Search CSRC

Fundamental background papers These papers established much of the basis for today's interest in combinatorial methods for testing and assurance. The first one provided empirical evidence, across a range of domains, that most failures are triggered by one or two factors interacting, with progressively fewer by three or more factors. Failures involving more than six factors were not seen, and have not been found since. Consequently, covering all 5-way or 6-way combinations can be thought of as "pseudo exhaustive" or "effectively exhaustive" since they cover all, or nearly all, inputs...

PEC tools include a variety of cryptographic primitives, protocols and techniques useful for enabling privacy. This page uses simplified illustrations of "ideal functionalities" to convey a brief intuition about some representative PEC tools. It should be noted that real protocols for these PEC tools use cryptographic techniques in place of the trusted party (\(\mathcal{F}\)) represented in the figures. Zero Knowledge Proof of Knowledge (ZKPoK) A ZKPoK allows a prover to prove knowledge of a secret \(\color{red}w\) (also called witness), without disclosing it to the verifier. The secret is...

Official comments on the Fourth Round Candidate Algorithms should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to pqc-comments@nist.gov The...

Our initial planning for the CPRT project comprises three phases: Phase 1: Free the Data We are currently in Phase 1, which involves developing the data format and freeing the data from a selection of our guidelines and frameworks with broad impact. This data is typically locked into publications. By moving it into a shared repository using a newly-developed unified data format, we will now be able to offer new ways to interact with and download the data. Phase 1 offers only basic tools for interacting within each reference datasets. Phase 2: Manage the Data Phase 2 in late 2023 will...

November 1, 2022: NIST issues summary and analysis of responses to the CUI Series pre-draft call for comments. Comments received in response to the pre-draft call for comments on the CUI Series. Submitters’ names and affiliations (when provided) will be included, while contact information will be removed. Date Received From July 19, 2022 Williams International July 19, 2022 Real IT Care July 19, 2022 RSM US LLP July19, 2022 ePlus Technology, Inc July 19, 2022 Mercy Medical Center July 20, 2022 ESN...

Examples of combinatorial coverage achieved by real-world test suites in various application domains. The test suites studied in these examples were designed using conventional methods, i.e., they were not developed using ACTS or another covering array tool. Application Config t = 2 t = 3 t = 4 t = 5 t = 6 Reference Spacecraft control 132754262 0.940 0.831 0.668 0.536 Maximoff, J. R., Kuhn, D. R., Trela, M. D., &...

Call for Additional Digital Signature Schemes for the Post-Quantum Cryptography Standardization Process (PDF) Closed June 1, 2023 The Round 2 candidates were announced October 24, 2024. NIST IR 8528, Status Report on the First Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process is now available. NIST announced that the PQC standardization process is continuing with a fourth round, with the following KEMs still under consideration: BIKE, Classic McEliece, HQC, and SIKE. However, there are no remaining digital signature candidates...

NIST has set up a pqc-forum@list.nist.gov mailing list. The mailing list will be used to discuss the standardization and adoption of secure, interoperable and efficient post-quantum algorithms. You must be subscribed to send email to the mailing list. Please use the instructions below to subscribe. To join: mailto:pqc-forum+subscribe@list.nist.gov You will receive a response message from jupyter+subconfirm@list.nist.gov. Please click the "Join" link inside that email to confirm your subscription request. To unsubscribe: mailto:pqc-forum+unsubscribe@list.nist.gov Mailing List...

An RBG-forum@list.nist.gov email mailing list has been established for dialogue regarding NIST's RBG project. It is an unmoderated mailing list; messages addressed to this list are immediately distributed to all the addresses on the list. To join: mailto:RBG-forum+subscribe@list.nist.gov You will receive a response message from jupyter+subconfirm@list.nist.gov. Please click the "Join" link inside that email to confirm your subscription request. To unsubscribe: mailto:RBG-forum+unsubscribe@list.nist.gov

The National Institute of Standards and Technology previously hosted a series of monthly educational workshops focused on the Open Security Controls Assessment Language (OSCAL). NOTE: These workshops are no longer being held and remain available as an archive of education resources for the OSCAL community. The purpose of these workshops is to improve OSCAL adoption by expanding the OSCAL community of interest (COI) through the onboarding of members who have no previous knowledge of OSCAL. By helping establish the foundation for security automation, with a particular focus on the continuous...

A ciphermodes-forum@list.nist.gov email list has been established for dialogue regarding NIST's Cipher Modes project. Use the following link to subscribe/unsubscribe: https://groups.google.com/a/list.nist.gov/g/ciphermodes-forum

Automated test generation is of little value if it only generates data, without the expected results for each set of inputs. The methods described below can generate both inputs and expected outputs. Kuhn DR, D Yaga, Hu, V, Kacker RN, Lei Y. Pseudo-Exhaustive Testing of Rule Based Systems, 30th Intl Conference on Software Engineering and Knowledge Engineering, Redwood City, CA July 1-3, 2018. Kuhn DR, Hu V, Ferraiolo DF, Kacker RN, Lei Y. Pseudo-Exhaustive Testing of Attribute Based Access Control Rules. In2016 IEEE Ninth International Conference on Software Testing, Verification...

The Computer Forensic Reference DataSet Portal (CFReDS) is a gateway to documented digital forensic image datasets. These datasets can assist in a variety of tasks including tool testing, developing familiarity with tool behavior for given tasks, general practitioner training and other unforeseen uses that the user of the datasets can devise. Most datasets have a description of the type and locations of significant artifacts present in the dataset. There are descriptions and finding aides to help you locate datasets by the year produced, by author, or by attributes of the dataset. All of the...

The Federated Testing project is an expansion of the Computer Forensics Tool Testing (CFTT) Program to provide digital forensics investigators and labs with test suites for tool testing and to support shared test reports. The goal of Federated Testing is to help digital forensics investigators to test the tools that they use in their labs and to enable sharing of tool test results within the digital forensics community. Shared Test Suites CFTT has developed test suites that will help you test your forensic tool. The test suites are packaged together in a live Linux .iso file. To test your...

NIST seeks to accelerate the adoption of our cybersecurity and privacy standards, guidelines, and frameworks by making it much easier for users of NIST products to identify, locate, compare, and customize content across NIST’s standards, guidelines, and practices. This will also add value to our existing NIST guidance by delivering human- and machine-consumable information. What is the Cybersecurity and Privacy Reference Tool (CPRT)? The CPRT provides a centralized, standardized, and modernized mechanism for managing reference datasets (and offers a consistent format for accessing reference...

We are always eager to collaborate, hear your feedback, and work alongside you. Please reach out to us anytime and let us know your thoughts. Map with us! Do you want to submit your mappings to NIST documents and have them displayed on our site? Please follow the details below or email olir@nist.gov if you have any questions. Submission Guidelines Learn more about OLIR by visiting their website. Contact Information Questions, comments, or feedback? Email us at cprt@nist.gov. Follow us on X! Subscribe to our GovDelivery list so you get future email updates!

The following are selected examples of additional resources supporting incident response preparation. General Incident Response Programs, Policies, and Plans Carnegie Mellon University, Incident Management (includes plan, policy, and reporting templates, and incident declaration criteria) Computer Crime & Intellectual Property Section (CCIPS), U.S. Department of Justice, Best Practices for Victim Response and Reporting of Cyber Incidents Cybersecurity & Infrastructure Security Agency (CISA), Incident Response Plan (IRP) Basics NIST, Guide for Cybersecurity Event Recovery (SP...

The following are selected examples of additional resources supporting the incident response life cycle. Vulnerability and Threat Information CISA, Automated Indicator Sharing (AIS) CISA, CISA Cyber Threat Indicator and Defensive Measure Submission System CISA, Cybersecurity Alerts & Advisories CISA, Cybersecurity Directives CISA, Ransomware Vulnerability Warning Pilot (RVWP) The MITRE Corporation, MITRE ATT&CK National Council of ISACs (NCI) NIST, Guide to Cyber Threat Information Sharing (SP 800-150) NIST, National Vulnerability Database (NVD) NIST, Recommendations for...

Human-centered cybersecurity (HCC) (also known as usable security) involves the social, organizational, and technological influences on people’s understanding of and interactions with cybersecurity. By taking a human-centered cybersecurity approach, we can both improve people's cybersecurity experiences and achieve better cybersecurity outcomes. This Google Group provides a forum for human-centered cybersecurity researchers, cybersecurity and IT practitioners, and human factors experts to share ideas, best practices, and potential engagement opportunities. Read the September 2024 NIST Blog...

More complex cryptographic functions use other cryptographic primitives as building blocks to securely perform the desired operations. The Automated Cryptographic Validation Test System (ACVTS) testing of higher level cryptographic functions focuses on the algorithm itself and not the other algorithms that may also be used. This means it is required that prerequisite algorithms are tested separately in order to receive a cryptographic algorithm validation. The following tables outline the prerequisite requirements for ACVTS. Symmetric Key Algorithm Mode...

Live at HIMSS: NIST’s Secure Data-Sharing Platform Provides a Trusted Gateway to Clinical Data | GovCIO Media & Research

The original SFDS proposal was a finalist in the NIST 2021 TMAP pitch competition. Click here to read the article.

2022 FIPS 201 Rev. 3 Public Comments Special thanks to those who participated in the workshops and provided technical comments in shaping this standard. The commentators represented a wide range of government and industry organizations including the following (file is in .pdf format): 2020 Draft comments and dispositions 2012 FIPS 201 Rev. 2 Public Comments Special thanks to those who have participated in the workshops and provided valuable technical comments in shaping this standard. The commentators represented a wide range of government and industry organizations,...

Talks from Workshop on Combinatorial Testing for Artificial Intelligence-Enabled Systems September 4, 2024 Virginia Tech Research Center, Arlington, VA https://sites.google.com/vt.edu/ct-workshop Ongoing teaching workshops in this area may be found here. The goal of this workshop was to provide practitioners and researchers with a foundational understanding of combinatorial testing techniques and applications to testing AI-enabled software systems (AIES). Participants included staff from Cybersecurity and Infrastructure Security Agency (CISA), Office of Sec. of Defense, Director...

Research tools to support combinatorial testing. No license is required and there are no restrictions on distribution or use. All software is provided free of charge and will remain free in the future. NIST is an agency of the US Government, so this software is public domain. You are free to include it and redistribute it in commercial products if desired. ACTS is in Java, and will run on any platform with the latest Java release (Java free download is at java.com). There are many users running current Windows, Mac OS, and Linux systems. ACTS Basic version download Java .jar file. No...