ISO 13491-1:2016

INTERNATIONAL ISO
STANDARD 13491-1
Third edition
2016-03-15
Financial services — Secure
cryptographic devices (retail) —
Part 1:
Concepts, requirements and
evaluation methods
Services financiers — Dispositifs cryptographiques de sécurité
(services aux particuliers) —
Partie 1: Concepts, exigences et méthodes d’évaluation
Reference number
©
ISO 2016
© ISO 2016, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO 2016 – All rights reserved

Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 5
5 Secure cryptographic device concepts . 5
5.1 General . 5
5.2 Attack scenarios . 6
5.2.1 General. 6
5.2.2 Penetration . 6
5.2.3 Monitoring . 6
5.2.4 Manipulation . 6
5.2.5 Modification . 6
5.2.6 Substitution . 6
5.3 Defence measures . . 7
5.3.1 General. 7
5.3.2 Device characteristics . 7
5.3.3 Device management . 8
5.3.4 Environment . 8
6 Requirements for device security characteristics . 8
6.1 General . 8
6.2 Physical security requirements for SCDs . 9
6.2.1 General. 9
6.3 Tamper evident requirements . 9
6.3.1 General. 9
6.4 Tamper resistant requirements .10
6.4.1 General.10
6.5 Tamper responsive requirements .10
6.5.1 General.10
6.6 Logical security requirements for SCDs .11
6.6.1 Dual control .11
6.6.2 Unique key per device .11
6.6.3 Assurance of genuine device .11
6.6.4 Design of functions .11
6.6.5 Use of cryptographic keys .12
6.6.6 Sensitive device states.12
6.6.7 Multiple cryptographic relationships .12
6.6.8 SCD software authentication .12
7 Requirements for device management .12
7.1 General .12
7.2 Life cycle phases .13
7.3 Life cycle protection requirements.14
7.3.1 General.14
7.3.2 Manufacturing phase.14
7.3.3 Post-manufacturing phase .15
7.3.4 Commissioning (initial financial key loading) phase .15
7.3.5 Inactive operational phase .15
7.3.6 Active operational phase (use) .16
7.3.7 Decommissioning (post-use) phase .16
7.3.8 Repair phase .16
7.3.9 Destruction phase .17
7.4 Life cycle protection methods .17
7.4.1 Manufacturing .17
7.4.2 Post manufacturing phase .17
7.4.3 Commissioning (initial financial key loading) phase .17
7.4.4 Inactive Operational Phase .18
7.4.5 Active operational (use) phase .18
7.4.6 Decommissioning phase .18
7.4.7 Repair .19
7.4.8 Destruction .19
7.5 Accountability .19
7.6 Device management principles of audit and control .20
Annex A (informative) Evaluation methods .23
Bibliography .33
iv © ISO 2016 – All rights reserved

Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
...