This Circular stipulates the list of mandatory cryptographic technical standards for hardware security modules in electronic identification and authentication activities. This document aims to ensure the security and safety of information in systems using cryptographic technology.
Scope of application
Organizations and individuals involved in the production, import, distribution, and use of hardware security modules in electronic identification and authentication activities.
Key points
- Detailed provisions on cryptographic algorithms such as AES, RSA, ECDSA, SHA, HMAC, PBKDF2, DRBG.
- Requirement to use the latest versions of standards for each algorithm.
- Specifies the HS code and product description related to civil cryptography goods.
- danhmuctieuhoachungtuhoaquocgiaHS84713090847141908471499084718090
- bieumauvaformchinhthuc
🌐 Social impact of this document
- Enhance information security in electronic transactions.
- Develop the market for civil cryptography technology.
❓ Frequently asked questions
When does this Circular take effect?
This Circular takes effect from the date of issuance.
Can the cryptographic algorithms specified in this Circular be changed?
Updates to cryptographic algorithms will be based on technological development and the latest recommendations from regulatory authorities.
Full text
CIRCULAR
REGULATIONS ON THE LIST OF TECHNICAL CRYPTOGRAPHIC STANDARDS TO BE COMPULSORILY APPLIED FOR HARDWARE SECURITY MODULES IN ELECTRONIC IDENTIFICATION AND AUTHENTICATION ACTIVITIES
Pursuant to the Law on Standards and Technical Regulations dated June 29, 2006;
||| Pursuant to the Cybersecurity Law dated November 19, 2015;
Pursuant to Decree No. 01/2022/NĐ-CP dated November 30, 2022 of the Government stipulating functions, tasks, powers, and organizational structure of the Ministry of National Defense;
Pursuant to Decree No. 09/2014/NĐ-CP dated January 27, 2014 of the Government stipulating functions, tasks, powers, and organizational structure of the General Office for Official Communications under the Government;
Pursuant to Decree No. 69/2024/ND-CP dated June 25, 2024 of the Government on electronic identification and authentication;
At the proposal of the Director of the General Office for Official Communications under the Government;
The Minister of National Defense issues this Circular to regulate the List of technical cryptographic standards to be compulsorily applied for hardware security modules in electronic identification and authentication activities.
Technical cryptographic standards to be compulsorily applied for hardware security modules in electronic identification and authentication activities to protect information not within the scope of state secrets shall be implemented according to the List attached to this Circular.
Article 2. Effective Date
This Circular takes effect from November 11, 2024.
Article 3. Implementation Organization
1. The Government Cryptographic Office shall review and propose the Minister of National Defense to amend and supplement the List of technical cryptographic standards to be compulsorily applied for hardware security modules in electronic identification and authentication activities as stipulated in Article 1 of this Circular, in accordance with technological development trends and state management policies. The Government Cryptographic Office shall consider accepting the test results of organizations with sufficient capacity serving the evaluation process.
2. The Director of the Government Cryptographic Office, heads of agencies, units, and organizations, and individuals concerned are responsible for implementing this Circular./.
|
DEPUTY MINISTER
DEPUTY MINISTER
(Signed)
General Nguyen Tan Cuong
|
ANNEX
LIST OF TECHNICAL CRYPTOGRAPHIC STANDARDS TO BE COMPULSORILY APPLIED FOR HARDWARE SECURITY MODULES IN ELECTRONIC IDENTIFICATION AND AUTHENTICATION ACTIVITIES
(Attached to Circular No. 87/2024/TT-BQP dated October 26, 2024 issued by the Minister of National Defense)
I. Regulations on the List of technical cryptographic standards to be compulsorily applied for hardware security modules in electronic identification and authentication activities
|
Serial number |
Type of standard |
Standard Code |
Full Name of Standard |
Application Provisions |
|
I. Technical cryptographic standard characteristics |
||||
|
1 |
Symmetric cryptography and operation modes |
TCVN 11367-3:2016 (ISO/IEC 18033-3:2010) |
Information technology - Security techniques - Cryptographic techniques - Part 3: Block cipher. |
- Apply TCVN 11367-3:2016 (ISO/IEC 18033-3:2010) and at least one of the three operation mode standards for block ciphers. - Use one of the two algorithms: AES or TDEA. - For the AES algorithm: + Use a key size of at least 128 bits; + Use one of the following modes: CBC, CFB, OFB, GCM, CCM, CTR, XTS. - For the TDEA algorithm: + Use a key size of 192 bits; + Use one of the following modes: CBC, CFB, OFB, CTR. |
|
TCVN 12213:2018 (ISO/IEC 10116:2017). |
Information technology - Security techniques - Operation modes of n-bit block ciphers in IT. |
|||
|
ISO/IEC 19772:2020 |
Information security - Authenticated encryption |
|||
|
NIST Special Publication 800-38E |
Recommendation for Block Cipher Modes of Operation: The XTS-AES Mode for Confidentiality on Storage Devices |
|||
|
2 |
Asymmetric cryptography and digital signatures |
TCVN 11367-2:2016 |
Information technology - Security techniques - Cryptographic techniques - Part 2: Asymmetric cryptography |
Apply one of the following cryptographic algorithms: - For the RSA algorithm: + nlen ≥ 2048 + Use the RSAES-OAEP scheme for encryption and RSASSA-PSS for signing. - For the ECDSA, ECDH algorithms: + nlen ≥ 256 + Use ECDH for key distribution and ECDSA for signing. - For the DSA, DH algorithms: + L ≥ 3072, N ≥ 256. + Use DH for key distribution and DSA for signing. |
|
FIPS PUB 180-4 |
RSA Cryptography Standard |
|||
|
ANSI X9.62-2005 |
Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Algorithm (ECDSA) |
|||
|
3 |
Hashing algorithm |
TCVN 11816-3:2017 |
Information technology - Security techniques - Hash functions - Part 3: Specialized hash functions |
Use one of the following algorithms: SHA-256, SHA-384, SHA-512-256, SHA-512, SHA3-256, SHA3-384, SHA3-512. |
|
FIPS PUB 202 |
SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions |
|||
|
4 |
Message authentication algorithm |
TCVN 11495-1:2016 |
Information technology - Security techniques - Message Authentication Code (MAC) - Part 2: Mechanism using specialized hash functions. |
Use one of the following algorithms: HMAC-SHA-256-128, HMAC-SHA-256, HMAC-SHA-384-192, HMAC-SHA-384, HMAC-SHA-512-256, HMAC-SHA-512, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512. |
|
FIPS PUB 202 |
SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions |
|||
|
5 |
Key derivation function |
NIST SP 800-132 |
Recommendation for Password-Based Key Derivation Part 1: Storage Applications |
Apply PBKDF2, version 2.0 or higher (if applicable). |
|
6 |
Random bit generator |
TCVN 12853:2020 |
Security techniques - Random bit generator |
Apply one of four standards and use one of the following random bit generators: Hash_DRBG, HMAC_DRBG, CTR_DRBG(AES), MS_DRBG, MQ_DRBG, XOR-NRBG, Oversampling-NRBG. NIST SP 800-90A |
|
Recommendation for Random Number Generation Using Deterministic Random Bit Generators |
NIST SP 800-90C |
|||
|
Recommendation for Random Bit Generator (RBG) Constructions |
AIS-31 |
|||
|
A proposal for: |
Functionality classes for random number generators Secure parameter storage |
|||
|
7 |
SP800-38F |
Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping |
Secure parameters must apply AES KW or KWP mode to encrypt and store on the device. |
Application programming interface |
|
8 |
PKCS#11 |
Cryptographic Token Interface Base Specification |
Version 2.2 or higher |
II. Regulations on the HS code of hardware security modules |
Product name and goods as prescribed in this Circular
|
Serial number |
Product description |
HS Code |
Civil cryptographic products belong to the group of cryptographic key generation, key management, or key storage products. |
|
01 |
Cryptographic key generation, key management, or key storage products. |
8471.30.90 |
Explanation of abbreviations and symbols: |
|
02 |
8471.41.90 |
||
|
03 |
8471.49.90 |
||
|
04 |
8471.80.90 |
AES
|
Abbreviation |
English name |
Vietnamese name |
|
Advanced Encryption Standard |
Advanced Encryption Standard |
CBC |
|
Cipher Block Chaining Mode |
Cipher Block Chaining Mode |
CCM |
|
Counter with Cipher Block Chaining Message Authentication Code |
Counter with Cipher Block Chaining Message Authentication Code |
CTR |
|
Counter Mode |
Counter Mode |
CTR_DRBG |
|
Counter - Deterministic Random Bit Generator |
Counter - Deterministic Random Bit Generator |
DRBG |
|
Deterministic Random Bit Generator |
Deterministic Random Bit Generator |
DSA |
|
Digital Signature Algorithm |
Digital Signature Algorithm |
GCM |
|
Galois/Counter Mode |
Galois/Counter Mode |
Hash_DRBG |
|
ECDSA |
Elliptic Curve Digital Signature Algorithm |
Elliptic curve-based digital signature algorithm |
|
Hash Deterministic Random Bit Generator |
Hash Deterministic Random Bit Generator |
HMAC |
|
Hashed Message Authentication Code |
Hashed Message Authentication Code |
Deterministic random bit generator based on hash function |
|
HMAC |
Hashed Message Authentication Code |
Authentication code based on hash function |
|
HMAC_DRBG |
HMAC - Deterministic Random Bit Generator |
Deterministic Random Bit Generator based on HMAC |
|
HS |
Harmonized Commodity Description and Coding System |
Harmonized System for Describing and Coding Goods |
|
KW |
Key Wrap |
Key Wrapping |
|
KWP |
Key Wrap with Padding |
Key Wrapping with Padding |
|
MQ_DRBG |
Multivariate Quadratic Deterministic Random Bit Generator |
Multivariate Quadratic Deterministic Random Bit Generator |
|
MS_DRBG |
Micali-Schnorr Deterministic Random Bit Generator |
Micali-Schnorr Deterministic Random Bit Generator |
|
NIST |
National Institute of Standards and Technology |
National Institute of Standards and Technology (United States) |
|
NRBG |
Non-deterministic Random Bit Generator |
Non-deterministic Random Bit Generator |
|
OFB |
Output Feedback Mode |
Output Feedback Mode |
|
Oversampling-NRBG |
Non-deterministic Random Bit Generator using Oversampling structure. As described in NIST's SP 800-90C document. |
|
|
PBKDF2 |
Password-Based Key Derivation Function 2 |
Password-Based Key Derivation Function 2 |
|
PKCS |
Public Key Cryptography Standards |
Public Key Cryptography Standards |
|
QCVN |
|
National Technical Regulation |
|
RSA |
Rivest - Shamir - Adleman |
Name of the cryptographic system invented by three mathematicians Rivest, Shamir, and Adleman |
|
SHA |
Secure Hash Algorithm |
Secure hash algorithm |
|
SP |
Special Publication |
Special Publication (National Institute of Standards and Technology, USA) |
|
TCVN |
|
National standard |
|
TDEA |
Triple Data Encryption Algorithm |
Triple Data Encryption Algorithm |
|
XOR-NRBG |
Non-deterministic Random Bit Generator using XOR structure. As described in NIST's SP 800-90C document. |
|
|
XTS |
XEX-based Tweaked Codebook Mode with Ciphertext Stealing |
Narrow Block Cipher Mode |
|
Code |
Description |
|
nlen |
For the RSA algorithm: nlen length modulo bits; For the ECDSA algorithm: nlen is the bit length of the order of the generator element |
|
L |
For the DSA algorithm: L length of the domain parameter session number in bits |
|
N ||| |
For the DSA algorithm: N ||| length of the domain parameter q in bits |
Original document (PDF)
Download
Relations map
Click a document to open. A red border = a relation that changes validity.
Translations
This document is available in the following languages: