Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 18033 — Information Technology — Security Techniques — Encryption Algorithms Series
Information Technology — Security Techniques — Encryption Algorithms (2010–2015 Editions, 4 Parts)
🔏 BS ISO/IEC 18033 is the British Standard implementation, adopted by BSI, of the ISO/IEC 18033 international series prepared by Technical Committee IST/33 (IT — Security techniques), classified under ICS 35.040. The series provides standardized definitions and specifications for encryption algorithms, covering general, block ciphers, stream ciphers, and identity-based ciphers. It is the standard algorithm-library foundation for data confidentiality protection, secure transmission, and cryptographic application integration.
💡 Encryption algorithms are the “cornerstone” of information security: block ciphers and stream ciphers protect confidentiality of static and transmitted data, while identity-based ciphers simplify key management. By standardizing algorithm structures and security properties, BS ISO/IEC 18033 provides a unified basis for cross-platform, cross-vendor cryptographic interoperability.
1. Series Overview 📌
The BS ISO/IEC 18033 series consists of several parts; this batch covers Parts 1, 3, 4, and 5. Part 1 is the general part, giving a common model, terms, and symbols for encryption; Part 3 specifies block ciphers; Part 4 specifies stream ciphers; Part 5 specifies identity-based ciphers. The series supersedes earlier editions and incorporates several amendments, reflecting the continuous updating of cryptographic algorithm standards.
The series primarily serves cryptographic algorithm and protocol designers, implementers of data encryption and secure transmission systems, smart card and secure-chip vendors, VPN and disk-encryption product developers, and cryptographic module security evaluation (e.g., FIPS 140, Common Criteria) and compliance audit bodies.
2. Structure and Technical Highlights 📋
| Standard | Title | Core Content |
|---|---|---|
| BS ISO/IEC 18033-1:2015 | General | Common model, terms, symbols, purpose of encryption, and general security properties |
| BS ISO/IEC 18033-3:2010 | Block ciphers | Block cipher algorithms (64-bit blocks such as TDEA, 128-bit blocks such as AES) — structure and requirements |
| BS ISO/IEC 18033-4:2011 | Stream ciphers | Stream cipher framework, general models, keystream generators and output functions, and concrete stream cipher algorithms |
| BS ISO/IEC 18033-5:2015 | Identity-based ciphers | Identity-based encryption mechanisms, simplifying public-key management (scanned version, written from public-domain knowledge) |
⚠️ BS ISO/IEC 18033-5 in this material is a scanned version; its description is written from public-domain knowledge of the standard. Please refer to the official BSI publication for the authoritative text.
3. Key Technical Requirements 🔧
The key technical requirements of the BS ISO/IEC 18033 series are reflected in algorithm structures and security properties:
- Purpose of encryption (Part 1): clarifies that encryption protects data confidentiality and describes security properties (e.g., indistinguishability, resistance to chosen-plaintext/ciphertext attacks).
- Block ciphers (Part 3): specifies block size, key length, round function, and encryption/decryption algorithms, covering 64-bit block (e.g., TDEA) and 128-bit block (e.g., AES) standard algorithms.
- Stream ciphers (Part 4): specifies the framework and general models of stream ciphers, including keystream generators, output functions, initialization, and key/IV management, plus concrete stream cipher algorithms.
- Security strength: specifies recommended parameters (key length, block length) to ensure sufficient security margin against current computing capability.
- Identity-based ciphers (Part 5): allow an identity (e.g., e-mail address) to serve as the public key, avoiding certificate management; suited to key distribution in constrained environments.
🚨 Algorithm security is closely tied to parameter choice: overly short keys and algorithms with known weaknesses or broken cryptanalysis (e.g., DES, RC4 in security contexts) should be avoided. Use standard-recognized modern algorithms with adequate key length and security margin.
4. Engineering Practice Applications 🛠️
In engineering practice, the BS ISO/IEC 18033 series is mainly applied to:
- 🔍 Data-at-rest encryption: full-disk encryption and database encryption use block ciphers (e.g., AES) to protect static data, preventing data leakage from media loss or unauthorized access.
- 🔧 Secure transmission and VPN: protocols such as TLS and IPsec use block or stream ciphers to encrypt transmitted data, protecting network communication confidentiality.
- 📊 Wireless and IoT encryption: in resource-constrained wireless sensors and IoT devices, stream ciphers and lightweight block ciphers provide low-overhead encryption.
- 📋 Identity-based key management: in closed environments lacking PKI infrastructure (e.g., intra-enterprise, satellite communications), identity-based ciphers simplify key distribution and renewal.
✅ It is recommended that cryptographic application developers select recognized standard algorithms per the BS ISO/IEC 18033 series, combine them with ISO/IEC 10118 (hash-functions) and ISO/IEC 9797 (message authentication codes) to build complete cryptographic schemes, and periodically assess the security margin of chosen algorithms.
5. Frequently Asked Questions ❓
❓ Q: What is the difference between block ciphers and stream ciphers?
A: Block ciphers encrypt fixed-size blocks of plaintext (e.g., 64 or 128 bits), suited to block data (files, databases); stream ciphers generate a keystream XORed with plaintext byte/bit by byte, suited to continuous data streams (communications, real-time transmission), usually faster and simpler in hardware.
A: Block ciphers encrypt fixed-size blocks of plaintext (e.g., 64 or 128 bits), suited to block data (files, databases); stream ciphers generate a keystream XORed with plaintext byte/bit by byte, suited to continuous data streams (communications, real-time transmission), usually faster and simpler in hardware.
❓ Q: Why specify key length?
A: Key length determines the difficulty of brute-force attack; longer keys give higher security strength. The standard specifies recommended minimum key lengths to resist exhaustive attacks under current and foreseeable computing capability — avoid overly short keys.
A: Key length determines the difficulty of brute-force attack; longer keys give higher security strength. The standard specifies recommended minimum key lengths to resist exhaustive attacks under current and foreseeable computing capability — avoid overly short keys.
❓ Q: How do identity-based ciphers differ from traditional public-key ciphers (e.g., RSA, ECC)?
A: Traditional public-key cryptography needs certificates (PKI) binding public keys to identities; identity-based ciphers directly use an identity (e.g., e-mail address, ID) as the public key, avoiding certificates and simplifying key management, but require a trusted third party to generate private keys, raising key-escrow concerns.
A: Traditional public-key cryptography needs certificates (PKI) binding public keys to identities; identity-based ciphers directly use an identity (e.g., e-mail address, ID) as the public key, avoiding certificates and simplifying key management, but require a trusted third party to generate private keys, raising key-escrow concerns.
❓ Q: Why does Part 1 explain the “purpose of encryption” and “security properties”?
A: Clarifying the purpose and security properties (e.g., indistinguishability, resistance to chosen-ciphertext attacks) is a prerequisite for correctly designing and using algorithms, avoiding treating encryption as mere data transformation and ensuring the chosen algorithm meets application security needs.
A: Clarifying the purpose and security properties (e.g., indistinguishability, resistance to chosen-ciphertext attacks) is a prerequisite for correctly designing and using algorithms, avoiding treating encryption as mere data transformation and ensuring the chosen algorithm meets application security needs.
❓ Q: How do BS ISO/IEC 18033 and actual algorithms such as AES and TDEA relate?
A: BS ISO/IEC 18033-3 incorporates mature algorithms such as AES and TDEA into the standard specification, giving them international standard status; products may implement these algorithms per the standard and undergo conformance testing and security evaluation to ensure the implementation conforms.
A: BS ISO/IEC 18033-3 incorporates mature algorithms such as AES and TDEA into the standard specification, giving them international standard status; products may implement these algorithms per the standard and undergo conformance testing and security evaluation to ensure the implementation conforms.