This research provides a computational analysis of the ISO 9798-6 standard’s Mechanism 7a authentication protocol. In contrast to typical authentication protocols, ISO 9798-6 mechanism 7a requires user interaction and aims to authenticate data possession instead of identities. Consequently, we introduce a 3-party possession user mediated authentication (3-PUMA) model. Furthermore, we demonstrate the necessary security guarantees of the MAC primitive – which include non-standard assumptions – and introduce existential unforgeability under key collision attacks (EUF-KCA). The resulting analysis demonstrates a notable lack in the standard’s requirements and has implications for other PUMA protocols.