iTeh StandardsiTeh Standards
EURUSD
Your shopping cart is empty.
ISO

ISO/IEC 23837-2:2023

(Main)

Information security — Security requirements, test and evaluation methods for quantum key distribution — Part 2: Evaluation and testing methods

Information security — Security requirements, test and evaluation methods for quantum key distribution — Part 2: Evaluation and testing methods

This document specifies test and evaluation methods for the security evaluation of quantum key distribution (QKD). It also describes evaluation activities that constitute the test and evaluation methods for the security functional requirements on the implementation of QKD protocols, the quantum optical components and conventional network components in QKD modules. Moreover, supplementary evaluation activities for security assurance requirements are provided to support the security evaluation of QKD with appropriate assurance levels.

Sécurité de l'information — Exigences de sécurité, méthodes d'essais et d'évaluation relatives à la distribution quantique de clés — Partie 2: Méthodes d'essais et d'évaluation

General Information

Status
Published
Publication Date
24-Sep-2023
ICS
35.030 - IT Security
Technical Committee
ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
Drafting Committee
ISO/IEC JTC 1/SC 27/WG 3 - Security evaluation, testing and specification
Current Stage
6060 - International Standard published
Start Date
25-Sep-2023
Due Date
24-Apr-2023
Completion Date
25-Sep-2023
Ref Project

Buy Standard

ISO/IEC 23837-2:2023 - Information security — Security requirements, test and evaluation methods for quantum key distribution — Part 2: Evaluation and testing methods Released:25. 09. 2023ISO/IEC 23837-2:2023 - Information security — Security requirements, test and evaluation methods for quantum key distribution — Part 2: Evaluation and testing methods Released:25. 09. 2023
PreviousNext
Standard
ISO/IEC 23837-2:2023 - Information security — Security requirements, test and evaluation methods for quantum key distribution — Part 2: Evaluation and testing methods Released:25. 09. 2023
English language
106 pages
sale 15% off
Preview
sale 15% off
Preview

Standards Content (Sample)


INTERNATIONAL ISO/IEC
STANDARD 23837-2
First edition
2023-09
Information security — Security
requirements, test and evaluation
methods for quantum key
distribution —
Part 2:
Evaluation and testing methods
Sécurité de l'information — Exigences de sécurité, méthodes d'essais
et d'évaluation relatives à la distribution quantique de clés —
Partie 2: Méthodes d'essais et d'évaluation
Reference number
© ISO/IEC 2023
© ISO/IEC 2023
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
© ISO/IEC 2023 – All rights reserved

Contents Page
Foreword . vi
Introduction .vii
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 3
5 Overview of the evaluation method for QKD modules . 4
5.1 General . 4
5.2 Scope of the evaluation method . 4
5.3 Overview of evaluation activities for SFRs . 5
5.3.1 General . 5
5.3.2 EAs for SFRs FTP_QKD.1 and FTP_QKD.2 . 6
5.3.3 EAs for SFRs on quantum optical components and parameter adjustment
procedure(s) . 6
5.3.4 EAs for SFRs on conventional network components . 7
5.3.5 Thresholds and input parameters related to the evaluation activities . 7
5.4 Overview of evaluation activities for SARs . 8
6 EAs for the evaluation of FTP_QKD . 8
6.1 General . 8
6.2 EA to test quantum state transmission and sifting procedures . 10
6.2.1 General aspects . 10
6.2.2 Test procedure.12
6.2.3 Pass/fail criteria . 14
6.3 EA to test other post-processing procedures . 14
6.3.1 General aspects . 14
6.3.2 Test procedure. 16
6.3.3 Pass/fail criteria . 17
6.4 EA to test parameter adjustment procedure(s) . 17
6.4.1 General aspects . 17
6.4.2 Test procedure. 19
6.4.3 Pass/fail criteria . 19
7 EAs for evaluating quantum optical components in the transmitter module .19
7.1 General . 19
7.2 EA to test the photon-number distribution of optical pulses .22
7.2.1 General aspects . 22
7.2.2 Test procedure. 24
7.2.3 Pass/fail criteria .25
7.3 EA to test the mean photon number and stability of optical pulses . 25
7.3.1 General aspects . 25
7.3.2 Test procedure.26
7.3.3 Pass/fail criteria .28
7.4 EA to test the independence of the intensities of optical pulses .28
7.4.1 General aspects .28
7.4.2 Test procedure.29
7.4.3 Pass/fail criteria .30
7.5 EA to test the accuracy of state encoding .30
7.5.1 General aspects . 30
7.5.2 Test procedure. 31
7.5.3 Pass/fail criteria . 32
7.6 EA to test the indistinguishability of encoded states . 32
7.6.1 General aspects . 32
7.6.2 Test procedure.34
iii
© ISO/IEC 2023 – All rights reserved

7.6.3 Pass/fail criteria . 35
7.7 EA to test the uniform distribution of the global phase of optical pulses .36
7.7.1 General aspects . 36
7.7.2 Test procedure. 37
7.7.3 Pass/fail criteria .38
7.8 EA to test the degree of optical isolation of the TX module .38
7.8.1 General aspects .38
7.8.2 Test procedure.40
7.8.3 Pass/fail criteria .40
7.9 EA to test the sensitivity of the injected light monitor in the TX module.40
7.9.1 General aspects .40
7.9.2 Test procedure. 41
7.9.3 Pass/fail criteria . 42
7.10 EA to test the robustness of the TX module against laser injection . 42
7.10.1 General aspects . 42
7.10.2 Test procedure.44
7.10.3 Pass/fail criteria .46
8 EAs for the evaluation of quantum optical components in the receiver module .47
8.1 General . 47
8.2 EA to test the consistency of detection probability in the RX module .49
8.2.1 General aspects .49
8.2.2 Test procedure. 51
8.2.3 Pass/fail criteria . 51
8.3 EA to test information leakage of back-flashes from the RX module . 52
8.3.1 General aspects . 52
8.3.2 Test procedure.
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.

This May Also Interest You

ISO
ISO/IEC 19790:2025(Main)
Information security, cybersecurity and privacy protection — Security requirements for cryptographic modules

This document specifies the security requirements for a cryptographic module utilized within a security system protecting sensitive information in Information and Communication Technologies (ICT). It defines four security levels for cryptographic modules to provide for a wide spectrum of data sensitivity and a diversity of application environments. This document specifies up to four security levels for each of the 11 requirement areas with each security level increasing security over the preceding level.

  • Standard
    80 pages
    English language
    sale 15% off
  • Standard
    85 pages
    French language
    sale 15% off
ISO
ISO/IEC 24759:2025(Main)
Information security, cybersecurity and privacy protection — Test requirements for cryptographic modules

This document specifies the methods to be used by testing laboratories to test whether the cryptographic module conforms to the requirements specified in ISO/IEC 19790:2025. The methods are developed to provide a high degree of objectivity during the testing process and to ensure consistency across the testing laboratories. This document also specifies the information that vendors are required to provide testing laboratories as supporting evidence to demonstrate their cryptographic modules’ conformity to the requirements specified in ISO/IEC 19790:2025. Vendors can also use this document to verify whether their cryptographic modules satisfy the requirements specified in ISO/IEC 19790:2025 before applying to a testing laboratory for testing.

  • Standard
    182 pages
    English language
    sale 15% off
ISO
ISO/IEC 18031:2025(Main)
Information technology — Security techniques — Random bit generation

This document specifies a conceptual model for a random bit generator for cryptographic purposes, together with the elements of this model. This document specifies the characteristics of the main elements required for both non-deterministic and deterministic random bit generators. It also establishes the security requirements for both non-deterministic and deterministic random bit generators. Techniques for statistical testing of random bit generators for the purposes of independent verification or validation and detailed designs for such generators are outside the scope of this document.

  • Standard
    94 pages
    English language
    sale 15% off
ISO
ISO/IEC 27562:2024(Main)
Information technology — Security techniques — Privacy guidelines for fintech services

This document provides guidelines on privacy for fintech services. It identifies all relevant business models and roles in consumer-to-business relations and business-to-business relations, as well as privacy risks and privacy requirements, which are related to fintech services. It provides specific privacy controls for fintech services to address privacy risks. This document is based on the principles from ISO/IEC 29100, ISO/IEC 27701, and ISO/IEC 29184, the privacy impact assessment framework described in ISO/IEC 29134, and the risk management guideline described in ISO 31000. It also provides guidelines focusing on a set of privacy requirements for each stakeholder. This document can be applicable to all kinds of organizations such as regulators, institutions, service providers and product providers in the fintech service environment.

  • Standard
    30 pages
    English language
    sale 15% off
ISO
ISO/IEC 27013:2021/Amd 1:2024(Amendment)
Information security, cybersecurity and privacy protection — Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1 — Amendment 1
  • Standard
    4 pages
    English language
    sale 15% off
ISO
ISO/IEC 20008-3:2024(Main)
Information security — Anonymous digital signatures — Part 3: Mechanisms using multiple public keys

This document specifies anonymous digital signature mechanisms in which a verifier uses multiple public keys to verify a digital signature. This document provides: — a general description of an anonymous digital signature mechanism using multiple public keys; — a variety of mechanisms that provide such anonymous digital signatures. For each mechanism, this document specifies the process for: — generating the private key and public key of each user; — producing signatures; — verifying signatures; — linking signatures (if the mechanism supports linking); — tracing signatures (if the mechanism supports tracing); — producing signatures with threshold capability (if the mechanism supports a threshold capability); — verifying signatures with threshold capability (if the mechanism supports a threshold capability). This document does not define the implementation of a public key infrastructure (PKI) and the means for distinct entities to exchange, extract and verify their respective public key certificates.

  • Standard
    23 pages
    English language
    sale 15% off
ISO
ISO/IEC 27035-4:2024(Main)
Information technology — Information security incident management — Part 4: Coordination

This document provides guidelines for multiple organizations handling information security incidents in a coordinated manner. It also addresses the impacts of external cooperation on the internal incident management of an individual organization and provides guidelines for an individual organization to adapt to the coordination process. Furthermore, it provides guidelines for the coordination team, if it exists, to perform coordination activities supporting the cross-organization incident response. The principles given in this document are generic and are intended to be applicable to multiple organizations to work together to handle information security incidents, regardless of their types, sizes or nature. Organizations can adjust the guidance given in this document according to their type, sizes and nature of business in relation to the information security risk situation. This document is also applicable to an individual organization that participates in partner relationships.

  • Standard
    22 pages
    English language
    sale 15% off
ISO
ISO/IEC 9797-2:2021/Cor 1:2024(Corrigendum)
Information security — Message authentication codes (MACs) — Part 2: Mechanisms using a dedicated hash-function — Technical Corrigendum 1
  • Standard
    3 pages
    English language
    sale 15% off
ISO
ISO/IEC 18014-2:2021/Cor 1:2024(Corrigendum)
Information security — Time-stamping services — Part 2: Mechanisms producing independent tokens — Technical Corrigendum 1
  • Standard
    1 page
    English language
    sale 15% off
ISO
ISO/IEC 27019:2024(Main)
Information security, cybersecurity and privacy protection — Information security controls for the energy utility industry

This document provides information security controls for the energy utility industry, based on ISO/IEC 27002:2022, for controlling and monitoring the production or generation, transmission, storage and distribution of electric power, gas, oil and heat, and for the control of associated supporting processes. This includes in particular the following: — central and distributed process control, monitoring and automation technology as well as information systems used for their operation, such as programming and parameterization devices; — digital controllers and automation components such as control and field devices or programmable logic controllers (PLCs), including digital sensor and actuator elements; — all further supporting information systems used in the process control domain, e.g. for supplementary data visualization tasks and for controlling, monitoring, data archiving, historian logging, reporting and documentation purposes; — communication technology used in the process control domain, e.g. networks, telemetry, telecontrol applications and remote-control technology; — Advanced metering infrastructure (AMI) components, e.g. smart meters; — measurement devices, e.g. for emission values; — digital protection and safety systems, e.g. protection relays, safety PLCs, emergency governor mechanisms; — energy management systems, e.g. for distributed energy resources (DER), electric charging infrastructures, and for private households, residential buildings or industrial customer installations; — distributed components of smart grid environments, e.g. in energy grids, in private households, residential buildings or industrial customer installations; — all software, firmware and applications installed on above-mentioned systems, e.g. distribution management system (DMS) applications or outage management systems (OMS); — any premises housing the abovementioned equipment and systems; — remote maintenance systems for abovementioned systems. This document does not apply to the process control domain of nuclear facilities. This domain is covered by IEC 63096.

  • Standard
    39 pages
    English language
    sale 15% off
  • Standard
    48 pages
    French language
    sale 15% off