Overview
ISO/IEC 23837-1:2023 - "Information security - Security requirements, test and evaluation methods for quantum key distribution - Part 1: Requirements" defines a baseline framework for the security evaluation of quantum key distribution (QKD) modules. Published in 2023, this first-part standard aligns QKD security requirements with the ISO/IEC 15408 (Common Criteria) evaluation framework and specifies common security functional requirements (SFRs) covering both conventional network components and quantum optical elements, plus the end-to-end implementation of QKD protocols.
Key topics and technical requirements
- Scope and structure of QKD implementations: defines external interfaces (quantum channel, control/management, key management), internal components for transmitter and receiver modules, and TOE/TSF definitions.
- Theoretical and protocol analysis: overview of QKD principles, protocol classification and architecture to support SFR mapping.
- Security problem analysis: identification of assumptions, asset analysis, and threats to both classical network components and quantum optical components (including side-channel and implementation vulnerabilities).
- Baseline Security Functional Requirements (SFRs): a common set of SFRs mapped to QKD use - examples include audit data generation (FAU_GEN.1), cryptographic operations and RNG (FCS_COP.1, FCS_RNG.1), access and information-retention controls (FDP_), TSF management (FMT_), and inter-TSF confidentiality/integrity (FPT_ITC.1, FPT_ITI.1).
- QKD-specific extensions: new or extended functional components such as FTP_QKD for protocol/raw data generation and post-processing, plus requirements for quantum emanation and physical resistance of optical components.
- Conformance and evaluation guidance: conformance statement templates and an informative annex offering guidance for developing protection profiles for QKD modules.
Applications and intended users
This standard is practical for:
- QKD manufacturers and system integrators designing secure QKD hardware and software to meet internationally recognized SFRs.
- Security evaluators and testing laboratories performing Common Criteria–based assessments of QKD modules.
- Security architects and product assurance teams who need to translate QKD protocol models into testable requirements and mitigate implementation vulnerabilities (e.g., side-channel risks).
- Purchasing organizations, regulators, and certification bodies requiring verifiable security claims for QKD deployments in sectors such as finance, government, telecom and critical infrastructure.
Related standards
- ISO/IEC 15408 series (Common Criteria) - evaluation framework used throughout this document.
- ISO/IEC 19790 and relevant standards on testing cryptographic modules and network devices - referenced for methodology on conventional components.
- Other parts of the ISO/IEC 23837 series - for test and evaluation methods beyond the requirements specified in Part 1.
Keywords: ISO/IEC 23837-1:2023, quantum key distribution, QKD security, security functional requirements, Common Criteria, quantum optical components, security evaluation, cryptographic modules.