Search CSRC

Abstract: This publication specifies a standard to be used by Federal organizations which require that the integrity of computer data be cryptographically authenticated. In addition, it may be used by any organization whenever cryptographic authentication is desired. Cryptographic authentication of data durin...

Abstract: The document specifies basic security criteria for two different uses of passwords in an ADP system, (I) personal identity authentication and (2) data access authorization. It establishes the basic criteria for the design, implementation and use of a password system in those systems where passwords...

Abstract: [Originally published as Federal Standard 1028 (FED-STD-1029) by the General Services Administration. Note on Cover: "Federal Standard 1028 has been redesignated as Federal Information Processing Standards Publication (FIPS PUB) 141." Per Federal Register Notice FR 53 41221, October 20, 19...

Abstract: [Originally published as Federal Standard 2016 (FED-STD-1026) by the General Services Administration, prepared by the National Communications System. Note on Cover: "Federal Standard 1026 has been redesignated as Federal Information Processing Standards publication (FIPS PUB) 139."] This standard s...

Abstract: [Originally published as Federal Standard 1027 (FED-STD-1027) by the General Services Administration. Note on Cover: "Federal Standard 1027 has been redesignated as Federal Information Processing Standards Publication (FIPS PUB) 140." Per Federal Register Notice FR 53 41221, October 20, 1988.]...

Abstract: The Data Encryption Standard (DES) was published as Federal Information Processing Standards Publication (FIPS PUB) 46 on January 15, 1977. The DES specifies a cryptographic algorithm for protecting computer data. FIPS PUB 81 defines four modes of operation for the DES which may be employed in a wid...

Abstract: The Federal Data Encryption Standard (DES) (FIPS 46) specifies a cryptographic algorithm to be used for the cryptographic protection of sensitive, but unclassified, computer data. This FIPS defines four modes of operation for the DES which may be used in a wide variety of applications. The modes spe...

Abstract: Cost becomes an early concern in applying privacy safeguards to any computerized record-keeping system. To determine privacy cost impact one requires a concrete and rigorous approach that permits repeated analysis of carefully documented assumptions. Such a methodology appears in the work reported i...

Abstract: This publication provides guidelines for use by Federal ADP organizations in implementing the computer security safeguards necessary for compliance with Public Law 93-579, the Privacy Act of 1974. A wide variety of technical and related procedural safeguards are described. These fall into three broa...

Abstract: This publication provides guidelines to be used by Federal organizations in structuring physical security programs for their ADP facilities. It treats security analysis, natural disasters, supporting utilities, system reliability, procedural measures and controls, off-site facilities, contingency pl...

Abstract: This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines (one for each system impact level—low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact lev...

Abstract: This publication provides a catalog of security and privacy controls for information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse set of threats and risks, including hostile attacks, human errors, natural d...

Journal: Cryptography and Communications Abstract: We present techniques to obtain small circuits which also have low depth. The techniques apply to typical cryptographic functions, as these are often specified over the field G F(2), and they produce circuits containing only AND, XOR and XNOR gates. The emphasis is on the linear components...

Abstract: This document and its companion documents, SP 800-63, SP 800-63A, and SP 800-63B, provide technical and procedural guidelines to agencies for the implementation of federated identity systems and for assertions used by federations. This publication supersedes corresponding sections of SP 800-63-2. T...

Journal: Mathematics of Computation Abstract: Isogenies are the morphisms between elliptic curves and are, accordingly, a topic of interest in the subject. As such, they have been well studied, and have been used in several cryptographic applications. Velu's formulas show how to explicitly evaluate an isogeny, given a specification of the kerne...

Conference: International Symposium on Forensic Science Error Management: Detection, Measurement and Mitigation Abstract: Recognized sources of error in digital forensics include systematic errors arising from implementation errors, and random errors resulting from faulty equipment. But as digital forensic techniques expand to include statistical machine learning, another source of error will be statistical errors that...

Journal: IEEE Cloud Computing Abstract: Despite the undisputed advantages of cloud computing, customers-in particular, small and medium enterprises (SMEs)-still need meaningful understanding of the security and risk-management changes that the cloud entails so they can assess whether this new computing paradigm meets their security requir...

Abstract: This note describes a theoretical chosen-plaintext attack on the VAES3 mode for format-preserving encryption. VAES3 was specified under the name FF2 in Draft National Institute of Standards and Technology (NIST) Special Publication 800-38G.

Abstract: The ability to control access to sensitive data in accordance with policy is perhaps the most fundamental security requirement. Despite over four decades of security research, the limited ability for existing access control mechanisms to enforce a comprehensive range of policy persists. While resear...

Abstract: This publication provides a catalog of security and privacy controls for federal information systems and organizations and a process for selecting controls to protect organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizati...

Abstract: On September 5, 2013, ITL released Revision 2 of FIPS 201 (FIPS 201-2), Personal Identity Verification of Federal Employees and Contractors. The revision includes adaptations to changes in the environment and new technology since the first revision of the standard. FIPS 201-2 also provides clarifica...

Abstract: This publication provides a catalog of security and privacy controls for federal information systems and organizations and a process for selecting controls to protect organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizati...

Abstract: This publication provides a catalog of security and privacy controls for federal information systems and organizations and a process for selecting controls to protect organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizati...

Abstract: A workshop was held on September 10-11, 2012 to discuss two documents that have been posted for public comment: SP 800-130 (A Framework for Designing Cryptographic Key Management Systems) and a table of proposed requirements for SP 800-152 (A Profile for U. S. Federal Cryptographic Key Management Sy...

Journal: International Journal of Software Engineering and Knowledge Engineering Abstract: Mandatory access control (MAC) mechanisms control which users or processes have access to which resources in a system. MAC policies are increasingly specified to facilitate managing and maintaining access control. However, the correct specification of the policies is a very challenging problem. To f...