ISO/IEC 18367:2016

Information technology — Security techniques — Cryptographic algorithms and security mechanisms conformance testing

ISO/IEC 18367:2016 gives guidelines for cryptographic algorithms and security mechanisms conformance testing methods. Conformance testing assures that an implementation of a cryptographic algorithm or security mechanism is correct whether implemented in hardware, software or firmware. It also confirms that it runs correctly in a specific operating environment. Testing can consist of known-answer or Monte Carlo testing, or a combination of test methods. Testing can be performed on the actual implementation or modelled in a simulation environment. ISO/IEC 18367:2016 does not include the efficiency of the algorithms or security mechanisms nor the intrinsic performance. This document focuses on the correctness of the implementation.

Technologie de l'information — Techniques de sécurité — Essais de conformité des algorithmes cryptographiques et des mécanismes de sécurité

General Information

• Status: Published
• Publication Date: 07-Dec-2016
• ICS: 35.030 - IT Security
• ICS: 35.040 - Information coding
• Technical Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Drafting Committee: ISO/IEC JTC 1/SC 27/WG 3 - Security evaluation, testing and specification

Relations

• Consolidated By: ISO 15653:2018 - Metallic materials — Method of test for the determination of quasistatic fracture toughness of welds
• Effective Date: 06-Jun-2022

Standards Content (Sample)

INTERNATIONAL ISO/IEC
STANDARD 18367
First edition
2016-12-15
Information technology — Security
techniques — Cryptographic
algorithms and security mechanisms
conformance testing
Technologie de l’information — Techniques de sécurité — Essais de
conformité des algorithmes cryptographiques et des mécanismes de
sécurité
Reference number
©
ISO/IEC 2016
© ISO/IEC 2016, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. [phone]
Fax [phone]
[e-mail]
www.iso.org
ii © ISO/IEC 2016 – All rights reserved

Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms . 6
5 Objectives . 7
6 Types of cryptographic algorithms and security mechanisms from a conformance
testing perspective . 8
6.1 General . 8
6.2 Asymmetric key algorithms . 8
6.3 Digital signature . 8
6.4 Digital signature with message recovery . 8
6.5 Hashing algorithms . 8
6.6 Key establishment mechanisms . 8
6.7 Lightweight cryptography . 9
6.8 Message authentication algorithms . 9
6.9 Random bit generator algorithms . 9
6.9.1 Deterministic random bit generator algorithms . 9
6.9.2 Non-deterministic random bit generator algorithms . 9
6.10 Symmetric key algorithms .10
6.10.1 Block cipher symmetric key algorithms .10
6.10.2 Stream cipher symmetric key algorithms .10
7 Conformance testing methodologies .10
7.1 Overview .10
7.2 Black box testing.11
7.2.1 General.11
7.2.2 Known-answer test vectors .11
7.2.3 Multi-block message testing .11
7.2.4 Monte Carlo or statistical testing .11
7.3 Glass box or white box testing .11
7.3.1 Source code inspection .11
7.3.2 Binary analysis.11
8 Levels of conformance testing .12
8.1 Introduction .12
8.2 Level of basic conformance testing .12
8.3 Level of moderate conformance .12
9 Conformance testing guidelines .12
9.1 General guidelines.12
9.1.1 Identification .12
9.1.2 Guidelines for black box testing .13
9.1.3 Guidelines for white box testing .13
9.2 Guidelines specific to encryption algorithms .16
9.2.1 Identification of encryption algorithms .16
9.2.2 Selecting a set of conformance test items .17
9.2.3 Guidelines for each conformance test item.18
9.3 Guidelines specific to digital signature algorithms .29
9.3.1 Identification of digital signature algorithms .29
9.3.2 Selecting a set of conformance test items .29
9.3.3 Guidelines for each conformance test item.29
9.4 Guidelines specific to hashing algorithms .30
© ISO/IEC 2016 – All rights reserved iii

9.4.1 Identification of hashing algorithms .30
9.4.2 Selecting a set of conformance test items .31
9.4.3 Guidelines for each conformance test item.31
9.5 Guidelines specific to MAC algorithms .33
9.5.1 Identification of MAC algorithms .33
9.5.2 Selecting a set of conformance test items .34
9.5.3 Guidelines for each conformance test item.34
9.6 Guidelines specific to RBG algorithms .35
9.6.1 Identification of RBG algorithms .35
9.6.2 Selecting a set of conformance test items .35
9.6.3 Guidelines for each conformance test item.35
9.7 Guidelines specific to key establishment mechanisms .36
9.7.1 Identification of key establishment mechanisms .36
9.7.2 Selecting a set of conformance test items .36
9.7.3 Guidelines for each conformance test item.37
9.8 Guidelines specific to key derivation function .39
9.8.1 Identification of key derivation function .39
9.8.2 Selecting a set of conformance test items .39
9.8.3 Guidelines for each conformance test item.39
9.9 Guidelines specific to prime number generation .40
9.9.1 Identification of prime number generation .40
9.9.2 Selecting a set of conformance test items .40
9.9.3 Guidelines for each conformance test item.41
10 Conformance testing .41
10.1 Level of conformance testing .41
10.2 Symmetric key cryptographic algorithms .42
10.2.1 n-bit block cipher .42
10.3 Asymmetric key cryptographic algorithms .43
10.3.1 Digital Signature Algorithm (DSA) .43
10.3.2 RSA .
...