Overview
ISO/TR 14742:2010 - Financial services: Recommendations on cryptographic algorithms and their use is a Technical Report from ISO/TC 68 that provides guidance on cryptographic algorithms and key-length strategy specifically for the financial services sector. It does not define new algorithms; instead it lists recommended algorithms, gives guidance on key lengths, usage dates, and migration strategy, and focuses on algorithm selection rather than protocol design. The report is informative and intended to be updated more frequently than formal standards.
Key topics and technical requirements
- Algorithm categories covered: block ciphers, stream ciphers, hash functions, message authentication codes (MACs), asymmetric algorithms (digital signatures, asymmetric ciphers), authentication mechanisms, key establishment/agreement and transport mechanisms.
- Measuring bits of security: introduces the notion of “n bits of security” (e.g., collision resistance for hashes, computational work for symmetric ciphers) and maps bit-strength to recommended usage periods (e.g., 80-bit until end 2010; 96-bit until 2020; 112-bit until 2030; 128-bit from 2030 onward).
- Algorithm migration: strategic guidance for migrating between algorithms or increasing security parameters (e.g., moving from TDEA to AES; increasing RSA key lengths), and notes trade-offs between parameter changes versus full algorithm replacements.
- Practical algorithm guidance: discussions on block size, keying options, operation modes, hash-function properties, MAC length and key span, asymmetric algorithm classes (factorization, DLP, EC), and random number generation.
- Security horizon & quantum considerations: addresses quantum-computing impacts (e.g., Grover’s algorithm effect on symmetric key sizes and vulnerability of current asymmetric algorithms) and the need for future reassessment.
- References and related implementation info: points readers to algorithm-defining ISO standards and other guidance (e.g., NIST SP 800-57) for implementation details and selection of security parameters.
Applications and who uses it
ISO/TR 14742:2010 is aimed at:
- Security architects and cryptographers designing or reviewing cryptographic protections for financial systems.
- Standards writers and implementers within ISO/TC 68 and organizations adopting ISO financial services standards.
- Compliance officers and auditors evaluating whether algorithm choices and key lifecycles meet industry recommendations.
- Vendors and software developers building payment, banking, or other financial applications that require approved cryptographic algorithms and migration plans.
Practical uses include selecting AES/TDEA strengths, choosing hash and MAC algorithms, defining key-expiry policies, and planning algorithm migration timelines.
Related standards
- ISO/TC 68 financial services standards (referenced algorithm definitions)
- ISO 11568 series (key management)
- NIST SP 800-57 (bits-of-security guidance)
Keywords: ISO/TR 14742:2010, cryptographic algorithms, financial services security, key lengths, algorithm migration, block cipher, hash function, MAC, asymmetric algorithms.