ISO/IEC 20543:2019

Overview

ISO/IEC 20543:2019 specifies a methodology for the evaluation, testing and analysis of random bit generators (RBGs) used in cryptographic applications. It is an implementation‑agnostic standard that enables vendors to submit well‑defined security claims about both non‑deterministic (NRBG) and deterministic (DRBG) generators and enables evaluators or validation authorities to verify, certify or reject those claims. The standard focuses on evaluation methodology (stochastic models, entropy assessment, statistical testing) rather than design or implementation guidance. It also clarifies that post‑processing to map bit strings to application‑specific distributions is outside the scope.

Key technical topics and requirements

• Scope and purpose: Methodology for evaluating RBGs within the frameworks of ISO/IEC 19790 and ISO/IEC 15408 (cryptographic module and Common Criteria contexts).
• NRBG vs DRBG: Separate treatment of non‑deterministic and deterministic generators, including modelling of entropy sources and seed requirements.
• Stochastic modelling of entropy sources: Requirement to support a stochastic model with technical arguments based on the device’s design and observed behaviour.
• Entropy analysis: Emphasis on estimating min‑entropy and other entropy measures relative to a realistic attacker model.
• Conformance testing: Vendor documentation, design evidence, entropy justification, and statistical testing to support claims.
• Secrecy properties: Definitions and evaluation considerations for backward secrecy, enhanced backward secrecy, and enhanced forward secrecy (prediction resistance).
• Statistical methodology and test files: Normative annex on statistical methods and informative annex with example test files to support reproducible evaluation.
• Implementation‑agnostic: No prescriptive design rules; the standard requires evidence and arguments linking design to claimed entropy and behaviour.

Practical applications - who uses ISO/IEC 20543:2019

• Cryptographic module vendors preparing RBG security claims for certification.
• Independent test laboratories and validation authorities performing conformity testing and certification (e.g., FIPS/CC testing contexts).
• Security engineers and architects who need to assess or document RBG behaviour, entropy sources, and resistance to prediction.
• Compliance officers and procurement teams evaluating the suitability of cryptographic components for regulated environments.

Related standards

• ISO/IEC 19790 - Security requirements for cryptographic modules (context for RBG evaluation).
• ISO/IEC 15408 - Evaluation criteria (Common Criteria) used alongside this methodology.
• ISO/IEC 18031:2011 - Random bit generation (background and terminology).
• ISO/IEC 17825 and ISO/IEC 24759 - Related testing methodologies referenced for broader cryptographic testing.

ISO/IEC 20543:2019 is essential if you need a rigorous, standards‑aligned method to justify and validate the security of random bit generation in cryptographic systems.