Information technology — Security techniques — Security requirements for cryptographic modules

ISO/IEC 19790:2006 specifies the security requirements for a cryptographic module utilized within a security system protecting sensitive information in computer and telecommunication systems.

ISO/IEC 19790:2006 specifies the following.

• Four levels of increasing security for cryptographic modules. Each level offers an increase in security over the preceding level.
• The following functional security objectives:
  • module specification;
  • ports and interfaces;
  • roles, services and authentication;
  • finite state model;
  • physical security;
  • operational environment;
  • cryptographic key management;
  • self-tests;
  • design assurance;
  • mitigation of other attacks.

ISO/IEC 19790:2006 will be complemented by a future International Standard defining the associated evaluation and test methods.

ISO/IEC 19790:2006 is derived from NIST Federal Information Processing Standard PUB 140-2 May 25, 2001.