Name: ISO/IEC 17825:2024 — Information technology — Security techniques — Testing methods for the mitigation of non-invasive attack classes against cryptographic modules
SKU: ISO/IEC 17825:2024
Price: 25 EUR
Availability: InStock

ISO/IEC 17825:2024 PDF

Information technology — Security techniques — Testing methods for the mitigation of non-invasive attack classes against cryptographic modules

Название (английский):

ISO/IEC 17825:2024

Information technology — Security techniques — Testing methods for the mitigation of non-invasive attack classes against cryptographic modules

Статус документа:: Действующий
Формат:: Электронный (PDF)
Количество страниц:: 38
Дата публикации:: 19 января 2024 г.
Издание:: ISO/IEC IS 17825 edition 2 version 1
ICS:: 35.030

Тип поставки:

Full version570 €Read online 24h10 €Read online 72h15 €

Язык документа:

ruen

Срок поставки:7 раб. дн. (перевод)

Цена:570 €

Описание (английский):

This document specifies the non-invasive attack mitigation test metrics for determining conformance to the requirements specified in ISO/IEC 19790:2012 for security levels 3 and 4. The test metrics are associated with the security functions addressed in ISO/IEC 19790:2012. Testing is conducted at the defined boundary of the cryptographic module and the inputs/outputs available at its defined boundary. This document is intended to be used in conjunction with ISO/IEC 24759:2017 to demonstrate conformance to ISO/IEC 19790:2012. NOTE ISO/IEC 24759:2017 specifies the test methods used by testing laboratories to assess whether the cryptographic module conforms to the requirements specified in ISO/IEC 19790:2012 and the test metrics specified in this document for each of the associated security functions addressed in ISO/IEC 19790:2012. The test approach employed in this document is an efficient “push-button” approach, i.e. the tests are technically sound, repeatable and have moderate costs.

Overview

ISO/IEC 17825:2024 - "Information technology - Security techniques - Testing methods for the mitigation of non-invasive attack classes against cryptographic modules" - specifies test metrics and repeatable test methods to evaluate the resistance of cryptographic modules to non‑invasive attacks. Focused on security levels 3 and 4 of ISO/IEC 19790:2012, the second edition updates side‑channel and other non‑invasive test methods, and provides a pragmatic, cost‑moderate “push‑button” testing approach performed at the module’s defined boundary.

Key topics and requirements

Non‑invasive attack classes: side‑channel analysis (timing, SPA/SEMA, DPA/DEMA), advanced side‑channel attacks on asymmetric algorithms, and other non‑intrusive leakage paths.
Side‑channel analysis workflow: a core test flow and a structured resistance test framework that includes vendor information needs, leakage analysis steps, and test strategies.
Test metrics and pass/fail criteria: normative pass/fail metrics are defined (see Annex A) for mapping test outcomes to the security functions in ISO/IEC 19790:2012.
Measurement and quality: informative annexes describe requirements for measurement apparatus, quality criteria for setups, and guidance on when leakage is assessed as non‑measurable.
Scope and limitations: testing is closed‑box (external inputs/outputs only), aimed at producing repeatable, technically sound results. The standard notes that closed‑box testing provides a “controlled” level of reasonable confidence but does not guarantee coverage of all possible attacks.
Updated content: this edition reflects recent research trends, introduces an explanatory introduction on expected assurance levels, and improves requirement traceability.

Applications and who should use it

ISO/IEC 17825:2024 is intended for:

Testing laboratories performing conformance testing against ISO/IEC 19790 (used together with ISO/IEC 24759:2017).
Security evaluators and certification bodies assessing cryptographic modules at security levels 3 and 4.
Device and firmware vendors designing modules to withstand non‑invasive attacks; the standard clarifies required vendor information to support testing.
Security architects and engineers building threat models and deciding appropriate countermeasures against side‑channel and timing attacks. Practical applications include evaluation of hardware security modules (HSMs), secure elements, smartcards, and other cryptographic modules where physical or side‑channel leakage is a concern.

Related standards

ISO/IEC 19790:2012 - security requirements for cryptographic modules (conformance target).
ISO/IEC 24759:2017 - test methods used by labs to assess conformance to ISO/IEC 19790 and the test metrics in ISO/IEC 17825.
Relevant measurement and calibration guidance referenced by the standard (see informative annexes).

Keywords: ISO/IEC 17825:2024, non‑invasive attack testing, cryptographic module testing, side‑channel analysis, DPA, SPA, timing attacks, ISO/IEC 19790, ISO/IEC 24759.

ISO/IEC 17825:2024 PDF

Похожие стандарты

Abstract

Overview

Key topics and requirements

Applications and who should use it

Related standards

Технические детали

EN ISO/IEC 19896-2:2026

Information security, cybersecurity and privacy protection - Requirements for the competence of IT security c…

BS ISO/IEC 17825:2024

Information technology. Security techniques. Testing methods for the mitigation of non-invasive attack classe…

ISO 8689-1:2000

Water quality — Biological classification of rivers — Part 1: Guidance on the interpretation of biological qu…

ISO/ASTM51540-04(2012)

Standard Practice for Use of a Radiochromic Liquid Dosimetry System (Withdrawn 2020)

ISO/ASTM51204-04

Standard Practice for Dosimetry in Gamma Irradiation Facilities for Food Processing (Withdrawn 2013)

ISO/ASTM51431-05

Standard Practice for Dosimetry in Electron Beam and X-Ray (Bremsstrahlung) Irradiation Facilities for Food P…

ISO/ASTM52628-20e1

Standard Practice for Dosimetry in Radiation Processing

ISO/ASTM52921-13(2019)

Standard Terminology for Additive Manufacturing—Coordinate Systems and Test Methodologies