Overview
ISO/IEC 20085-2:2020 - "IT Security techniques - Test tool requirements and test tool calibration methods ... Part 2: Test calibration methods and apparatus" specifies how to calibrate non‑invasive attack test tools used on cryptographic modules. The standard defines calibration methods and the required apparatus (including a reference artefact) so that different measurement and analysis tools produce comparable, reproducible results against the pass/fail test metrics in ISO/IEC 17825. Key goals are traceability, repeatability and reliable determination of whether side‑channel leakage endangers critical security parameters.
Key topics and requirements
- Scope and purpose
- Calibration of test tools used for side‑channel (power, electromagnetic, timing) evaluation of cryptographic modules against ISO/IEC 17825 metrics.
- Test tool components
- Separation of measurement tool (probe, A/D converter, trigger, capture rate) and analysis tool (data processing, alignment, filtering, attack algorithms). Calibration covers both.
- Calibration principles
- Methods to set threshold values so that pass/fail boundaries are reproducible across tools.
- Use of a defined artefact (signal source representative of a leaking device) to establish a clear threshold between pass and fail.
- Calibration procedure elements
- Point of measurement, parameter adjustment, accuracy and traceability of measurement tools, and metrics tied to number of traces (security strength).
- Calibration metrics and artefacts
- Security strength defined in terms of number of traces required to detect leakage per ISO/IEC 17825.
- Informative annexes provide example artefacts and implementations (e.g., HSM emulation on FPGA, microcontroller, signal generator) and guidance on countermeasures tuning.
Applications
- Calibrating side‑channel measurement setups in testing labs to ensure consistent vulnerability assessments.
- Verifying equivalence between different non‑invasive attack tools and test benches.
- Supporting conformity and certification testing of cryptographic modules (e.g., FIPS/ISO/IEC conformity frameworks).
- Establishing reproducible thresholds for pass/fail decisions in product evaluation, R&D and independent testing.
Who should use this standard
- Security testing laboratories and certification bodies performing side‑channel evaluations.
- Cryptographic module vendors and embedded system designers validating non‑invasive attack mitigations.
- Hardware security engineers, penetration testers and QA teams responsible for measurement tool setup and traceability.
- Tool manufacturers (oscilloscopes, probes, signal generators) aiming for interoperability with standardized test suites.
Related standards
- ISO/IEC 17825 - Testing methods for mitigation of non-invasive attack classes (metrics referenced)
- ISO/IEC 19790 - Security requirements for cryptographic modules (IUT context)
- ISO/IEC 20085-1 - Part 1: Test tools and techniques (tool requirements and test concepts)
Keywords: ISO/IEC 20085-2:2020, test calibration methods, artefact, cryptographic modules, non-invasive attack mitigation, side‑channel analysis, measurement tool, analysis tool, ISO/IEC 17825.