A Standards for Authentication and Key Establishment Practitioners often look to standards bodies to recommend techniques that can be used with the assurance of independent verification of correctness and suitability. Several standards exist covering protocols of the type we have examined in this book. This appendix lists the main relevant standards and briefly summarises their contents. In many cases specific protocols have been examined in the body of the book and we refer to these where appropriate. Standards are issued by many different bodies, both national and international. We have included mainly international standards; many national standards bodies issue their own versions of international standards with little or no alteration. Because of their international influence we also mention some US national standards. We additionally include some protocols which are not standardised by any organisation but which are widely deployed in certain settings. A.1 ISO Standards The International Organization for Standardization (http://www.iso.ch), also known as the ISO, has published numerous standards on cryptographic mechanisms and protocols. A.1.1 ISO/IEC 9798 ISO issued the six-part standard ISO/IEC 9798 on the topic of entity authentication. • Part 1: General (3rd edition, 2010). • Part 2: Mechanisms using symmetric encipherment algorithms (3rd edition, 2008). • Part 3: Mechanisms using digital. signature techniques (2nd edition, 1998; with amendment, 2010). • Part 4: Mechanisms using a cryptographic check function (2nd edition, 1999). • Part 5: Mechanisms using zero knowledge techniques (3rd edition, 2009). © Springer-Verlag GmbH Germany, part of Springer Nature 2020 441 C. Boyd et al., Protocols for Authentication and Key Establishment, Information Security and Cryptography, https://doi.org/10.1007/978-3-662-58146-9 442 A Standards for Authentication and Key Establishment • Part 6: Mechanisms using manual data transfer (2nd edition, 2010). The protocols in Part 2 of the standard were examined in Sect. 3.2.3. Some of the protocols in Part 3 of the standard were examined in Sect. 4.2.1. The protocols in Part 4 of the standard were examined in Sect. 3.2.4. A.1.2 ISO/IEC 11770 ISO issued the six-part standard ISO/IEC 11770 on the topic of key management. Some of the protocols in Parts 2 and 3 of the standard are strongly related to protocols in Parts 2 and 3 of ISO/IEC 9798. Part 1: Framework (2nd edition, 2010). Part 2: Mechanisms using symmetric techniques (2nd edition, 2008). The proto- cols in this part of the standard were examined in Sects. 3.3.4 (the server-less protocols) and 3.4.4 (the server-based protocols). Part 3: Mechanisms using asymmetric techniques (3rd edition, 2015). Protocols in this part of the standard include both key transport protocols which have been examined in Sect. 4.3.1 and key agreement protocols which were summarised in Sect. 5.6. Part 4: Mechanisms based on weak secrets (2nd edition, 2017). This part of the standard is concerned with password-based protocols. It includes five of the password-based key agreement protocols described in Chap. 8. Two are ‘bal- anced’ protocols where both parties hold the shared password: SPEKE (Pro- tocol 8.5) and J-PAKE (Protocol 8.8). Three are augmented protocols where a server holds only the image of the client password: SRP (Protocol 8.18), AMP (Protocol 8.19) and AugPAKE (Protocol 8.20). There is also one password- authenticated key retrieval mechanism which allows a server to furnish a user with a strong secret while the user only stores a password. This is based on a scheme of Ford and Kaliski [281]. Part 5: Group key management (2011). This part of the standard is devoted to group key establishment using a key distribution centre. (This means that it excludes group key agreement which was covered extensively in Chapter 9.) Much of the document is taken up with describing key management structures for groups, particularly various types of trees including the octopus structure shown in Protocol 9.8. There are two specific mechanisms included in the stan- dard, but both are given abstract descriptions. Protocols based on key chains are also described. With regard to security properties the standard only considers what are termed forward secrecy and backward secrecy for dynamic groups: the former states that leaving group members should not learn future keys1 while the latter states that new group members should not learn past keys. 1 Note that this definition of forward secrecy is different from what we use in most of this book. A.2 IETF Standards 443 Part 6: Key derivation (2016). Part 6 of ISO/IEC 11770 standardises key deriva- tion functions in two classes called one-step and two-step functions. The one- steps functions compute one or more keys as the output of a hash function or, in one case, a MAC algorithm. The two-step functions apply a key extraction func- tion followed by a key expansion function, the latter of which can be repeated to obtain further keys. A related standard is ISO/IEC 15946 (Part 1, 3rd edition, 2016; Part 5, 2nd edition, 2017) which covers cryptography based on elliptic curves. This standard includes details for implementing elliptic curve mechanisms defined in Part 3 of ISO/IEC 11770. A.1.3 ISO 9594-8/ITU X.509 A series of standards for directory systems was first issued in 1988 jointly by ISO and CCITT (which was later re-formed as ITU). The section of the standard num- bered 9594-8 (ISO version) or X.509 (ITU version) was known as the Authentication Framework. This section of the standard provides information on how to use a di- rectory to store public key certificates, including the format of certificates. It also includes examples of how to use the certificates to provide authentication and key establishment. In the most recent version of the standard (8th edition, 2017) the Authentication Framework has been renamed Public-Key and Attribute Certificate Frameworks. Portions of the X.509 specification have also been published by the Internet Engineering Task Force, which we note below. Under the heading ‘Strong authentication’ three key establishment protocols were presented. Unfortunately there were some problems with the protocols in the first version of the standard and they were subsequently updated. The protocols have been examined in Sect. 4.3.5. A.2 IETF Standards The Internet Engineering Task Force (IETF) (http://www.ietf.org) produces standards concerned with development of Internet technology. In contrast to many other standards bodies, the IETF works in an open way and all its documents are freely available on the Internet. Documents are first proposed as ‘Internet-Drafts’; after a series of revisions and discussion, some become standardized in documents that are known (for historical reasons) as ‘Requests for Comments’ (RFCs). There are different types of RFCs, including informational, historical, proposed standards, and Internet standards. Some RFCs are also developed by the Crypto Forum Research Group (CFRG), a working group of the IETF’s sister organisation Internet Research Task Force (IRTF), which aims to bridge theory and practice by bringing new cryptographic techniques to the Internet community and serving as an ‘expert crypto consultant’ to IETF work- ing groups. 444 A Standards for Authentication and Key Establishment Table A.1 summarises some prominent RFCs that specify or use prominent au- thenticated key exchange protocols. Some of these were examined earlier and we provide pointers to where they are described in this book. For many of these proto- cols there are additional RFCs available which cover related information or exten- sions of these protocols for different applications. We also include Internet-Drafts in a few areas which are under development but as of writing have not yet progressed to RFCs. A.3 IEEE P1363 Standards The Institute of Electrical and Electronics Engineers (IEEE) is a US-based insti- tution with a worldwide membership. The IEEE Standards Association (http: //standards.ieee.org) issues standards in a wide range of electronics and communications areas. The IEEE P1363 Working Group has developed a number of standards under the heading Standard Specifications for Public-Key Cryptography. At the time of writing there are five active standards in force from the P1363 group. 1363-2000: Public-Key Cryptography. The original P1363 standard includes spec- ifications for public key algorithms and key agreement protocols based on dis- crete logarithms. The only key establishment protocols included in P1363-2000 are basic Diffie–Hellman key agreement and authenticated versions using the Unified Model and MQV. These were examined in Sects. 5.4.4 and 5.4.5. 1363a-2004: Amendment 1: Additional Techniques. This update to the original standard incorporates implementation details for elliptic curves. 1363.1-2008: Public Key Cryptographic Techniques Based on Hard Problems over Lattices. This includes encryption and signature algorithms but no authen- tication or key establishment protocols. 1363.2-2008: Password-Based Public-Key Cryptographic Techniques. There is much overlap with the ISO/IEC 11770-4 standard (see Sect. A.1.2). The 1363.2- 2008 standard includes versions of PAK (Protocol 8.3), PPK (Protocol 8.4), SPEKE (Protocol 8.5), AMP (Protocol 8.19), B-SPEKE (Protocol 8.16) and a variant known as W-SPEKE, PAK-Z (Protocol 8.15) and SRP (Protocol 8.17). Most of the protocol specifications include versions for both the elliptic curve setting and for discrete logarithms in finite fields. 1363.3-2013: Identity-Based Cryptographic Techniques Using Pairings. There are many different identity-based cryptographic primitives included in this stan- dard but only two key agreement protocols, namely Protocol 7.12 of Wang and the variant of Smart’s protocol discussed in Sect.