ISO 13491-1:2024 defines concepts and requirements for secure cryptographic devices in retail financial services. It addresses sensitive keys and operations within a device boundary, giving implementers a reference for threats, security properties and the design of financial devices.
TL;DR:
- ISO 13491-1:2024 defines security characteristics for retail cryptographic devices.
- It covers device operation and lifecycle management.
- Denial of service and MPC-based software services are outside its stated scope.
Summary
Secure-device concepts
ISO 13491-1:2024 specifies security characteristics for secure cryptographic devices used with processes described in the ISO 9564 series, ISO 16609 and ISO 11568. The subject is the device and its management, not a generic claim that encryption is present.
Operational and lifecycle scope
The public abstract covers operational characteristics and management through all stages of the device lifecycle. These are complementary concerns: a device’s features and the way it is handled both affect its security.
Explicit exclusions
The scope excludes denial-of-service issues and software services using multi-party computation to provide cryptographic services. ISO cautions against treating such software services as hardware security modules under this document’s terminology.
Published edition
ISO identifies edition 4, published in July 2024. The catalogue supports those scope boundaries without supplying the full requirements. Device approval or conformance needs evidence for the actual product and assessed edition.
Keywords
- Cryptographic Devices
- SCDs
- Device Security
- Lifecycle Management
- Retail Payments
- HSMs
- Operational Controls
- Key Management
- PIN Security
- Message Authentication