ISO/IEC 24759:2025
(Main)Information security, cybersecurity and privacy protection — Test requirements for cryptographic modules
Information security, cybersecurity and privacy protection — Test requirements for cryptographic modules
This document specifies the methods to be used by testing laboratories to test whether the cryptographic module conforms to the requirements specified in ISO/IEC 19790:2025. The methods are developed to provide a high degree of objectivity during the testing process and to ensure consistency across the testing laboratories. This document also specifies the information that vendors are required to provide testing laboratories as supporting evidence to demonstrate their cryptographic modules’ conformity to the requirements specified in ISO/IEC 19790:2025. Vendors can also use this document to verify whether their cryptographic modules satisfy the requirements specified in ISO/IEC 19790:2025 before applying to a testing laboratory for testing.
Sécurité de l’information, cybersécurité et protection de la vie privée — Exigences d'essai pour modules cryptographiques
General Information
Relations
Standards Content (Sample)
International
Standard
ISO/IEC 24759
Fourth edition
Information security,
2025-02
cybersecurity and privacy
protection — Test requirements
for cryptographic modules
Sécurité de l’information, cybersécurité et protection de la vie
privée — Exigences d'essai pour modules cryptographiques
Reference number
© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2025 – All rights reserved
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms. 2
5 Document organization . 2
5.1 General .2
5.2 Assertions and security requirements .3
5.3 Assertions with cross references .3
6 Security requirements . 4
6.1 General .4
6.2 Cryptographic module specification .5
6.2.1 Cryptographic module specification general requirements .5
6.2.2 Types of cryptographic modules .5
6.2.3 Cryptographic boundary .6
6.2.4 Module operations .16
6.3 Cryptographic module interfaces . 23
6.3.1 Cryptographic module interfaces general requirements . 23
6.3.2 Categories of interfaces . 26
6.3.3 Plaintext trusted path . 35
6.3.4 Protected internal paths . 38
6.4 Roles, services, and authentication . 39
6.4.1 Roles, services, and authentication general requirements . 39
6.4.2 Roles . 40
6.4.3 Services .41
6.4.4 Authentication . 49
6.5 Software/firmware security .59
6.5.1 Software/firmware security general requirements .59
6.5.2 Security level 1 .62
6.5.3 Security level 2 .67
6.5.4 Security levels 3 and 4. 68
6.6 Operational environment. 69
6.6.1 Operational environment general requirements . 69
6.6.2 Clause applicability .70
6.6.3 Operating system requirements for modifiable operational environments .71
6.7 Physical security . 83
6.7.1 Physical security embodiments . 83
6.7.2 Physical security general requirements . 84
6.7.3 Physical security requirements for each physical security embodiment . 95
6.7.4 Environmental failure protection/testing . 100
6.7.5 Environmental failure protection features . 100
6.7.6 Environmental failure testing procedures . 101
6.8 Non-invasive security . . 104
6.8.1 Non-invasive security general requirements . 104
6.8.2 Security levels 1 and 2. 104
6.8.3 Security level 3 . 105
6.8.4 Security level 4 . 105
6.9 Sensitive security parameter management . 106
6.9.1 Sensitive security parameter management general requirements . 106
6.9.2 Random bit generators . 108
6.9.3 Sensitive security parameter generation .110
6.9.4 Automated sensitive security parameter establishment .110
© ISO/IEC 2025 – All rights reserved
iii
6.9.5 Sensitive security parameter entry and output . 111
6.9.6 Sensitive security parameter storage .117
6.9.7 Sensitive security parameter zeroization . 118
6.10 Self-tests . 122
6.10.1 Self-test general requirements . 122
6.10.2 Security levels 3 and 4. 126
6.10.3 Pre-operational self-tests . 127
6.10.4 Conditional self-tests . 130
6.11 Life-cycle assurance .143
6.11.1 Life-cycle assurance general requirements .143
6.11.2 Configuration management .143
6.11.3 Design .145
6.11.4 Finite state model .145
6.11.5 Development . 149
6.11.6 Vendor testing . 155
6.11.7 Delivery and operation . 157
6.11.8 Guidance documents . 160
6.12 Mitigation of other attacks .161
6.12.1 Mitigation of other attacks general requirements .161
6.12.2 Security levels 1, 2 and 3 .161
6.12.3 Security level 4 .161
7 Documentation
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.