Overview - ISO/IEC 20897-2:2022 (PUF Test and Evaluation Methods)
ISO/IEC 20897-2:2022 specifies test and evaluation methods for physically unclonable functions (PUFs) used in information security, cybersecurity and privacy protection. The standard defines how to verify PUF behavior and security claims by inspecting design rationale and performing statistical analyses of PUF responses (either from batches of devices or from a single device) against defined thresholds. It is intended to increase the assurance of using PUFs in cryptographic modules and other security-sensitive devices.
Key topics and technical requirements
- Scope and purpose: Tests are used to verify security requirements defined in ISO/IEC 20897-1 and to support use with cryptographic modules (see ISO/IEC 19790).
- Test methods:
- Design rationale inspection - document entropy sources, extractor, pre/post-processing and trust assumptions.
- Statistical evaluation - collect response data and compare metrics to thresholds.
- Stochastic models - used when empirical testing is infeasible (e.g., very low failure probabilities or prohibitive sample sizes).
- Security tests covered:
- Steadiness (repeatability; measured via intra-Hamming distance, BER, etc.)
- Randomness (statistical randomness of responses)
- Uniqueness (inter-device distinctness)
- Tamper-resistance (resilience to physical/active attacks)
- Mathematical and physical unclonability
- Test conditions: Measurements must include relevant environmental ranges (temperature, voltage, humidity), cycles across extremes, and can incorporate accelerated aging techniques.
- Data model: Responses are conceptually organized in a multi-dimensional cube (bits, challenges, devices, queries) to guide measurement and analysis.
Practical applications and intended users
- Who uses it:
- Security engineers and designers validating PUF-based key generation and device identity solutions
- Vendors producing PUF-equipped hardware who must demonstrate compliance
- Procurement bodies specifying PUF security requirements for products
- Test laboratories and certification bodies performing security evaluations
- Where it applies:
- Cryptographic modules that prefer not to store keys (improving key protection)
- Device authentication, secure provisioning, anti-counterfeiting, and IoT endpoint security
- Situations requiring documented, repeatable PUF evaluation for procurement or public claims
Related standards
- ISO/IEC 20897-1 - PUF security requirements (complements Part 2)
- ISO/IEC 19790 - Security requirements for cryptographic modules
- BSI AIS 31 - referenced for stochastic-model testing approaches
Using ISO/IEC 20897-2 helps organizations assess physically unclonable functions, demonstrate PUF security properties (steadiness, randomness, uniqueness), and apply rigorous test methods for secure hardware design and procurement. Keywords: ISO/IEC 20897-2:2022, physically unclonable functions, PUF test and evaluation, cryptographic modules, steadiness, randomness, uniqueness, BER, intra-HD, inter-HD.