ISO/IEC FDIS 24759
(Main)Information security, cybersecurity and privacy protection — Test requirements for cryptographic modules
Information security, cybersecurity and privacy protection — Test requirements for cryptographic modules
Titre manque
General Information
Relations
Buy Standard
Standards Content (Sample)
FINAL DRAFT
International
Standard
ISO/IEC FDIS
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection — Test
Voting begins on:
requirements for cryptographic
2024-11-26
modules
Voting terminates on:
2025-01-21
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
Reference number
FINAL DRAFT
International
Standard
ISO/IEC FDIS
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection — Test
Voting begins on:
requirements for cryptographic
modules
Voting terminates on:
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
© ISO/IEC 2024
IN ADDITION TO THEIR EVALUATION AS
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
or ISO’s member body in the country of the requester.
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland Reference number
© ISO/IEC 2024 – All rights reserved
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms. 2
5 Document organization . 2
5.1 General .2
5.2 Assertions and security requirements .3
5.3 Assertions with cross references .3
6 Security requirements . 4
6.1 General .4
6.2 Cryptographic module specification .5
6.2.1 Cryptographic module specification general requirements .5
6.2.2 Types of cryptographic modules .5
6.2.3 Cryptographic boundary .6
6.2.4 Module operations .16
6.3 Cryptographic module interfaces . 23
6.3.1 Cryptographic module interfaces general requirements . 23
6.3.2 Categories of interfaces . 26
6.3.3 Plaintext trusted path . 35
6.3.4 Protected internal paths . 38
6.4 Roles, services, and authentication . 39
6.4.1 Roles, services, and authentication general requirements . 39
6.4.2 Roles . 40
6.4.3 Services .41
6.4.4 Authentication . 50
6.5 Software/firmware security .61
6.5.1 Software/firmware security general requirements .61
6.5.2 Security level 1 . 63
6.5.3 Security level 2 . 68
6.5.4 Security levels 3 and 4.70
6.6 Operational environment.71
6.6.1 Operational environment general requirements .71
6.6.2 Clause applicability .71
6.6.3 Operating system requirements for modifiable operational environments . 73
6.7 Physical security . 84
6.7.1 Physical security embodiments . 84
6.7.2 Physical security general requirements . 85
6.7.3 Physical security requirements for each physical security embodiment . 96
6.7.4 Environmental failure protection/testing . 101
6.7.5 Environmental failure protection features . 101
6.7.6 Environmental failure testing procedures . 102
6.8 Non-invasive security . . 105
6.8.1 Non-invasive security general requirements . 105
6.8.2 Security levels 1 and 2. 105
6.8.3 Security level 3 . 106
6.8.4 Security level 4 . 106
6.9 Sensitive security parameter management . 107
6.9.1 Sensitive security parameter management general requirements . 107
6.9.2 Random bit generators . 109
6.9.3 Sensitive security parameter generation . 111
6.9.4 Automated sensitive security parameter establishment . 111
© ISO/IEC 2024 – All rights reserved
iii
6.9.5 Sensitive security parameter entry and output . 112
6.9.6 Sensitive security parameter storage . 118
6.9.7 Sensitive security parameter zeroization .119
6.10 Self-tests . 123
6.10.1 Self-test general requirements . 123
6.10.2 Security levels 3 and 4. 127
6.10.3 Pre-operational self-tests .128
6.10.4 Conditional self-tests . 132
6.11 Life-cycle assurance .145
6.11.1 Life-cycle assurance general requirements .145
6.11.2 Configuration management .145
6.11.3 Design .147
6.11.4 Finite state model .147
6.11.5 Development . 151
6.11.6 Vendor testing .
...
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
FDIS ISO/IEC FDIS 24759(E:2024(en)
Style Definition
...
ISO/IEC JTC 1/SC 27/WG 3
Style Definition
...
Style Definition
...
Secretariat: DIN
Style Definition
...
Date: 2024-06-0111-12
Style Definition
...
Style Definition
Information security, cybersecurity and privacy protection — Test requirements for
...
cryptographic modules
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
FDIS stage .
Style Definition
...
Style Definition
...
Style Definition
...
Warning for WDs and CDs
Style Definition
...
This document is not an ISO International Standard. It is distributed for review and comment. It is subject to
Style Definition
...
change without notice and may not be referred to as an International Standard.
Style Definition
...
Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of
Style Definition
...
which they are aware and to provide supporting documentation.
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
A model document of an International Standard (the Model International Standard) is available at:
https://www.iso.org/drafting-standards.html
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
Style Definition
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
FDIS ISO/IEC 24759 (E)
© ISO/IEC 2024
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no
Formatted: Font: 11 pt, Font color: Blue
part of this publication may be reproduced or utilized otherwise in any form or by any means,
Formatted: Border: Box: (Single solid line, Blue, 0.5 pt
electronic or mechanical, including photocopying, or posting on the internet or an intranet, without
Line width)
prior written permission. Permission can be requested from either ISO at the address below or ISO’s
member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Formatted: Font: 11 pt, Font color: Blue, German
(Germany)
Website: www.iso.orgwww.iso.org
Formatted: Font: 11 pt, Font color: Blue
Formatted: Font: 11 pt, Font color: Blue
Published in Switzerland
iv
FDIS ISO/IEC 24759 (E)
Contents Formatted: Space Before: 48 pt, Don't adjust space
between Latin and Asian text, Don't adjust space
between Asian text and numbers
Introduction . vii
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms . 2
5 Document organization . 2
5.1 General . 2
5.2 Assertions and security requirements . 3
5.3 Assertions with cross references . 3
6 Security requirements . 4
6.1 General . 4
6.2 Cryptographic module specification . 5
6.2.1 Cryptographic module specification general requirements . 5
6.2.2 Types of cryptographic modules . 5
6.2.3 Cryptographic boundary . 6
6.2.4 Module operations . 18
6.3 Cryptographic module interfaces . 26
6.3.1 Cryptographic module interfaces general requirements . 26
6.3.2 Categories of interfaces . 29
6.3.3 Plaintext trusted path . 40
6.3.4 Protected internal paths . 43
6.4 Roles, services, and authentication . 44
6.4.1 Roles, services, and authentication general requirements . 44
6.4.2 Roles . 45
6.4.3 Services . 47
6.4.4 Authentication . 57
6.5 Software/firmware security . 69
6.5.1 Software/firmware security general requirements . 69
6.5.2 Security level 1 . 72
6.5.3 Security level 2 . 78
6.5.4 Security levels 3 and 4 . 80
6.6 Operational environment. 81
6.6.1 Operational environment general requirements . 81
6.6.2 Clause applicability . 81
6.6.3 Operating system requirements for modifiable operational environments . 83
6.7 Physical security . 96
6.7.1 Physical security embodiments . 96
6.7.2 Physical security general requirements . 97
6.7.3 Physical security requirements for each physical security embodiment . 110
6.7.4 Environmental failure protection/testing . 116
6.7.5 Environmental failure protection features . 116
6.7.6 Environmental failure testing procedures . 118
6.8 Non-invasive security . 121
6.8.1 Non-invasive security general requirements . 121
6.8.2 Security levels 1 and 2 . 121
6.8.3 Security level 3 . 122
6.8.4 Security level 4 . 122
6.9 Sensitive security parameter management . 123
v
FDIS ISO/IEC 24759 (E)
6.9.1 Sensitive security parameter management general requirements . 123
6.9.2 Random bit generators . 126
6.9.3 Sensitive security parameter generation . 127
6.9.4 Automated sensitive security parameter establishment . 128
6.9.5 Sensitive security parameter entry and output . 129
6.9.6 Sensitive security parameter storage . 136
6.9.7 Sensitive security parameter zeroization . 136
6.10 Self-tests . 141
6.10.1 Self-test general requirements . 141
6.10.2 Security levels 3 and 4 . 146
6.10.3 Pre-operational self-tests . 147
6.10.4 Conditional self-tests . 151
6.11 Life-cycle assurance . 166
6.11.1 Life-cycle assurance general requirements . 166
6.11.2 Configuration management . 167
6.11.3 Design . 169
6.11.4 Finite state model . 169
6.11.5 Development . 173
6.11.6 Vendor testing . 180
6.11.7 Delivery and operation . 182
6.11.8 Guidance documents . 186
6.12 Mitigation of other attacks . 187
6.12.1 Mitigation of other attacks general requirements . 187
6.12.2 Security levels 1, 2 and 3 . 187
6.12.3 Security level 4 . 188
7 Documentation requirements . 188
7.1 Purpose . 188
7.2 Items . 189
7.2.1 Cryptographic module specification . 189
7.2.2 Cryptographic module interfaces . 190
7.2.3 Roles, services, and authentication . 190
7.2.4 Software/Firmware security . 191
7.2.5 Operational environment. 192
7.2.6 Physical security . 192
7.2.7 Non-invasive security . 193
7.2.8 Sensitive security parameter management . 194
7.2.9 Self-tests . 195
7.2.10 Life-cycle assurance . 195
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.