DANSK DSF/ISO/IEC FDIS 20897-1 [ Draft ]

This document specifies the security requirements for physically unclonable functions (PUFs). Specified security requirements concern the output properties, tamper-resistance and unclonability of a single and a batch of PUFs. Since it depends on the application which security requirements a PUF should meet, this documents also describes the typical use cases of a PUF. Amongst PUF use cases, random number generation is out of scope in this document. For the definitions of security requirements (and their evaluation and test methods), refer to the existing International Standards related to random number generators, ISO/IEC 18031[1]. The concrete test evaluation methods for each security requirements defined in this document are provided in ISO/IEC 20897-2. This document is related to ISO/IEC 19790 which specifies security requirements for cryptographic modules. In those modules, CSPs (e.g. key) and PSPs (e.g. ID) are the assets to protect. PUF is one solution to avoid storing security parameters, thereby increasing the overall security of a cryptographic module.