Overview
ISO/IEC 24759:2017 - Information technology - Security techniques - Test requirements for cryptographic modules - defines the standardized test methods and evidence requirements used by testing laboratories to determine whether a cryptographic module conforms to the security requirements in ISO/IEC 19790:2012. The standard is intended to provide objective, repeatable test procedures and to ensure consistent results across laboratories. It also specifies what vendors must supply as supporting evidence and can be used by vendors as pre-test guidance.
Key topics and technical requirements
ISO/IEC 24759:2017 organizes testing around the security areas defined in ISO/IEC 19790 and maps those requirements into explicit testable assertions and vendor/tester actions. Major topics covered include:
- Assertions and test structure
- Security requirements are broken into assertions (AS...). Each assertion lists applicable security levels and is followed by vendor evidence (VE...) and tester (TE...) requirements.
- Cryptographic module specification
- Includes tests for module type, cryptographic boundary, and operational modes.
- Interfaces, roles, services and authentication
- Test methods for module interfaces, trusted channels, role-based services and authentication mechanisms.
- Software/firmware and operational environment
- Examination and testing of firmware integrity and operational environment constraints (modifiable vs non‑modifiable).
- Physical and non-invasive security
- Tests for physical embodiments, tamper resistance and non-invasive attack mitigation.
- Sensitive security parameter (SSP) management
- Requirements and tests for random bit generators, key generation, storage, entry/output, and zeroisation.
- Self-tests and life‑cycle assurance
- Pre-operational and conditional self-tests, development and configuration management, vendor testing, delivery, operation and end-of-life considerations.
- Documentation and supporting evidence
- Specific vendor documentation required to demonstrate conformity (design, test vectors, procedures).
- Mapping to security levels
- Assertions specify which security levels (1–4) they apply to, guiding scope and rigor of testing.
Practical applications and users
ISO/IEC 24759:2017 is used by:
- Testing laboratories and certification bodies to execute objective cryptographic module testing and produce consistent conformity assessments.
- Vendors and product developers as a pre-test checklist and to prepare the required vendor evidence and documentation prior to formal evaluation.
- Procurement officers and security architects to understand what certified cryptographic modules have been tested against and which security levels apply.
- Regulators and auditors seeking standardized test evidence for cryptographic module compliance.
Related standards
- ISO/IEC 19790:2012 - Security requirements for cryptographic modules (normative reference and the primary requirements tested by ISO/IEC 24759).
- Prepared by ISO/IEC JTC 1/SC 27 (Information security techniques).
Keywords: ISO/IEC 24759:2017, cryptographic modules, cryptographic module testing, security requirements, ISO/IEC 19790, testing laboratories, vendor evidence, conformity assessment.
Open preview (PDF)Information technology — Security techniques — Test requirements for cryptographic modules
