When American organizations think about cryptographic standards, they usually think NIST. NIST FIPS publications govern federal use, the CAVP and CMVP programs validate implementations, and most US compliance frameworks reference NIST documents. But outside the United States, the picture is different. The international baseline is ISO/IEC. The European Union, Japan, Korea, China, India, and most other countries reference ISO/IEC standards in their procurement, certification, and regulatory frameworks.
For encryption specifically, the relevant document is ISO/IEC 18033. This is a multi-part standard published jointly by ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission). It covers asymmetric ciphers, block ciphers, stream ciphers, identity-based encryption, and homomorphic encryption. As of 2025, it is undergoing amendments to add post-quantum algorithms.
This post walks through what each part of ISO/IEC 18033 covers, how it compares to NIST documents, and what the upcoming PQC additions mean for international deployments. For software like QNSQY that aims to serve hospitals, governments, and businesses worldwide, understanding ISO/IEC 18033 is essential.
How ISO/IEC Develops Cryptographic Standards
ISO and IEC collaborate through Joint Technical Committee 1 (JTC 1), which has subcommittees focused on different areas. Cryptography lives in JTC 1 / SC 27 (IT Security techniques). SC 27 has working groups, and Working Group 2 (WG 2) handles cryptography and security mechanisms.
The development cycle is slower than NIST's. A new standard takes five to seven years from work item proposal to publication. Each part goes through stages: working draft, committee draft, draft international standard, final draft, and international standard. Comments come from national bodies (ANSI for the US, BSI for Germany, JISC for Japan, etc.).
The result is consensus-based standards with broad international acceptance, but slower to adopt new algorithms. ISO/IEC 18033 is mid-amendment as of 2025 to incorporate ML-KEM and other PQC, with publication expected in 2026 to 2027.
Part 1: General
ISO/IEC 18033-1 is the umbrella document. It defines terminology, models, and conformance requirements. It explains what the other parts cover and how they relate. For most readers, this part is reference material rather than something you implement.
The current version is ISO/IEC 18033-1:2021. It updates the original 2005 version to align with newer standards (TLS 1.3 era cryptography) and adds notes on transition to PQC.
Part 2: Asymmetric Ciphers
ISO/IEC 18033-2:2006 (with amendments) covers asymmetric encryption. Algorithms include:
- RSA-OAEP
- RSA-KEM
- ECIES
- HC and PSEC-KEM (older algorithms, less common)
This is the part most directly comparable to NIST FIPS 186 (digital signatures, but also covers RSA) and SP 800-56B (key establishment with RSA).
The post-quantum amendment is the big change for Part 2. Draft amendment ISO/IEC 18033-2:2006/Amd 1 will add ML-KEM-512, ML-KEM-768, and ML-KEM-1024. The amendment is going through comment cycles and expected to publish in 2026. Once published, ML-KEM becomes part of the international encryption baseline alongside ISO references in regulated sectors.
For QNSQY users, the practical effect is that ML-KEM in hybrid mode satisfies both NIST FIPS 203 and the upcoming ISO/IEC 18033-2 amendment. See ML-KEM explained for the algorithm details.
Part 3: Block Ciphers
ISO/IEC 18033-3:2010 covers block ciphers. The standardized algorithms are:
- AES (128, 192, 256 bit keys)
- Camellia (Japanese cipher, 128, 192, 256 bit keys)
- TDEA (Triple DES, deprecated)
- SEED (Korean cipher)
- MISTY1 (Japanese cipher, somewhat deprecated)
- HIGHT (Korean lightweight cipher)
- CLEFIA (Sony lightweight cipher)
AES is the dominant choice globally. Camellia is widely deployed in Japan and parts of Europe. SEED is mandated in Korea for some applications. Lightweight ciphers (HIGHT, CLEFIA) target IoT and constrained devices.
Notably, ISO/IEC 18033-3 does not yet include ChaCha20 (used by QNSQY for AEAD). ChaCha20 is covered separately in IETF RFC 7539 / 8439 and is widely deployed but has not gone through ISO standardization. Some ISO bodies are discussing adding it.
For PQC, block ciphers are quantum-resistant if you double the key size. AES-256 is considered safe against Grover's algorithm, which gives only a square-root speedup against symmetric ciphers. ISO/IEC 18033-3 effectively requires no PQC update for AES-256 use.
Part 4: Stream Ciphers
ISO/IEC 18033-4:2011 covers stream ciphers. Algorithms include:
- MUGI
- SNOW 2.0 and SNOW 3G (used in 4G/5G mobile)
- Rabbit
- Decim v2
- KCipher-2
SNOW is the most widely deployed because of its inclusion in mobile network standards. Most other stream ciphers see limited use.
ChaCha20 is again notable for its absence from this part. ChaCha20 is technically a stream cipher (or AEAD when combined with Poly1305). Its omission reflects ISO/IEC's slower adoption pace.
Stream ciphers, like block ciphers, are quantum-resistant at sufficient key size. No PQC amendment is planned for Part 4.
Part 5: Identity-Based Encryption
ISO/IEC 18033-5:2015 covers identity-based encryption (IBE). IBE lets you encrypt to "alice@example.com" without first looking up Alice's public key. The recipient's identity (the email or any string) is the public key, with master keys held by a trusted authority.
Algorithms in Part 5 include:
- BB1 (Boneh-Boyen)
- SK (Sakai-Kasahara)
- BF (Boneh-Franklin)
IBE has niche use cases. The biggest is enterprise email where a central authority can mint keys for all employees. It avoids the certificate distribution problem of PKI. The drawback is the trusted authority can decrypt anything (key escrow by design).
PQC for IBE is more complex than for traditional public-key encryption. Lattice-based IBE schemes exist but are not yet ISO standardized. Discussions are early.
Part 6: Homomorphic Encryption
ISO/IEC 18033-6:2019 covers homomorphic encryption. Homomorphic encryption lets you compute on ciphertext without decrypting first. The result, when decrypted, equals the result of computing on the original plaintext.
Algorithms include:
- ElGamal-based partially homomorphic encryption
- Paillier-based additively homomorphic encryption
These are partially or somewhat homomorphic schemes. Fully homomorphic encryption (FHE), which can compute arbitrary circuits, is not yet in ISO/IEC 18033-6 but is being studied. ISO/IEC 18033-7 is in development to cover FHE schemes (BFV, BGV, CKKS, TFHE).
PQC alignment: most modern FHE schemes are lattice-based and naturally quantum-resistant. The upcoming Part 7 will be PQC by default.
Comparing ISO/IEC 18033 to NIST
NIST and ISO/IEC do not have a one-to-one mapping. Rough equivalents:
- ISO/IEC 18033-1 ↔ NIST framework documents (no direct match)
- ISO/IEC 18033-2 ↔ NIST SP 800-56A/B + FIPS 203 (PQC KEM)
- ISO/IEC 18033-3 ↔ NIST FIPS 197 (AES) + SP 800-38 series (modes)
- ISO/IEC 18033-4 ↔ no direct NIST equivalent (stream ciphers covered piecemeal)
- ISO/IEC 18033-5 ↔ no NIST equivalent (NIST does not standardize IBE)
- ISO/IEC 18033-6 ↔ no NIST equivalent (NIST has ongoing HE projects)
Many algorithms appear in both. AES is in FIPS 197 and ISO/IEC 18033-3. RSA is in FIPS 186 and ISO/IEC 18033-2. ML-KEM is in FIPS 203 and (soon) ISO/IEC 18033-2.
For products that need to claim compliance globally, the typical strategy is to implement to NIST standards and document ISO/IEC alignment. The cryptographic modules are the same; only the validation paperwork differs.
ISO/IEC 19790 and Module Validation
ISO/IEC 18033 specifies algorithms, but algorithms alone are not enough. Cryptographic modules need to be validated as correctly implementing those algorithms. ISO/IEC 19790:2012 (with 2025 revision) is the international module validation standard, equivalent to NIST FIPS 140-3.
The two are now aligned: FIPS 140-3 references ISO/IEC 19790:2012 directly. A module validated to FIPS 140-3 is effectively also compliant with ISO/IEC 19790 for the algorithms it covers. See ISO/IEC 19790 modules.
PQC Amendments in Progress
As of 2025, several amendments to ISO/IEC 18033 are in active development:
- 18033-2 Amd 1: ML-KEM addition (expected 2026)
- 18033-2 Amd 2: HQC addition (expected 2027 or later)
- 18033-7: Fully homomorphic encryption (in early development)
- 14888-3 Amd: ML-DSA, SLH-DSA, FN-DSA digital signatures (expected 2026)
The pace is slower than NIST because ISO/IEC requires consensus across all participating national bodies. Once published, the amendments become reference standards for international procurement and certification.
For QNSQY, supporting both NIST FIPS 203 and the upcoming ISO/IEC 18033-2 amendment is straightforward because ML-KEM is the same algorithm in both. The only difference is which standard you cite in compliance documents.
How ISO/IEC 18033 Affects International Deployments
Companies selling cryptographic products in the European Union, Asia, or anywhere outside North America benefit from ISO/IEC 18033 compliance. Specific examples:
- EU GDPR: Article 32 requires "appropriate technical measures" including encryption. ISO/IEC 18033 algorithms are the de facto baseline for what counts as appropriate.
- Japan: government and finance sectors require Camellia or AES per ISO/IEC 18033-3.
- Korea: SEED is mandated for some government use, also covered in ISO/IEC 18033-3.
- EU eIDAS: electronic identification regulation references ISO/IEC standards for cryptographic primitives.
Hospitals operating internationally need to consider both NIST and ISO/IEC compliance. QNSQY ships AES-256 and ML-KEM (in hybrid with X25519), all of which are or will be ISO/IEC 18033 compliant. See ISO/IEC PQC standards for the broader international PQC standards picture.
National Body Positions on PQC
ISO/IEC standards are agreed by national bodies, and each national body brings its own context. A few worth highlighting in 2026.
Germany (BSI) has been the most active European national body on PQC. The BSI Technical Guideline TR-02102-1 specifies recommended cryptographic algorithms for German federal agencies and includes ML-KEM and ML-DSA in the 2025 revision, with hybrid mode mandatory through at least 2030. BSI is one of the strongest voices in SC 27 pushing for early ISO/IEC 18033 PQC amendments.
France (ANSSI) publishes its own RGS (Référentiel Général de Sécurité) referencing ISO/IEC standards. ANSSI has signaled support for ML-KEM in hybrid configurations and is leading European discussions on PQC procurement requirements through the EU's NIS2 directive implementation.
Japan (CRYPTREC) maintains the Japanese e-Government Recommended Ciphers List. CRYPTREC tracks NIST and ISO/IEC closely; ML-KEM and ML-DSA were added to its monitoring list in 2024 and are expected to enter the recommended list once ISO/IEC 18033 amendments publish.
Korea (KISA) has historically promoted SEED and other Korean ciphers. KISA's 2025 PQC migration roadmap references both NIST and ISO/IEC, with explicit support for ML-KEM in hybrid mode for government deployments through 2030.
China (OSCCA) maintains its own commercial cryptography standard hierarchy (SM2, SM3, SM4, SM9). OSCCA has signaled interest in PQC research but the China-domestic cryptographic supply chain is largely outside the ISO/IEC 18033 framework. International products targeting China typically need both ISO/IEC and OSCCA-compliant variants.
Compliance Strategy for International Vendors
For software vendors targeting global markets, the practical pattern is to implement against the strongest applicable standard and document compliance against the others. ML-KEM in hybrid with X25519 plus AES-256-GCM and HKDF-SHA-256 satisfies, in one configuration:
- US: NIST FIPS 203, FIPS 197, FIPS 198, NIST SP 800-56C Rev 2
- International: ISO/IEC 18033-2 (after 2026 amendment), ISO/IEC 18033-3, ISO/IEC 9797-2, ISO/IEC 11770-6
- EU: BSI TR-02102-1, ANSSI RGS, ENISA recommendations
- Japan: CRYPTREC monitored list
A single binary can serve all of these markets without algorithm changes. The differences are in the documentation: which standard you cite, which validation report you submit, which national certification you pursue. QNSQY's Business tier targets exactly this overlap, with documentation packages aligned to each major regulatory framework.
FAQ
Do I need to implement Camellia or SEED to be ISO/IEC compliant?
No. ISO/IEC 18033 is a menu of approved algorithms, not a checklist requiring all of them. Implementing AES-256 (covered in Part 3) plus ML-KEM (in the upcoming Part 2 amendment) gives you ISO/IEC alignment for the most common needs.
Is ChaCha20 ISO/IEC compliant?
Not currently. ChaCha20 is widely deployed (TLS 1.3, WireGuard, age, QNSQY) but is documented in IETF RFC 8439 rather than ISO/IEC. Some discussions in SC 27 suggest adding it, but no firm date. For now, AES-GCM is the safer choice for ISO/IEC compliance claims.
When will ML-KEM be in ISO/IEC 18033-2?
The amendment is in committee review with publication expected in 2026. The technical content is finalized; the wait is on ISO procedural cycles. National bodies including BSI, ANSI, JISC, and others are reviewing the draft.
Does QNSQY meet ISO/IEC 18033 requirements?
QNSQY uses AES-256-GCM (ISO/IEC 18033-3 compliant) and ML-KEM (will be ISO/IEC 18033-2 compliant after the amendment). Hybrid mode with X25519 adds defense in depth without reducing standards alignment. See pricing for tier details.
Are ISO/IEC 18033 standards free to read?
No. ISO/IEC standards are sold by ISO. Costs range from 100 to 200 CHF per part. Some national bodies sell at reduced rates. Drafts are sometimes available for public comment during development. The lack of free access is a frequent criticism.
How do I cite ISO/IEC 18033 compliance in a product datasheet?
The standard practice is "implements AES-256-GCM in compliance with ISO/IEC 18033-3:2010 and NIST FIPS 197" with a footnote pointing to the specific reference. For PQC algorithms once the amendment publishes, the equivalent will be "implements ML-KEM-768 in compliance with ISO/IEC 18033-2:2006/Amd 1:2026 and NIST FIPS 203:2024."
Do I need a separate certification for ISO/IEC 18033 versus FIPS 140-3?
In most cases, no. Because FIPS 140-3 references ISO/IEC 19790, a single CMVP-validated module covers both. The validation paperwork uses NIST language but is recognized by jurisdictions that reference ISO/IEC. A few jurisdictions (notably France for ANSSI Premier Niveau qualification) require additional national certification beyond CMVP.
Sources
- ISO/IEC 18033-1:2021, "Information security, Encryption algorithms, Part 1: General." https://www.iso.org/standard/76156.html
- ISO/IEC 18033-2:2006, "Information technology, Security techniques, Encryption algorithms, Part 2: Asymmetric ciphers." https://www.iso.org/standard/37971.html
- ISO/IEC 18033-3:2010, "Information technology, Security techniques, Encryption algorithms, Part 3: Block ciphers." https://www.iso.org/standard/54531.html
- ISO/IEC 18033-5:2015, "Information technology, Security techniques, Encryption algorithms, Part 5: Identity-based ciphers." https://www.iso.org/standard/59948.html
- ISO/IEC JTC 1/SC 27 work programme. https://www.iso.org/committee/45306.html
- BSI Technische Richtlinie TR-02102-1, Kryptographische Verfahren. https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema-sortiert/tr02102/tr02102_node.html
- ANSSI RGS, Règles et recommandations concernant la cryptographie. https://www.ssi.gouv.fr/
Related Articles
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.