標準號：ISO/IEC 11770-3-2008
中文標準名稱：信息技術.安全技術.密鑰管理.第3部分:使用不對稱技術的機制
英文標準名稱：Information technology - Security techniques - Key management - Part 3: Mechanisms using asymmetric techniques
標準類型：L04
發布日期：1999/12/31 12:00:00
實施日期：1999/12/31 12:00:00
中國標準分類號：L04
引用標準：ISO/IEC 10118;ISO/IEC 14888
適用范圍：This part of ISO/IEC 11770 defines key management mechanisms based on asymmetric cryptographictechniques. It specifically addresses the use of asymmetric techniques to achieve the following goals.1) Establish a shared secret key for a symmetric cryptographic technique between two entities A and B by key agreement. In a secret key agreement mechanism, the secret key is the result of a data exchange between the two entities A and B. Neither of them can predetermine the value of the shared secret key.2) Establish a shared secret key for a symmetric cryptographic technique between two entities A and B by key transport. In a secret key transport mechanism, the secret key is chosen by one entity A and is transferred to another entity B, suitably protected by asymmetric techniques.3) Make an entity's public key available to other entities by key transport. In a public key transport mechanism, the public key of entity A must be transferred to other entities in an authenticated way, but not requiring secrecy.Some of the mechanisms of this part of ISO/IEC 11770 are based on the corresponding authenticationmechanisms in ISO/IEC 9798-3.This part of ISO/IEC 11770 does not cover aspects of key management such as-- keylifecycle management,-- mechanisms to generate or validate asymmetric key pairs,-- mechanisms to store, archive, delete, destroy, etc. keys.While this part of ISO/IEC 11770 does not explicitly cover the distribution of an entity's private key (of anasymmetric key pair) from a trusted third party to a requesting entity, the key transport mechanisms describedcan be used to achieve this. A private key can in all cases be distributed with these mechanisms where anexisting, non-compromised key already exists. However, in practice the distribution of private keys is usually amanual process that relies on technological means like smart cards, etc.This part of ISO/IEC 11770 does not cover the implementations of the transformations used in the keymanagement mechanisms.NOTE To achieve authenticity of key management messages, it is possible to make provisions for authenticity withinthe key establishment protocol or to use a public key signature system to sign the key exchange messages.