Overview
ISO/IEC 18367:2016 - Information technology - Security techniques - Cryptographic algorithms and security mechanisms conformance testing - provides authoritative guidelines for verifying the correctness of cryptographic algorithm and security mechanism implementations. The standard covers testing whether an implementation (hardware, software or firmware) performs the algorithm or mechanism correctly in a given operating environment. It explicitly focuses on functional conformance and does not address algorithm efficiency or intrinsic performance.
Keywords: ISO/IEC 18367:2016, cryptographic algorithms, conformance testing, security mechanisms, correctness testing
Key topics
- Types of algorithms and mechanisms addressed: symmetric key (block/stream ciphers), asymmetric key (RSA, DSA, ECDSA), digital signatures (including message recovery), hashing, message authentication codes (MAC), random bit generators (DRBG and non-deterministic), key establishment, key derivation functions (KDF), prime number generation, authenticated encryption, and lightweight cryptography.
- Testing methodologies: black-box (known-answer tests, multi-block tests, Monte Carlo/statistical tests), white-box/glass-box (source code inspection, binary analysis), and simulation-based testing alternatives.
- Levels of conformance: defined tiers (basic, moderate, etc.) to scale test depth depending on risk and assurance requirements.
- Test design guidance: identification of algorithm instances, selection of test items, and detailed guidelines for each algorithm class (e.g., hashing, MAC, KDF, DRBG).
- Practical test types: known-answer test vectors, Monte Carlo statistical tests, multi-block messaging, and examples of typical implementation mistakes (informative annexes).
Keywords: black box testing, white box testing, known-answer tests, Monte Carlo testing, DRBG, KDF, hashing, MAC
Applications
- Validate that a cryptographic implementation correctly implements the intended algorithms in its real operating environment.
- Support laboratory test plans for conformance verification, QA, code review and binary analysis.
- Provide guidance for interoperability testing between products that implement standardized cryptographic primitives.
- Form a baseline for security evaluators and product teams to design meaningful test suites that focus on correctness rather than performance.
Keywords: conformance verification, cryptographic testing, interoperability testing, QA
Who uses this standard
- Cryptographic implementers (software, firmware, hardware)
- Test laboratories and independent security evaluators
- QA and engineering teams building secure systems
- Certification and compliance bodies designing test programs
- Product architects ensuring interoperable cryptographic behavior
Related standards
- ISO/IEC 18031 (deterministic random bit generation) is referenced in ISO/IEC 18367:2016 for DRBG testing guidance.
- ISO/IEC 18367 is complementary to other ISO/IEC standards that address cryptographic modules, testing frameworks and security requirements.
Using ISO/IEC 18367:2016 helps organizations create repeatable, standards-based conformance tests that improve trust in cryptographic implementations without conflating correctness with performance metrics.