Home » Android » Cryptographic security measures. Skzy - what is it? means of cryptographic information protection Activities in the field of cryptography in Russia

Cryptographic security measures. Skzy - what is it? means of cryptographic information protection Activities in the field of cryptography in Russia

According to the legislation of the EAEU, encryption (cryptographic) means(hereinafter – ShKS) - This " hardware, software and hardware-software tools, systems and complexes that implement algorithms for cryptographic transformation of information and are intended to protect information from unauthorized access during its transmission via communication channels and (or) during its processing and storage” .

This definition is very abstract, and therefore the attribution or non-attribution of a specific product to the ShKS can cause significant difficulties.

List of goods related to ShKS

The Regulations on the import (export) of ShKS provides a list of functions (components) that a product must contain in order for it to be considered a ShKS:

imitation protection means
electronic digital signature tools
coding tools
means of producing cryptographic keys
the cryptographic keys themselves
systems, equipment and components designed or modified to perform cryptanalytic functions
systems, equipment and components designed or modified to employ cryptographic techniques for generating spreading code for spreading spectrum systems, including code hopping for frequency hopping systems
systems, equipment and components designed or modified to employ cryptographic channeling techniques or security codes for time-modulated ultra-wideband systems.

However, in practice, a situation often arises that customs authorities, guided by the list from section 2.19 (and even only the HS code from the list), may decide that the imported product is an encryption tool (and it does not matter whether there is actually encryption there or not ). In this case, the importer will have to obtain permits or prove to customs that the product does not have encryption.

Procedure for import (export) of ShKS

Depending on the customs procedure for the import (export) of ShKS, it is necessary to prepare various types of documents:

12 ShKS categories

In practice, the vast majority of goods with encryption functionality are imported on the basis of notification.

Notification can be registered only for goods belonging to one or more of 12 categories of encryption tools, the technical and cryptographic characteristics of which are subject to notification. This list is given in the Notification Regulations.

Category No. 1

1. Products containing encryption (cryptographic) means, having any of the following components: 1) a symmetric cryptographic algorithm using a cryptographic key with a length not exceeding 56 bits; 2) an asymmetric cryptographic algorithm based on any of the following methods: factorization of integers whose size does not exceed 512 bits; calculation of discrete logarithms in the multiplicative group of a finite field, the size of which does not exceed 512 bits; discrete logarithm in a group of a finite field, different from the field specified in paragraph three of this subclause, the size of which does not exceed 112 bits.

ShKS of this category perform various cryptographic functions, but the determining factor for assignment to this category is the length of the cryptographic key. The specified key lengths are significantly less than the recommended minimum values for the corresponding groups of algorithms. The use of such short cryptographic keys makes it possible on modern equipment to open encrypted messages using a brute force method.

Symmetric encryption mainly used to ensure data confidentiality, and is based on the fact that the sender and recipient of information use the same key to both encrypt messages and decrypt them. This key must be kept secret and transmitted in a manner that cannot be intercepted. Examples of symmetric encryption algorithms: RC4, DES, AES.

Of the algorithms listed, only DES (considered obsolete) certainly falls into category 1; Also, the RC4 algorithm can sometimes be used with short keys (for example, in the WEP protocol of Wi-Fi communication technology: the key length is 40 or 128 bits).

IN asymmetric encryption algorithms(or public key cryptography) uses one key (public) to encrypt information, and another (secret) to decrypt it. These algorithms are widely used to establish secure connections over open communication channels for digital signature purposes. Examples of algorithms: RSA, DSA, Diffie-Hellman Protocol, GOST R 34.10-2012.

Specified methods refer to the mathematical basis for the functioning of asymmetric algorithms:

factorization of integers - RSA algorithm
calculation of discrete logarithms in the multiplicative group of a finite field - DSA, Diffie-Hellman, El-Gamal algorithms
discrete logarithm in a group of a finite field different from the field specified in paragraph three of this subclause - algorithms on elliptic curves: ECDSA, ECDH, GOST R 34.10-2012.

Examples of notified ShKS: theoretically, any product can use outdated algorithms or short keys in modern algorithms. In practice, however, this makes little sense, because does not provide a sufficient level of protection. One real-world example would be Wi-Fi in WEP mode with a 40-bit key length.

Category No. 2

2. Products containing encryption (cryptographic) means having the following limited functions: 1) authentication, which includes all aspects of access control where there is no encryption of files or texts, with the exception of encryption that is directly related to the protection of passwords, personal identification numbers or similar data to protect against unauthorized access;

User authentication under this category involves comparing the user's entered password or other similar identifying data with information stored in the database of authorized users, and the encryption process itself consists of protection of user secret data from copying and illegal use when they are transferred from the authentication object (user) to the controlling device.

Examples of notified ShKS: devices for access control and management systems - password readers, devices for storing and creating databases of authorized users, network authentication devices - gateways, routers, routers, etc., devices with protection of information stored on them - hard drives with a password restriction function access.

2) electronic digital signature (electronic signature).

The signing process is implemented by cryptographic transformation of information using a private signature key and allows you to check the absence of distortion of information in an electronic document from the moment the signature is formed (integrity), whether the signature belongs to the owner of the signature key certificate (authorship), and in case of successful verification, confirm the fact of signing the electronic document (non-repudiation).

Examples of notified ShKS: EDS generators, software for maintaining and implementing the EDS application mechanism, storage devices for EDS key information.

Category No. 3

3. Encryption (cryptographic) tools, which are components of software operating systems, the cryptographic capabilities of which cannot be changed by users, which are designed to be installed by the user independently without further significant support from the supplier and technical documentation (description of cryptographic transformation algorithms, interaction protocols, description of interfaces, etc. .d.) which is accessible to the user.

operating system is a set of interconnected programs designed to manage computer resources and organize user interaction.

Examples of notified ShKS: operating systems and software systems based on them.

Category No. 4

4. Personal smart cards (smart cards): 1) the cryptographic capabilities of which are limited to their use in the categories of goods (products) specified in paragraphs 5 - 8 of this list; 2) for wide public use, the cryptographic capabilities of which are not available to the user and which, as a result of special development, have limited capabilities for protecting the personal information stored on them.

Smart cards These are plastic cards with a built-in microchip. In most cases, smart cards contain a microprocessor and an operating system that controls the device and controls access to objects in its memory.

Examples of notified ShKS: SIM cards for access to the services of mobile operators, bank cards equipped with a microprocessor chip, smart identification cards for its owner.

Category No. 5

5. Reception equipment for radio broadcasting, commercial television, or similar commercial equipment for broadcasting to a limited audience without digital signal encryption, except when encryption is used solely for the management of video or audio channels, sending bills, or returning program-related information to broadcast providers.

This category refers to products intended to provide the user with access to paid encrypted digital satellite, terrestrial and cable TV channels and radio stations (radio channels) (examples of standards: DVB-CPCM, DVB-CSA).

Examples of notified ShKS: TV tuners, TV signal receivers, satellite TV receivers.

Category No. 6

6. Equipment, the cryptographic capabilities of which are not available to the user, specially designed and limited for use in any of the following ways: 1) the software is executed in a copy-protected form; 2) access to any of the following: copy-protected content stored only on readable electronic media; information stored in encrypted form on electronic media that are offered for sale to the public in identical sets; 3) control of copying of audio and video information protected by copyright.

Examples of notified ShKS: Game consoles, games, software, etc.

Category No. 7

7. Encryption (cryptographic) equipment specially designed and limited to banking or financial transactions.

Products in this category must be a hardware device, i.e. have a finished type of banking equipment, the use of which does not require additional assembly or modification except for modernization purposes.

Examples of notified ShKS: ATMs, payment terminals, pin pads (bank cards are classified as category No. 4).

Category No. 8

8. Portable or mobile radio-electronic equipment for civilian use (for example, for use in commercial civilian cellular radio communication systems) that are not capable of end-to-end encryption (from subscriber to subscriber).

This category includes all mobile cellular communication devices operating in the GSM, GPRS, EDGE, UMTS, LTE standards, as well as some radio stations. The main requirement for products of this category in the field of functionality is the lack of ability to end-to-end encryption, i.e. communication between subscribers must be carried out through a relay device.

Examples of notified ShKS: Mobile communication devices and devices incorporating cellular communication modules of the above standards, radio stations.

Category No. 9

9. Wireless radio-electronic equipment that encrypts information only in a radio channel with a maximum wireless range without amplification and relay of less than 400 m in accordance with the manufacturer’s specifications.

This includes most devices that can otherwise be called “short-range radio-electronic means”. Encryption occurs when transmitting/receiving information over a wireless radio channel in order to protect it from interception and penetration of unauthorized users into the communication network. As is known, such protection is supported by most wireless data transmission standards: Wi-Fi, Bluetooth, NFC, and sometimes RFID.

Examples of notified ShKS: routers, access points, modems, devices containing short-range wireless radio modules, contactless access/payment/identification cards.

Category No. 10

10. Encryption (cryptographic) means used to protect technological channels of information and telecommunication systems and communication networks.

This category describes products that are network devices that perform switching And service functions. As a rule, most of these devices support simple network management protocols that allow you to monitor the state of the network, its performance, and also send network administrator commands to its different nodes.

Examples of notified ShKS: Servers, switches, network platforms, gateways.

Category No. 11

11. Products whose cryptographic function is blocked by the manufacturer.

This category can be represented by completely different types of devices for different purposes and areas of application. The decisive factor for classifying such goods into category No. 11 is the presence of a pre-installed software or hardware, which produces targeted blocking cryptographic functions performed by the product.

Category No. 12

12. Other goods that contain encryption (cryptographic) means other than those specified in paragraphs 1 - 11 of this list, and meet the following criteria: 1) are publicly available for sale to the public in accordance with the legislation of a member state of the Eurasian Economic Union without restrictions from those available in availability of assortment at retail locations through any of the following: cash sales; sales by ordering goods by mail; electronic transactions; sales by telephone orders; 2) encryption (cryptographic) functionality of which cannot be changed by the user in a simple way; 3) designed to be installed by the user without further significant support from the supplier; 4) technical documentation confirming that the goods comply with the requirements of subparagraphs 1 - 3 of this paragraph is posted by the manufacturer in the public domain and is presented, if necessary, by the manufacturer (a person authorized by him) to the approving body upon his request.

It is worth noting that in practice, the TsLSZ FSB of Russia imposes increased requirements for the submission of materials for registering notifications for goods in this category. Thus, all of the listed criteria must be confirmed (by links to the manufacturer’s website with information in Russian or documented).

The most common categories of ShKS

For each notification, the Unified Register provides a list of categories to which the product is classified. This information is encoded in the field "Identifier": the field is a 12-digit code, and if the product belongs to category number N from the list above, then position N in the code will have the number 1, otherwise - 0.

For example, code 110000000110 indicates that the product was notified under categories No. 1, 2, 10 and 11.

It's interesting to look at the usage statistics for the different categories.

As can be seen from the diagram, the most common and frequently encountered cryptographic functions in ShKS are data encryption in a short-range wireless radio channel (Wi-Fi, Bluetooth) - 27% of the total number of registered ShKS, which is logical, given the volume of produced mobile communications equipment, personal computers and other technical devices equipped with modules that support these communication technologies.

The second place is occupied by ShKS, which support the functions of authentication and access control to protected information - 19,5% . This trend is also easily explained by increased standards and consumer demands for the protection of personal information both on physical media (hard drives, USB flash drives, servers, etc.) and on network media (cloud storage, network data banks, etc. .). Additionally, it is worth noting that the vast majority of ShKS used in access control and management systems (better known as ACS) also perform cryptographic functionality belonging to category No. 2.

Since networking is an integral part of the functioning of any information system, aspects of administering a given communication network are implemented in network control devices. The security of the control interface organized by these devices is realized through the use of encryption mechanisms for technological communication channels, which is the basis for categorizing this kind of ShCS into category No. 10, which is the third most common - 16% .

It is also important to note that the least common functions of the ShKS are divided into categories №5 (0,28% ), №12 (0,29% ) And №7 (0,62% ). Products that implement these cryptographic functions are rare, and when registering with the Central Labor Protection Center, the documentation for them is subject to a more detailed analysis, because “not put into production” and the sets of cryptographic protocols and algorithms used may be unique in each individual case. That is why maximum attention must be paid to goods of these categories when drawing up the necessary documents, since otherwise the risk of refusal to register a notification is extremely high.

Notes

Links

Electronic signature (EDS), - Unified Electronic Signature Portal, - http://www.techportal.ru/glossary/identifikatsiya.html
Cryptographic methods of information security, - Collection of lectures on the basics of local networks of the National Open University, - http://www.intuit.ru/studies/courses/16655/1300/lecture/25505?page=2
The concept of an operating system, - Portal materials about operating systems, - http://osys.ru/os/1/ponyatie_operatsionnoy_sistemy.shtml
Introduction to SNMP, - Materials on network security, - http://network.xsp.ru/6_1.php

The term "cryptography" comes from the ancient Greek words "hidden" and "write". The phrase expresses the main purpose of cryptography - the protection and preservation of the secrets of transmitted information. Information protection can occur in various ways. For example, by limiting physical access to data, hiding the transmission channel, creating physical difficulties in connecting to communication lines, etc.

Purpose of Cryptography

Unlike traditional methods of secret writing, cryptography assumes full accessibility of the transmission channel for attackers and ensures the confidentiality and authenticity of information using encryption algorithms that make the information inaccessible to outside reading. A modern cryptographic information protection system (CIPS) is a software and hardware computer complex that provides information protection according to the following basic parameters.

Confidentiality- impossibility of reading information by persons who do not have appropriate access rights. The main component of ensuring confidentiality in CIPF is the key, which is a unique alphanumeric combination for user access to a specific CIPF block.
Integrity- impossibility of unauthorized changes, such as editing and deleting information. To do this, redundancy is added to the original information in the form of a verification combination, calculated using a cryptographic algorithm and depending on the key. Thus, without knowing the key, adding or changing information becomes impossible.
Authentication- confirmation of the authenticity of information and the parties sending and receiving it. Information transmitted over communication channels must be uniquely authenticated by content, time of creation and transmission, source and recipient. It should be remembered that the source of threats can be not only the attacker, but also the parties involved in the exchange of information with insufficient mutual trust. To prevent such situations, CIPF uses a system of time stamps to prevent repeated or reverse sending of information and changing the order of its occurrence.

Authorship- confirmation and impossibility of refusing actions performed by the user of the information. The most common method of authentication is the EDS system consists of two algorithms: for creating a signature and for verifying it. When working intensively with ECC, it is recommended to use software certification centers to create and manage signatures. Such centers can be implemented as a CIPF tool that is completely independent of the internal structure. What does this mean for the organization? This means that all transactions are processed by independent certified organizations and falsification of authorship is almost impossible.

Encryption algorithms

Currently, open encryption algorithms using symmetric and asymmetric keys with a length sufficient to provide the required cryptographic complexity predominate among CIPF. The most common algorithms:

symmetric keys - Russian R-28147.89, AES, DES, RC4;
asymmetric keys - RSA;
using hash functions - R-34.11.94, MD4/5/6, SHA-1/2.

Many countries have their own national standards. In the USA, a modified AES algorithm with a key length of 128-256 bits is used, and in the Russian Federation, the electronic signature algorithm R-34.10.2001 and the block cryptographic algorithm R-28147.89 with a 256-bit key. Some elements of national cryptographic systems are prohibited for export outside the country; activities to develop CIPF require licensing.

Hardware cryptographic protection systems

Hardware CIPF are physical devices containing software for encrypting, recording and transmitting information. Encryption devices can be made in the form of personal devices, such as ruToken USB encryptors and IronKey flash drives, expansion cards for personal computers, specialized network switches and routers, on the basis of which it is possible to build fully secure computer networks.

Hardware CIPF is quickly installed and operates at high speed. Disadvantages: high, compared to software and hardware-software CIPFs, cost and limited upgrade capabilities.

Also included in the hardware category are CIPF units built into various data recording and transmission devices that require encryption and restriction of access to information. Such devices include automobile tachometers that record vehicle parameters, some types of medical equipment, etc. For full operation of such systems, separate activation of the CIPF module by the supplier’s specialists is required.

Software cryptographic protection systems

Software CIPF is a special software package for encrypting data on storage media (hard and flash drives, memory cards, CD/DVD) and when transmitted over the Internet (emails, files in attachments, secure chats, etc.). There are quite a lot of programs, including free ones, for example, DiskCryptor. Software CIPF also includes secure virtual information exchange networks operating “on top of the Internet” (VPN), an extension of the HTTP Internet protocol with support for HTTPS encryption and SSL - a cryptographic information transfer protocol widely used in IP telephony systems and Internet applications.

Software cryptographic information protection systems are mainly used on the Internet, on home computers and in other areas where the requirements for the functionality and stability of the system are not very high. Or as is the case with the Internet, when you have to create many different secure connections at the same time.

Software and hardware cryptographic protection

Combines the best qualities of hardware and software CIPF systems. This is the most reliable and functional way to create secure systems and data networks. All options for user identification are supported, both hardware (USB drive or smart card) and “traditional” - login and password. Software and hardware CIPFs support all modern encryption algorithms, have a wide range of functions for creating secure document flow based on digital signatures, and all required government certificates. The installation of CIPF is carried out by qualified developer personnel.

Company "CRYPTO-PRO"

One of the leaders of the Russian cryptographic market. The company develops a full range of programs for protecting information using digital signatures based on international and Russian cryptographic algorithms.

The company's programs are used in electronic document management of commercial and government organizations, for filing accounting and tax reports, in various city and budget programs, etc. The company has issued more than 3 million licenses for the CryptoPRO CSP program and 700 licenses for certification centers. Crypto-PRO provides developers with interfaces for embedding cryptographic protection elements into their own and provides a full range of consulting services for the creation of CIPF.

Crypto provider CryptoPro

When developing the CIPF Cryptographic Service Providers, the Cryptographic Service Providers cryptographic architecture built into the Windows operating system was used. The architecture allows you to connect additional independent modules that implement the required encryption algorithms. With the help of modules working through CryptoAPI functions, cryptographic protection can be implemented by both software and hardware CIPF.

Key carriers

Various types of private keys can be used:

smart cards and readers;
electronic locks and readers that work with Touch Memory devices;
various USB keys and removable USB drives;
Windows, Solaris, Linux system registry files.

Cryptoprovider functions

CIPF CryptoPro CSP is fully certified by FAPSI and can be used for:

2. Complete confidentiality, authenticity and integrity of data using encryption and simulation protection in accordance with Russian encryption standards and the TLS protocol.

3. Checking and monitoring the integrity of the program code to prevent unauthorized changes and access.

4. Creation of system protection regulations.

About import
to the customs territory of the Eurasian
economic union and export from customs
territory of the Eurasian Economic Union
encryption (cryptographic) means

Scroll
categories of goods that are encryption (cryptographic) means or contain encryption (cryptographic) means, the technical and cryptographic characteristics of which are subject to notification

1. Goods containing encryption (cryptographic) means, having any of the following components:

1) a symmetric cryptographic algorithm using a cryptographic key not exceeding 56 bits in length;

2) an asymmetric cryptographic algorithm based on any of the following methods:

factorization of integers whose size does not exceed 512 bits;

calculation of discrete logarithms in the multiplicative group of a finite field, the size of which does not exceed 512 bits;

discrete logarithm in a group of a finite field, different from the field specified in paragraph three of this subclause, the size of which does not exceed 112 bits.

Notes: 1. Parity bits are not included in the key length.

2. The term "cryptography" does not refer to fixed methods of data compression or encoding.

2. Products containing encryption (cryptographic) tools with the following limited functions:

1) authentication, which includes all aspects of access control where there is no encryption of files or texts, with the exception of encryption that is directly related to the protection of passwords, personal identification numbers or similar data to protect against unauthorized access;

Note. Authentication and electronic digital signature (e-signature) functions include an associated key distribution function.

4. Personal smart cards (smart cards):

1) the cryptographic capabilities of which are limited to their use in the categories of goods (products) specified in paragraphs 5 - 8 of this list;

2) for wide public use, the cryptographic capabilities of which are not available to the user and which, as a result of special development, have limited capabilities for protecting the personal information stored on them.

Note. If a personal smart card (smart card) can perform several functions, the control status of each of the functions is determined separately.

6. Equipment, the cryptographic capabilities of which are not available to the user, specifically designed and limited for use in any of the following ways:

1) the software is executed in a copy-protected form;

2) access to any of the following:

copy-protected content stored only on readable electronic media;

information stored in encrypted form on electronic media that are offered for sale to the public in identical sets;

3) control of copying of audio and video information protected by copyright.

7. Encryption (cryptographic) equipment specially designed and limited to banking or financial transactions.

Note. Financial transactions include, but are not limited to, fees and charges for transportation services and lending.

10. Encryption (cryptographic) means used to protect technological channels of information and telecommunication systems and communication networks.

11. Products whose cryptographic function is blocked by the manufacturer.

12. Other goods that contain encryption (cryptographic) means other than those specified in paragraphs 1 - 11 of this list, and meet the following criteria:

1) are publicly available for sale to the public in accordance with the legislation of a member state of the Eurasian Economic Union without restrictions from the available assortment at points of retail sale through any of the following:

cash sales;

sales by ordering goods by mail;

electronic transactions;

sales by telephone orders;

2) encryption (cryptographic) functionality of which cannot be changed by the user in a simple way;

3) designed to be installed by the user without further significant support from the supplier;

4) technical documentation confirming that the goods comply with the requirements of subparagraphs 1 - 3 of this paragraph is posted by the manufacturer in the public domain and is presented, if necessary, by the manufacturer (a person authorized by him) to the approving body upon his request.

Cryptographic security means are special means and methods of transforming information, as a result of which its content is masked. The main types of cryptographic closure are encryption and encoding of the protected data. In this case, encryption is a type of closure in which each symbol of the data being closed is subject to independent transformation; When encoding, the protected data is divided into blocks that have a semantic meaning, and each such block is replaced with a digital, alphabetic or combined code. In this case, several different encryption systems are used: replacement, permutation, gamma, and analytical transformation of encrypted data. Combination ciphers have become widespread, when the source text is sequentially transformed using two or even three different ciphers.

Principles of operation of the cryptosystem

A typical example of a situation in which a cryptography (encryption) problem arises is shown in Figure 1:

Rice. №1

In Figure 1, A and B are legitimate users of protected information; they want to exchange information via a public communication channel.

P is an illegal user (adversary, hacker) who wants to intercept messages transmitted over a communication channel and try to extract information from them that is interesting to him. This simple scheme can be considered a model of a typical situation in which cryptographic methods of information protection or simply encryption are used.

Historically, some military words have been entrenched in cryptography (enemy, attack on cipher, etc.). They most accurately reflect the meaning of the corresponding cryptographic concepts. At the same time, well-known military terminology based on the concept of code (naval codes, General Staff codes, code books, code designations, etc.) is no longer used in theoretical cryptography. The fact is that over the past decades, coding theory has emerged - a large scientific direction that develops and studies methods for protecting information from random distortions in communication channels. Cryptography deals with methods of transforming information that would prevent an adversary from extracting it from intercepted messages. In this case, it is no longer the protected information itself that is transmitted through the communication channel, but the result of it.

transformation using a cipher, and the adversary faces the difficult task of breaking the cipher. Opening (cracking) a cipher is the process of obtaining protected information from an encrypted message without knowing the cipher used. An adversary may not attempt to obtain, but to destroy or modify protected information during its transmission. This is a completely different type of threat to information, different from interception and breaking of the code. To protect against such threats

We are developing our own specific methods. Therefore, as information travels from one legitimate user to another, it must be protected in a variety of ways to counteract different threats. A situation arises of a chain of different types of links that protects information. Naturally, the enemy will strive to find the weakest link in order to get to the information at the lowest cost. This means that legitimate users must take this circumstance into account in their protection strategy: it makes no sense to make some link very strong if there are obviously weaker links (the “principle of equal strength of protection”). Coming up with a good cipher is a labor-intensive task. Therefore, it is advisable to increase the lifetime of a good cipher and use it to encrypt as many messages as possible. But this creates a danger that the enemy has already solved (opened) the code and is reading the protected information. If the network cipher has a replaceable key, then by replacing the key, you can make it so that the methods developed by the enemy no longer have an effect.

Information technology

CRYPTOGRAPHIC INFORMATION PROTECTION

Principles of development and modernization of encryption (cryptographic) information security tools

Information technology. Cryptographic data security. Principles of creation and modernization for cryptographic modules

OKS 35.040

Date of introduction 2018-05-01

Preface

1 DEVELOPED by the Center for Information Protection and Special Communications of the Federal Security Service of the Russian Federation (FSB of Russia)

2 INTRODUCED by the Technical Committee for Standardization TC 26 "Cryptographic Information Protection"

3 APPROVED AND ENTERED INTO EFFECT by Order of the Federal Agency for Technical Regulation and Metrology dated December 22, 2017 N 2068-st

4 INTRODUCED FOR THE FIRST TIME

The rules for applying these recommendations are established in Article 26 of the Federal Law of June 29, 2015 N 162-FZ "On standardization in the Russian Federation" . Information about changes to these recommendations is published in the annual (as of January 1 of the current year) information index "National Standards", and the official text of changes and amendments is published in the monthly information index "National Standards". In case of revision (replacement) or cancellation of these recommendations, the corresponding notice will be published in the next issue of the monthly information index "National Standards". Relevant information, notices and texts are also posted in the public information system - on the official website of the Federal Agency for Technical Regulation and Metrology on the Internet (www.gost.ru)

Introduction

The current procedure in the Russian Federation for the development of encryption (cryptographic) means of protecting information that does not contain information constituting a state secret (hereinafter referred to as CIPF) is determined by the Regulations on the development, production, implementation and operation of encryption (cryptographic) means of protecting information (Regulations of the PKZ - 2005) .

In accordance with the Regulations of the PKZ - 2005, interaction is carried out between the customer of the CIPF, the developer of the CIPF, a specialized organization conducting case studies of CIPF, and the FSB of Russia, which carries out an examination of the results of case studies, based on the results of which the possibility of admitting the CIPF to operation is determined.

This document is methodological in nature and contains the principles on which the development and/or modernization of existing CIPF should be based.

The scope of the document is the interaction of customers and CIPF developers during their communication:

- among themselves;

- with specialized organizations conducting case studies;

- with the FSB of Russia, which carries out an examination of the results of case studies.

This document allows CIPF customers to navigate and become familiar with the problems that arise during the development and operation of CIPF. The principles set out in this document allow the CIPF customer to determine the provisions that should be included in the terms of reference for the development and/or modernization of CIPF, as well as, in accordance with the rules for the classification of security measures adopted in the Russian Federation, determine the class of the CIPF being developed and ensure the required level of security of the protected information .

This document allows CIPF developers to justify, when communicating with the customer, the list of work required for the development and/or modernization of CIPF, as well as to organize interaction with specialized organizations, receiving from them the information necessary for the development of CIPF.

1 Application area

These recommendations apply to encryption (cryptographic) information security tools (CIPF) intended for use on the territory of the Russian Federation.

These recommendations define the principles for the development and modernization of encryption (cryptographic) means of protecting information that does not contain information constituting a state secret.

The principles of ensuring the security of protected information before its processing in CIPF are not discussed in this document.

The principles of development and modernization of encryption (cryptographic) information security tools listed in the provision (clause 4) may be regulated by separate recommendations for standardization.

2 Normative references

These guidelines use normative references to the following standards:

GOST 2.114 Unified system of design documentation. Specifications

GOST 19.202 Unified system of program documentation. Specification. Requirements for content and design

GOST 19.401 Unified system of program documentation. Program text. Requirements for content and design

GOST 19.402 Unified system of program documentation. Description of the program

GOST 19.501 Unified system of program documentation. Form. Requirements for content and design

GOST 19.502 Unified system of program documentation. Description of application. Requirements for content and design

GOST R 51275-2006 Information protection. Information object. Factors influencing information. General provisions

GOST R 56136-2014 Life cycle management of military products. Terms and definitions

Note - When using these recommendations, it is advisable to check the validity of the reference standards in the public information system - on the official website of the Federal Agency for Technical Regulation and Metrology on the Internet or using the annual information index "National Standards", which was published as of January 1 of the current year, and on issues of the monthly information index "National Standards" for the current year. If an undated reference standard is replaced, it is recommended that the current version of that standard be used, taking into account any changes made to that version. If a dated reference standard is replaced, it is recommended to use the version of that standard with the year of approval (adoption) indicated above. If, after the approval of these recommendations, a change is made to the referenced standard to which a dated reference is made that affects the provision referred to, it is recommended that that provision be applied without regard to that change. If the reference standard is canceled without replacement, then the provision in which a reference is made to it is applied in the part that does not affect this reference.

3 Terms, definitions and abbreviations

3.1.1 hardware; AS: A physical device that implements one or more specified functions. Within the framework of this document, the hardware is divided into AS SF and AS CIPF.

3.1.2 attack: Purposeful actions using hardware and/or software with the aim of violating the security of protected information or with the aim of creating conditions for this.

3.1.3 access subject authentication: A set of actions consisting of checking and confirming, using cryptographic mechanisms, information that allows one to uniquely distinguish the authenticated (verified) access subject from other access subjects.

3.1.4 biological random number sensor; BDSC: A sensor that generates a random sequence by implementing random tests based on the random nature of repeated human interaction with the CIPF and the CIPF operating environment.

3.1.5 documentation: A set of interrelated documents united by a common purpose. Within the framework of this document, the documentation is divided into documentation of the IS, SF, CIPF software and CIPF AS, as well as the documentation of the CIPF included in the delivery kit of the CIPF.

3.1.6 CIPF life cycle: A set of phenomena and processes that repeat with a frequency determined by the lifetime of a standard design (sample) of a CIPF from its conception to disposal or a specific instance of a CIPF from the moment of its production to disposal (see GOST R 56136-2014, article 3.16).

3.1.8 protected information: Protected information converted by CIPF using one or more cryptographic mechanisms.

3.1.9 imitation of a true message (imitation): A false message that is perceived by the user as a true message.

3.1.10 imitation insert: Information in electronic form that is attached to or otherwise associated with other information in electronic form (processed information) and that is used to protect the processed information using cryptographic mechanisms from the imposition of false information.

3.1.11 imitation protection: Protection of processed information using cryptographic mechanisms from the imposition of false information.

3.1.12 engineering cryptographic mechanism: An algorithmic or technical measure implemented in CIPF to protect information from attacks resulting from malfunctions or failures of CIPF AS and SF AS.

3.1.13 initialization sequence (initial key information): A set of data used by the PDSCH to generate a pseudo-random sequence.

3.1.14 informative signal: A signal whose values and/or parameters can be used to determine protected or cryptographically dangerous information (see recommendations, article 3.2.6).

3.1.15 information system; IS: A system designed for presenting, storing, processing, searching, distributing and transmitting information via communication channels, accessed using computer technology. In the case of using CIPF to protect information processed in an IS, the information system is one or a set of several CIPF operating environments.

3.1.16 communication channel: A set of technical means that ensure the transfer of information from a source to a recipient. The set of technical means may include, in particular, a transmitter, a communication line, a storage medium, a receiver, hardware and/or software.

Note - Examples of communication channels include: wired and wireless channels, radio channels, as well as channels implemented using alienable (removable) storage media.

3.1.17 authentication key: The cryptographic key used to authenticate the access subject.

Note - In this document, authentication keys refer to the private and public key pairs used in asymmetric cryptographic schemes and protocols. The authentication keys can be the electronic signature key and the electronic signature verification key, the public and secret keys of the participants in the protocol for generating a shared key or an asymmetric (hybrid) encryption scheme. Authentication keys also include passwords.

3.1.19 electronic signature key: A cryptographic key, which is a unique sequence of characters intended to create an electronic signature (Federal Law, Article 2, paragraph 5).

3.1.20 key information: A specially organized collection of data and/or cryptographic keys designed to provide cryptographic protection of information for a certain period of time.

3.1.21 key document: Key information carrier containing key information and/or initialization sequence, as well as, if necessary, control, service and technological information.

3.1.22 key carrier: A physical medium of a certain structure, designed to accommodate and store key information and/or an initialization sequence. There are one-time key media (table, punched tape, punched card, etc.) and reusable key media (magnetic tape, floppy disk, CD, Data Key, Smart Card, Touch Memory, etc.).

3.1.23 design documentation: Documentation for CIPF, AS, SF and IS, containing detailed information about the principles of operation and the development process of CIPF, AS, SF and IS.

3.1.24 controlled area: The space within which regular facilities are located and the stay and actions of persons and/or vehicles are monitored.

Note - The border of the controlled zone can be, for example, the perimeter of the protected territory of an enterprise (institution), the enclosing structures of a protected building, a protected part of a building, or a designated premises.

3.1.25 cryptographic function: A parametric function implemented by CIPF and designed to ensure the security of protected information. One of the parameters of a cryptographic function can be a cryptographic key.

Note - In this document, cryptographic functions that can be implemented by CIPF should be understood as:

- function of generating pseudo-random sequences;

- data encryption/decryption function;

- imitation protection function (data integrity monitoring function);

- function of creating an electronic signature;

- electronic signature verification function;

- the function of creating an electronic signature key and an electronic signature verification key;

- the function of producing key documents;

- the function of transmitting key information via communication channels;

- authentication function.

3.1.26 cryptographically dangerous information: Any information stored and/or generated during the operation stage of CIPF, the possession of which by an intruder may lead to a violation of the security of protected and/or protected information.

3.1.27 key (cryptographic key): A variable element (parameter), each value of which uniquely corresponds to one of the mappings (cryptographic functions) implemented by CIPF (see dictionary, p. 31).

NOTE In this document, cryptographic keys are divided into private keys and public keys.

3.1.28 cryptographic mechanism: An algorithm, protocol or scheme during which information is converted using a cryptographic key (cryptographic transformation).

3.1.29 imposition: An attack carried out by delivering to the user an imitation of a true message, obtained by generating a false message or modifying a really transmitted or stored message.

Note - In this document, undeclared capabilities should be understood as functionality of software, as well as hardware, the operation of which may lead to a violation of the security of protected information or create conditions for this.

Notes

1 Unauthorized access can be carried out by a legal entity, an individual, a group of individuals, including a public organization.

2 Information for which unauthorized access is not permitted may include, in particular, protected information, key information, and cryptographically dangerous information.

3.1.32 place of operation of the CIPF: The location of the standard facilities where the CIPF is operated.

3.1.33 informatization object: A set of information resources, information processing tools and systems used in accordance with a given information technology, means of supporting an informatization object, premises or objects (buildings, structures, technical means) in which they are installed (see GOST R 51275-2006, article 3.1 ).

Note - In this document, the objects of informatization include, in particular, IS, SF, CIPF, standard equipment, premises in which standard equipment is located, communication channels.

3.1.35 organizational and technical measures: A set of actions aimed at the joint application of organizational measures to ensure information security, technical and cryptographic methods of protecting information, using tools that have passed the procedure for assessing compliance with the requirements of the legislation of the Russian Federation in the field of information security.

3.1.36 public key: An unclassified cryptographic key that is uniquely associated with the secret key of the CIPF (see dictionary, p. 32).

Note - An example of a public key is the electronic signature verification key.

3.1.37 password: A cryptographic key that takes values from a set of low cardinality. As a rule, it is represented as a finite sequence of characters from a fixed alphabet and is used to authenticate the subject of access to CIPF.

3.1.38 software; Software: A set of data and commands, presented in the form of source and/or executable code and intended to operate on special-purpose and general-purpose hardware in order to obtain a certain result.

Note - Within the framework of this document, the software is divided into SF software, AS SF software, CIPF software and AS CIPF software.

3.1.39 software random number sensor; PDSCH: A sensor that generates a pseudo-random sequence by deterministically transforming the initialization sequence (original key information).

3.1.40 role-based authentication of access subjects: Authentication of access subjects, the successful completion of which allows you to associate a predetermined set of rules for interaction of the access subject with CIPF with the access subject.

3.1.41 secret key: A cryptographic key kept secret from persons who do not have access rights to the protected information, CIPF cryptographic keys and/or the use of CIPF cryptographic functions (see dictionary, p. 32).

3.1.42 specialized organization: An organization that has the right to carry out certain types of activities related to encryption (cryptographic) means and carries out case studies (see regulation, article 2, paragraph 32).

3.1.43 CIPF operating environment; SF: A set of one or more hardware (AS SF) and software (software), together with which the CIPF functions normally and which can affect the fulfillment of the requirements for the CIPF.

The software is divided into:

- operating environment hardware software (AS SF software), which is software that operates within a single hardware and is designed to solve a highly specialized range of tasks, for example BIOS, hard disk controller driver, etc.;

- operating environment software (SF software), which is divided into:

1) operating system (OS),

2) application software (ASW), which must function or functions in the operating system.

Schematically, the operating environment can be represented as follows (see Figure 1).

Figure 1 - Diagram of the operating environment

Figure 1

3.1.44 means of cryptographic information protection; CIPF: An encryption (cryptographic) tool designed to protect information that does not contain information constituting a state secret, and which is a combination of one or more components:

- software (CIPF software);

- hardware (AS CIPF);

- hardware software (AS CIPF software).

Schematically, CIPF can be represented as follows (see Figure 2).

Figure 2 - CIPF scheme

Figure 2

3.1.45 access subject: A person or process in an information system whose actions to access information system resources are regulated by access control rules.

Note - The subject of access to CIPF, in particular, can be an individual who uses the cryptographic functions of CIPF to ensure the security of protected information, or an information system process that interacts with CIPF.

3.1.46 tactical and technical requirements for key documents; TTT: A document defining the cryptographic, special and technical requirements that key documents must satisfy (see regulation, article 2, paragraph 28).

Note - Tactical and technical requirements are developed by the developer of the CIPF and approved by the FSB of Russia.

3.1.47 case studies: A set of cryptographic, engineering cryptographic and special studies aimed at assessing the compliance of CIPF with the information security requirements for CIPF (see Regulations, Article 2, paragraph 31).

3.1.48 technical characteristics of CIPF: Parameters of CIPF software and hardware, as well as methods for ensuring the security of protected information and/or protected CIPF information during its storage or transmission via communication channels, the values of which allow to ensure the required level of security.

Note - The technical characteristics of the CIPF may include, in particular, the amount of information encrypted on one secret key, the likelihood of malfunctions or failures of the CIPF hardware and/or the CIPF operating environment, and the parameters of informative signals.

3.1.49 universal software; UPO: Software of general use by unspecified users. Universal software is developed without targeting any specific field of activity and is included in the SF software.

3.1.50 successful attack: An attack that has achieved its goal.

3.1.51 vulnerability: A property of AS and/or software, resulting, in particular, from implementation errors and/or the existence of undeclared capabilities and allowing successful attacks on CIPF.

3.1.52 physical random number sensor; FDSC: A sensor that generates a random sequence by converting a signal from a random process generated by a non-deterministic physical system that is resistant to realistically possible changes in external conditions and its parameters.

3.1.53 standard means: A set of AS and software on which IS, SF and CIPF are implemented.

3.1.54 exported function: A function implemented in the CIPF software and described in the documentation for the CIPF software, which is provided to developers who integrate the CIPF into the IS.

3.1.55 electronic signature; ES: Information in electronic form that is attached to or otherwise associated with other information in electronic form (signed information) and that is used to identify the person signing the information (Federal Law, Article 2, paragraph 1).

Note - Types of electronic signatures are simple electronic signature and enhanced electronic signature. There is a distinction between an enhanced unqualified electronic signature and an enhanced qualified electronic signature.

3.1.56 CIPF life cycle stage: Part of the CIPF life cycle, distinguished by the characteristics of control moments (control boundaries), which provide for verification of the characteristics of design solutions of the standard design of CIPF and/or the physical characteristics of CIPF instances (see GOST R 56136-2014, article 3.18).

Note - This document discusses only the following stages of the CIPF life cycle: development (modernization), production, storage, transportation, commissioning (commissioning) and operation of the CIPF.

3.2 The following abbreviations are used in these recommendations:

AC - hardware;

AS CIPF - CIPF hardware;

AS SF - hardware of the operating environment;

BDSN - biological random number sensor;

DSCh - random number sensor (divided into FDSN, BDSN and PDSN);

IS - information system;

OS - operating system;

PDSCh - software random number sensor;

Software - software;

AS CIPF software - CIPF hardware software;

AS SF software - hardware software for the operating environment;

CIPF software - CIPF software;

SF software - operating environment software;

PPO - application software;

CIPF is a means of cryptographic information protection;

SF - operating environment;

TK - technical specifications for the development (modernization) of CIPF;

TTT - tactical and technical requirements for key documents;

UPO - universal software;

FDSN - physical random number sensor;

ES - electronic signature.

4 General principles for constructing CIPF

This section provides general principles on which the development of new or modification of existing cryptographic information protection systems is based.

4.1 CIPF must ensure the security of protected information when attacks are carried out during the processing of protected information in CIPF and/or subject to unauthorized access to protected CIPF information during its storage or transmission over communication channels.

4.2 CIPF must implement one or more cryptographic functions. Depending on the implemented cryptographic functions, CIPF can be classified as one or more means:

a) encryption tool;

b) means of imitation protection;

c) electronic signature tool;

d) coding tool;

e) a means of producing key documents;

f) key document.

4.3 Encoding tools are not discussed in this document.

4.4 All CIPF are divided into 5 classes, ordered by seniority:

a) class KC1 - junior in relation to classes KC2, KC3, KB and KA;

b) class KC2 - junior in relation to classes KC3, KB, KA and senior in relation to class KC1;

c) class KC3 - junior in relation to classes KB, KA and senior in relation to classes KC1, KC2;

d) class KB - junior in relation to class KA and senior in relation to classes KC1, KC2, KC3;

e) class KA - senior in relation to classes KC1, KC2, KC3, KB.

4.5 The class of the CIPF being developed (upgraded) is determined by the CIPF customer by forming a list of IP objects to be protected and a set of capabilities that can be used when creating methods, preparing and carrying out attacks on these objects, taking into account the information technologies used in the IP, operating environment and hardware .
[email protected]

If the payment procedure on the payment system website has not been completed, monetary
funds will NOT be debited from your account and we will not receive payment confirmation.
In this case, you can repeat the purchase of the document using the button on the right.

An error has occurred

Payment was not completed due to a technical error, funds from your account
were not written off. Try waiting a few minutes and repeating the payment again.

Type