Arjun Rai Gupta
ISO/IEC FDIS 29128-2 Information security, cybersecurity and privacy protection — Verification of Cryptographic Protocols Part 2: Evaluation Methods and Activities for Cryptographic Protocols
This document defines the evaluation methods and activities to assess the artefacts defined in Part 1 for the verification of the correctness and security of a cryptographic protocol specification using the framework from ISO/IEC 15408-4.
This document defines the minimum actions to be performed by an evaluator in order to conduct an ISO/IEC 15408 series evaluation, using the criteria and evaluation evidence defined in the ISO/IEC 15408 series.
> Expected to be replaced by ISO/IEC 18045 within the coming months.
This document provides packages of security assurance and security functional requirements intended to be useful in supporting common usage by stakeholders.
Users of this document may include consumers, developers, and evaluators of secure IT products.
ISO/IEC 15408-4:2022: Information security, cybersecurity and privacy protection — Evaluation criteria for IT security Part 4: Framework for the specification of evaluation methods and activities
This document provides a standardised framework for specifying objective, repeatable and reproducible evaluation methods and evaluation activities.
This document does not specify how to evaluate, adopt, or maintain evaluation methods and evaluation activities. These aspects are a matter for those originating the evaluation methods and evaluation activities in their particular area of interest.
In the framework of this fellowship, I worked on a Technical Report (TR) that addresses critical gaps and challenges in the international standards landscape for digital content identification and binding mechanisms.
The absence of a common terminology across standardisation communities poses a major challenge. Different communities use inconsistent language when describing how content is connected with its metadata or other associated information. Whereas the C2PA initiative uses its own distinct terminology, other standardisation communities (e.g. W3C or OAIS) have different interpretations of what bindings mean. This terminological divergence leads to interoperability and mutual understanding barriers. The TR is establishing a comprehensive taxonomy that provides a neutral reference framework for multiple standardisation efforts, facilitating clearer communication across standardisation communities.
A gap the TR is addressing, is the limited comprehension of how binding mechanisms respond to content transformations. Digital content undergoes frequent alterations through compression, format conversion, and editing. Traditional identifier systems often fail when these changes occur, particularly when embedded metadata is stripped. The Working Group systematically analyses characteristics and limitations of different binding approaches, from cryptographic hashing to robust fingerprinting to watermarking techniques. This analysis will help stakeholders to make informed architectural decisions tailored to their specific requirements.
Moreover, the fellowship further contributes to positioning the recently published ISCC standard (ISO 24138:2024) within a broader global context. The TR serves as an educational resource, helping stakeholders understand how similarity-preserving identification methods complement established identification systems and address emerging needs in content provenance and authenticity verification, particularly relevant with current growth of AI-generated content.