ISO/IEC 18031:2025

Overview

ISO/IEC 18031:2025 - "Information technology - Security techniques - Random bit generation" defines a conceptual model and security requirements for random bit generators (RBGs) used for cryptographic purposes. The standard covers both non-deterministic random bit generators (NRBGs) and deterministic random bit generators (DRBGs), specifying the characteristics of their main elements (e.g., entropy/randomness sources, internal state, state transition and output generation functions, and health tests). ISO/IEC 18031:2025 focuses on high-level requirements and models; detailed algorithm designs and techniques for independent statistical testing or validation are explicitly outside its scope.

Key Topics and Requirements

• Conceptual RBG model: Defines a functional model and the basic components of an RBG to support consistent implementations.
• Component characteristics: Requirements for randomness/entropy sources, additional inputs, internal state, state transition functions, and the output generation function.
• NRBG vs DRBG: Distinguishes non-deterministic (physical or hybrid entropy sources) and deterministic (seeded algorithmic) generators and their unique requirements.
• Entropy sources: Treatment of primary entropy sources (physical and non-physical), additional entropy inputs, and hybrid approaches.
• Health tests and monitoring: Requirements for on-line and periodic health tests, integrity checks, and failure-handling to detect degraded randomness or component faults.
• Security requirements: High-level security objectives for confidentiality and unpredictability of outputs, management of internal state, and rules for seed/ key handling in DRBGs.
• Normative and informative annexes: Guidance on combining RBGs, conversion methods for random numbers, examples, security considerations, entropy estimation, and assurance.

Applications and Users

ISO/IEC 18031:2025 is intended for organizations and professionals who design, implement, evaluate, or use cryptographic random number generation, including:

• Cryptographic engineers and protocol designers building secure key generation, TLS session keys, digital signatures, and secure token systems.
• Hardware designers of TRNGs, HSMs, secure elements, and IoT devices requiring reliable entropy.
• Software developers integrating RNGs into operating systems, libraries, or security applications.
• Security architects, auditors, and compliance teams assessing RNG security posture and conformity with best-practice standards.

Practical use cases include secure key generation, secure boot and firmware protection, cryptographic protocol randomness, and any application where unpredictable random bits are critical to security.

Related Standards

Implementers should consider this standard alongside related ISO/IEC security and cryptography standards and national guidelines for random number generation and entropy assessment to ensure comprehensive compliance and validation.