ISO/IEC INTERNATIONAL 20543 STANDARD First edition 2019-10 Information technology - Security techniques Test and analysis methods for random bit generators within IS0/IEC 19790 and IS0/IEC 15408 Technologies de I'information Techniques de sécurité Méthodes d'essai et d'analyse des générateurs de bits aléatoires dans I'isO/IEC 19790etI'IS0/IEC15408 Reference number IS0/IEC 20543:2019(E) IEC @IS0/IEC2019 IS0/IEC 20543:2019(E) COPYRIGHT PROTECTED DOCUMENT IS0/IEC 2019 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on theinternet or an intranet, withoutprior writtenpermission.Permission canberequestedfrom eitherIsoat the address beloworIso'smemberbodyinthecountryoftherequester. ISO copyright office CP 401 : Ch. de Blandonnet 8 CH-1214 Vernier, Geneva Phone: +41 22 749 0111 Fax: +41 22 749 09 47 Email: [email protected] Website: www.iso.org Published in Switzerland ii @ISO/IEC2019-Allrightsreserved IS0/IEC20543:2019(E) Contents Page Foreword .iv Introduction. .V 1 Scope. 1 2 Normative references 1 3 Terms and definitions 1 4 Symbols and abbreviated terms 7 5 Structure of this document .7 6 Overview of non-deterministic random bit generators .7 6.1 Introductory remarks on random bit generation 7 6.2 Modelling of random sources. 8 6.2.1 Stochastic models. 8 6.2.2 Heuristic analysis of entropy sources.. 10 6.2.3 Physical and non-physical sources. 11 6.2.4 Overview of the evaluation of the random source of a TNRBG 11 6.2.5 OverviewoftheevaluationoftherandomsourceofanNNRBG 12 6.3 General design template and taxonomy for non-deterministic random bit generators 12 6.3.1 12 Overview 6.3.2 Functional model of a NRBG 12 6.3.3 Components of a NRBG 15 Conformance testing of NRBG .18 7 7.1 Overview 18 7.2 Testing. 19 7.2.1 Design documentation. 19 7.2.2 Analysing entropy 19 Min entropy. 7.2.3 23 7.2.4 Statistical tests 24 7.3 25 Evaluation. 7.3.1 25 General. Vendor input to conformance testing 7.3.2 25 8 Overview of deterministic random bit generators 27 .27 8.1 General remarks 8.2 Structural overview of a deterministic random bit generator 28 Conformance testing of DRBG 29 9 9.1 Overview 29 9.2 Testing. 29 9.2.1 Design documentation 29 9.2.2 Analysis of seed entropy 29 10 Testing methodology 30 10.1 General 30 10.2 Vendor requirements 30 10.3 Tests requirements. .30 Annex A (normative) General statistical methodology 31 Annex B (informative) Test files. ..38 Bibliography .39 iii IS0/IEC2019-Allrightsreserved