basis:
| Part | Standard No. | Mechanism Basis | Typical Algorithms |
|---|---|---|---|
| Part 1 | BS ISO/IEC 9797-1:2011 | Block cipher | CBC-MAC, CMAC, MAC algorithms 1โ6 |
| Part 2 | BS ISO/IEC 9797-2:2011 | Dedicated hash-function | HMAC and other hash-based MAC algorithms |
| Part 3 | BS ISO/IEC 9797-3:2011 | Universal hash-function | UMAC and others |
โ ๏ธ Part 2 is the 2011 second edition incorporating the September 2015 corrigendum (corrections to subclauses 3.14, 6.3, 6.3.5, and 6.3.6). Use the latest corrected version.
2. Block Cipher Based MACs (Part 1) ๐ง
Part 1 specifies block-cipher-based message authentication code mechanisms. The core idea is to process the message in blocks using a block cipher (e.g., AES, DES) iteratively to produce a fixed-length authentication code. Content includes:
- Terms and symbols: message, key, initialization vector, padding, etc.;
- MAC algorithms: MAC algorithms 1โ6, such as CBC-MAC (algorithm 1) and variants with key padding and truncation;
- Security requirements: padding modes, key management, and output truncation rules for each algorithm.
This is the most classic MAC standard, widely used in financial message authentication and telecommunications signalling integrity protection.
3. Hash-Function Based MACs (Part 2) ๐ฅ
Part 2 specifies dedicated-hash-function-based MAC mechanisms, covering:
- Terms and symbols;
- Requirements: key length, hash-function selection, and security parameters;
- MAC Algorithm 1: the hash-based construction, including the key expansion step and the hash iteration and output processing flow.
โ
Value: hash-based MACs (e.g., HMAC) are efficient and portable in software, making them a common integrity protection choice in protocols such as TLS and IPsec.
4. Universal Hash-Function Based MACs (Part 3) ๐ ๏ธ
Part 3 specifies universal-hash-function-based MAC mechanisms, covering:
- General model: the general framework for constructing MACs from universal hash functions;
- Mechanisms: specific constructions, notably UMAC, including its input, key handling, universal hashing, and output generation.
๐จ Selection note: universal-hash MACs (e.g., UMAC) can achieve very high throughput on suitable platforms, but depend on key management and implementation details. Assess platform performance, implementation security, and interoperability needs when choosing.
5. Engineering Practice Essentials ๐
- ๐ Data integrity: attach a MAC in transit and storage to detect tampering.
- ๐ง Source authentication: the shared key lets the receiver confirm the message came from the party holding the key.
- ๐ Performance trade-offs: block-cipher MACs are mature in hardware; hash MACs are efficient in software; universal-hash MACs offer high throughput but more complex implementation.
- ๐ Key management: MACs depend on symmetric keys; follow key generation, distribution, rotation, and revocation security requirements.
6. Frequently Asked Questions โ
โ Q: How does a MAC differ from a hash?
A: A hash is keyless and detects integrity only; a MAC uses a key and detects both integrity and source authenticity, preventing forgery by attackers.
A: A hash is keyless and detects integrity only; a MAC uses a key and detects both integrity and source authenticity, preventing forgery by attackers.
โ Q: How does CBC-MAC differ from CMAC?
A: CBC-MAC (MAC Algorithm 1) is the classic construction, requiring care with padding and length handling for variable-length messages; CMAC-type improved algorithms handle variable-length messages via key derivation and are more robust.
A: CBC-MAC (MAC Algorithm 1) is the classic construction, requiring care with padding and length handling for variable-length messages; CMAC-type improved algorithms handle variable-length messages via key derivation and are more robust.
โ Q: Why three parts?
A: Different applications use different underlying primitives (block cipher, hash function, universal hash function). Separate parts specify each class of MAC mechanism and its parameters, allowing selection by application scenario.
A: Different applications use different underlying primitives (block cipher, hash function, universal hash function). Separate parts specify each class of MAC mechanism and its parameters, allowing selection by application scenario.
โ Q: Can a MAC provide non-repudiation?
A: No. A symmetric key lets any party generate a valid MAC, so the generator cannot be distinguished. Non-repudiation requires a digital signature (asymmetric mechanism).
A: No. A symmetric key lets any party generate a valid MAC, so the generator cannot be distinguished. Non-repudiation requires a digital signature (asymmetric mechanism).