ISO 20038:2017

Name: ISO 20038:2017 — Banking and related financial services — Key wrap using AES
SKU: ISO 20038:2017
Price: 39600 RUB
Availability: InStock

Banking and related financial services — Key wrap using AES

Название (английский):

ISO 20038:2017

Banking and related financial services — Key wrap using AES

Статус документа:: Действующий
Формат:: Электронный (PDF)
Количество страниц:: 22
Дата публикации:: 10 ноября 2017 г.
Издание:: ISO IS 20038 edition 1 version 1
ICS:: 35.240.40

Тип поставки:

Full version39 600 ₽Read online 24h1 200 ₽Read online 72h1 800 ₽

Язык документа:

ruen

Срок поставки:4 раб. дн. (перевод)

Цена:39 600 ₽

Описание (английский):

ISO 20038:2017 defines a method for packaging cryptographic keys for transport. This method can also be used for the storage of keys under an AES key. The method uses the block cipher AES as the wrapping cipher algorithm. Other methods for wrapping keys are outside the scope of this document but can use the authenticated encryption algorithms specified in ISO/IEC 19772.

Abstract

Похожие стандарты

Стандарты, упомянутые в описании

Overview

ISO 20038:2017 - "Banking and related financial services - Key wrap using AES" defines a standardized method for packaging (wrapping) cryptographic keys for secure transport and storage. The standard specifies an AES-based Key Block Binding method that provides both confidentiality and integrity protection for wrapped keys and their associated usage attributes. It is targeted at financial services environments where secure key management and interoperable key exchange are required.

Key topics and technical requirements

Wrapping cipher: Uses the Advanced Encryption Standard (AES) as the wrapping algorithm; supports AES‑128, AES‑192 and AES‑256.

Modes supported: Encryption of the confidential portion is supported in CBC or CTR mode (ISO/IEC 10116).

MAC algorithm: Uses CMAC (cipher‑based MAC, Method 5 in ISO/IEC 9797‑1 / NIST SP 800‑38B). The MAC output is 16 bytes and is used directly in the wrapping process.

Key derivation: The encryption key and MAC key are derived from a pre‑shared Key Block Protection Key using CMAC-based derivation (see Clause 6.3). Derived keys have the same length as the protection key.

Binding method: The CMAC is applied to the concatenation of the unencrypted header and the confidential portion (key + length + optional padding). The resulting MAC is then used as the IV to encrypt the confidential portion, yielding ciphertext that is transmitted together with the header and MAC.

Padding and length masking: For CBC mode, right-side random padding is applied so the confidential portion is a multiple of 16 bytes; CTR mode does not require padding but padding may be used to hide true key length.

Validation and rejection: Receiving Secure Cryptographic Devices (SCDs) must validate header format, ciphertext length (for CBC), derive keys, decrypt with the received MAC as IV, and verify integrity; any failure results in rejection of the key block.

Practical applications and users

ISO 20038:2017 is designed for:

Banks, payment networks and financial institutions needing secure key transport between systems or for long-term key storage.

HSM and SCD (Secure Cryptographic Device) vendors implementing interoperable key wrapping and key block formats.

Security architects, cryptographic engineers and key management teams implementing ISO-compliant key exchange and lifecycle controls.

Organizations seeking standardized AES key wrap for regulatory compliance and secure interoperability across vendors.

Practical uses include inter‑bank key exchange, provisioning symmetric keys to payment terminals, and secure archival of keying material.

Related standards

ISO 11568‑2 - Financial services - Key management (retail)

ISO/IEC 9797‑1 - Message Authentication Codes (MACs)

ISO/IEC 10116 - Modes of operation for an n‑bit block cipher

ISO/IEC 19772 - Authenticated encryption (alternative methods)

ANS X9 TR‑31 / RFC 3394 / NIST AES Key Wrap (context and historical references)

Keywords: ISO 20038:2017, AES key wrap, key wrapping, key block, banking key management, CMAC, CBC, CTR, Key Block Protection Key, secure cryptographic device.

ISO 20038:2017

Abstract

Похожие стандарты

Overview

Key topics and technical requirements

Practical applications and users

Related standards

Технические детали

ISO/IEC 10116:2017/Amd 1:2021

Information technology — Security techniques — Modes of operation for an n-bit block cipher — Amendment 1: CT…

ISO/IEC 9797-1:2011/Amd 1:2023

Information technology — Security techniques — Message Authentication Codes (MACs) — Part 1: Mechanisms using…

ISO 11568-2:2005

Banking — Key management (retail) — Part 2: Symmetric ciphers, their key management and life cycle

BS ISO/IEC 19772:2020

Information security. Authenticated encryption.