ISO/IEC 18033

Overview of ISO/IEC 18033

ISO/IEC 18033 is an international standard that defines encryption algorithms to provide confidentiality of data. It was developed by the ISO/IEC JTC 1/SC 27 committee to standardize cryptographic techniques. The standard is divided into multiple parts, each addressing a different type of encryption algorithm, including symmetric ciphers, asymmetric ciphers, and stream ciphers.

The goal of ISO/IEC 18033 is to provide a framework of trustworthy and tested encryption algorithms suitable for international use and interoperability in secure systems.

Structure of the Standard

• Part 1 – General: Provides an overview of encryption systems, terminology, and classification of algorithms.
• Part 2 – Asymmetric Ciphers: Covers public-key algorithms like RSA, ElGamal, and others.
• Part 3 – Block Ciphers: Defines block encryption algorithms such as AES, MISTY1, and Camellia.
• Part 4 – Stream Ciphers: Specifies stream-based encryption methods like HC-128 and Rabbit.

Major Algorithm Types

• Block Ciphers: Encrypt data in fixed-size blocks. AES is the most widely used and recommended block cipher in Part 3.
• Stream Ciphers: Encrypt data one bit or byte at a time. These are efficient for real-time applications (e.g., RC4 is deprecated; Rabbit and HC-128 are included).
• Asymmetric Ciphers: Based on mathematical problems such as factoring or discrete logarithms. Examples include RSA and ElGamal.
• Modes of Operation: Though not directly in 18033, block cipher modes like CBC, CTR, and GCM are crucial for secure encryption.

Implementation Considerations

• Security Strength: Selection should be based on required security levels and key lengths (e.g., AES-256 vs. AES-128).
• Efficiency: Stream ciphers may offer performance benefits in constrained environments like IoT devices.
• Interoperability: Use of standardized algorithms ensures compatibility across systems and vendors.
• Compliance: Organizations implementing ISO/IEC 27001 often refer to ISO/IEC 18033 for choosing compliant algorithms.
• Algorithm Lifecycle: Algorithms like RC4 are now deprecated; implementers should track cryptographic recommendations and deprecations.