ISO/IEC 19790:2012

Overview

ISO/IEC 19790:2012 - "Information technology - Security techniques - Security requirements for cryptographic modules" specifies security requirements for cryptographic modules used to protect sensitive information in computer and telecommunication systems. The standard defines four security levels across a spectrum of data sensitivity and deployment environments and organizes requirements into 11 requirement areas. It is focused on maintaining the security provided by a cryptographic module; compliance does not alone guarantee a module is secure or that it meets a particular owner’s protection needs.

Key topics and technical requirements

ISO/IEC 19790:2012 covers practical, testable security controls for cryptographic modules. Major technical topics include:

• Cryptographic module specification: module types, cryptographic boundary, and modes of operation
• Interfaces: definitions of logical and physical interfaces and requirements for trusted channels
• Roles, services and authentication: role definitions, services offered, and authentication mechanisms
• Software/firmware security: integrity, update controls and authorized code requirements
• Operational environment: requirements for modifiable vs non‑modifiable environments
• Physical security: embodiments, tamper-resistance, and environmental failure protection/testing
• Non‑invasive security: side-channel attack mitigation and related test metrics
• Sensitive security parameter (SSP) management: generation, establishment, storage, entry/output, zeroisation, and random bit generators
• Self‑tests: pre‑operational and conditional self‑tests to verify correct operation
• Life‑cycle assurance: configuration management, secure development, testing, delivery, and end‑of‑life handling
• Mitigation of other attacks: additional protections for unforeseen threats

The standard also includes normative annexes for documentation, an approved security policy structure, approved security functions, approved methods for SSP generation, approved authentication mechanisms, and test metrics for non‑invasive attack mitigation.

Practical applications and users

ISO/IEC 19790 is applied by organizations that design, build, evaluate, procure, or operate cryptographic modules:

• Hardware Security Module (HSM) and smart card manufacturers
• Cryptographic module vendors and firmware developers
• Security architects and system integrators embedding cryptography in products
• Evaluators, auditors and certification bodies assessing module compliance
• Regulated sectors (finance, government, telecom, healthcare) requiring validated cryptographic protection

Benefits include clear, repeatable security requirements for module design, testable controls for certification, and guidance for selecting modules appropriate to data sensitivity and deployment environments.

Related standards

ISO/IEC 19790 aligns with other national and international cryptographic module and IT security standards and is commonly used alongside complementary evaluation and certification frameworks in industry and government procurement.