Cryptography – Conditional Self-Tests

You are here: Technology Topics » Computer & Gadgets » Computer & Network Security » Cryptography » Cryptography – Conditional Self-Tests

This post is part of the Computer Security – Cryptography posts series.

Conditional tests shall be performed by a cryptographic module when the conditions specified for the following tests occur: Pair-Wise Consistency Test, Software Load Test, Manual Key Entry Test, Continuous RBG Test, RBG Entropy Source Test, and Conditional Bypass Test.

Pair-Wise Consistency Test (for public and private keys). If a cryptographic module generates public or private keys, then the following pair-wise consistency tests for every pair of generated public and private keys shall be performed:

• If the keys are used to perform key transport, then the public key shall encrypt a plaintext value. The resulting ciphertext value shall be compared to the original plaintext value. If the two values are equal, then the test shall fail. If the two values differ, then the private key shall be used to decrypt the ciphertext and the resulting value shall be compared to the original plaintext value. If the two values are not equal, the test shall fail.
• If the keys are used to perform the calculation and verification of digital signatures then the consistency of the keys shall be tested by the complete calculation and verification of a digital signature. If the digital signature cannot be verified, the test shall fail.
• If the keys are used to perform key agreement, then the arithmetic validity of the keys shall be tested by verifying the correct mathematical relationship between the public key and private key values.

Software Load Test. If software can be externally loaded into a cryptographic module, then the following Software Load Tests shall be performed:

• An Approved digital signature technique shall be applied to all validated software when externally loaded into a cryptographic module. The Software Load Test is not required for any software that is loaded onto and solely executed on hardware which has been excluded from the security requirements of this standard .
• The applied Approved data authentication technique shall be successfully verified or the Software Load Test shall fail.
• Before the newly loaded software is operationally used, the requirements shall be satisfied.

Manual Key Entry Test. If cryptographic keys or key components are manually entered into a cryptographic module, or if error on the part of the human operator could result in the incorrect entry of the intended key, then the following manual key entry tests shall be performed:

• The cryptographic key or key components shall have an error detection code (EDC) applied, or shall be entered using duplicate entries.
• If an EDC is used, the EDC shall be at least 32 bits in length.
• If the EDC cannot be verified, or the duplicate entries do not match, the test shall fail.

Continuous RBG Test. If a cryptographic module employs an Approved RBG or an RBG entropy source in an Approved mode of operation, the module shall perform the following continuous random bit generator test on each RBG and RBG entropy source that tests for failure to a constant value.

• If each call to a RBG produces blocks of n bits (where n > 63), the first n-bit block generated after power-up, initialization, or reset shall not be used, but shall be saved for comparison with the next n-bit block to be generated. Each subsequent generation of an n-bit block shall be compared with the previously generated block. The test shall fail if any two compared n-bit blocks are equal.
• If each call to a RBG produces fewer than 64 bits, the first n bits generated after power-up, initialization, or reset (for some n > 63) shall not be used, but shall be saved for comparison with the next n generated bits. Each subsequent generation of n bits shall be compared with the previously generated n bits. The test fails if any two compared n-bit sequences are equal.

RBG Entropy Source Test. If an RNG entropy source is contained within the operational environment, then the min-entropy assessment shall be performed on each output of the entropy source. This test shall fail if the assessed min-entropy is less than the min-entropy required by the Approved RBG.

Conditional Bypass Test. If a cryptographic module maintains internal information that governs the bypass capability, then the module shall verify the integrity of the governing information through an Approved integrity technique immediately preceding modification of the governing information, and shall generate a new integrity value using the Approved integrity technique immediately following the modification.

Documentation shall specify the mechanism or logic governing the bypass capability.



8 Responses to “Cryptography – Conditional Self-Tests”

1. Alex says:

   What are the algorithms used in asymmetric and symmetric cryptography ?
2. Hamid says:

   asymmetric relation is a binary relation which is not a symmetric relation
3. Daniel says:

   what is the difference between cryptography and encryption ?
4. Cadu says:

   cryptography is the art of encryption, is as old as the art of communication
5. Dany says:

   Encryption is the conversion of data into a form, called a ciphertext, that cannot be easily understood by unauthorized people.
6. Robert says:

   I want to study cryptography. What university should I choose ?
7. Abru says:

   Massachusetts Institute of Technology
8. Oliver says:

   There is a lot of overlap between universities that are good in cryptography and those that are good at math, so a general approximation may be to look at that.

   MIT (Massachusetts Institute of Technology) is the best (also because the RSA was invented there).

   For United States the NSA has a list of centers of academic excellence in the field of cryptography
9. Ken says:

   interesting post
10. P. Silva says:

    a very good article about Cryptography – Conditional Self-Tests