Search CSRC

The National Institute of Standards and Technology (NIST) and the National Security Agency (NSA), partners in the National Information Assurance Partnership (NIAP), …

Type: Presentation

Type: Presentation

Type: Presentation

Type: Presentation

Type: Briefing

Type: Presentation

Type: Presentation

Federal agencies and departments are required to comply with FIPS 140-1, Security Requirements for Cryptographic Modules. This involves the acquisition of validated cryptographic modules (which may be incorporated in a product/application) for protecting sensitive but unclassified data. Cryptographic modules are used to provide security services such as confidentiality, integrity, and authentication. FIPS 140-1 provides users with 1) a specification of security features that are required at each security level, 2) flexibility in choosing security requirements and environments, and 3) a guide...

Full Workshop Details Cryptography and security applications make extensive use of random numbers and random bits, particularly for the generation of cryptographic keying material. A key to initiate a cryptographic algorithm needs to be unpredictable and statistically unique,that is, to have at most a negligible chance of repeating the value of a previously selected key. Selecting a key at random ensures that there is no known structure to the key selection process that an adversary might be able to use to determine the key, other than by an exhaustive search. NIST is in the process of...

NIST conducted a two-day Key Management Workshop on March 4-5, 2014. The workshop was held to discuss a draft of NIST Special Publication (SP) 800-152 ("A Profile for U.S. Federal CKMS") that was made available for public comment prior to the workshop. This draft was based on the requirements in SP 800-130 ("A Framework for Designing Cryptographic Key Management Systems"), but extended beyond SP 800-130 to establish specific requirements for Federal organizations desiring to use or operate a CKMS, either directly or under contract; recommended augmentations to these requirements for those...

Elliptic curve cryptography will be critical to the adoption of strong cryptography as we migrate to higher security strengths. NIST has standardized elliptic curve cryptography for digital signature algorithms in FIPS 186 and for key establishment schemes in NIST Special Publication 800-56A. In FIPS 186-2, NIST recommended 15 elliptic curves of varying security levels for use in these elliptic curve cryptography standards. The provenance of the curves was not fully specified, leading to recent public concerns that there could be a hidden weakness in these curves. We remain confident in...

Full Workshop Details Cryptography and security applications make extensive use of random numbers and random bits, particularly for the generation of cryptographic keying material. A key to initiate a cryptographic algorithm needs to be unpredictable and statistically unique, that is, to have at most a negligible chance of repeating the value of a previously selected key. Selecting a key at random ensures that there is no known structure to the key selection process that an adversary might be able to use to determine the key, other than by an exhaustive search. NIST is in the process of...

Agenda at a glance: Executive Order 14028 – Section 4 Enhancing Software Supply Chain Security, Matthew Scholl, Computer Security Division Draft SP 800-161 Revision 1, Supply Chain Risk Management Practices for Information Systems and Organizations, Angela Smith and Jon Boyens, Computer Security Division __ NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal C-SCRM Forum fosters...

Presentations & Speakers at a Glance: Update from the Office of the Federal Chief Information Officer, Maria Roat (OMB) Update from GAO on the Cybersecurity & Information Security Audit Manual, Jennifer R. Franks (GAO) OMB Circular A-130 Implementation and Updates to SP 800-53 and FedRAMP, Carol Bales (OMB), Brian Conrad (GSA), and Vicky Pillitteri (NIST) Federal Zero Trust Strategy, Eric Mill (OMB) NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL...

The National Institute of Standards and Technology hosted on Tuesday, March 1st, and Wednesday, March 2nd, 2022, the third workshop in the series focusing on the Open Security Controls Assessment Language (OSCAL). Setting the foundation for security automation, with particular focus on the continuous authorization to operate (ATO) processes and continuous monitoring, OSCAL provides machine-readable representations of control catalogs, control baselines or profiles, system security plans, assessment plans, assessment results, and plan of actions and milestones, in a set of formats expressed in...

The first webinar in the Digital Identity Guidelines Webinar Series will center on a discussion of risk as it relates to digital identity. Panelists will explore the various lenses through which digital identity can be viewed, the variety and breadth of risks associated with digital identity, and how those risks might be considered in organizational, societal, and individual contexts. Series Overview This is part of the Digital Identity Guidelines Webinar Series. In furtherance of NIST’s effort to gain critical input on the Draft Fourth Revision to NIST Special Publication 800-63, Digital...

This second webinar in the Digital Identity Guidelines Webinar Series will focus on the changes NIST has made to the identity proofing guidance and illicit inputs on how the government and industry can collaboratively continue to innovate on identity proofing technology and services. Panelists will explore leading practices in commercial and public sector use cases, discuss emerging trends, identify areas of continued improvement in NIST guidance, and discuss techniques that may provide additional optionality and choice for end users. Series Overview This is part of the Digital Identity...

This final webinar in the Digital Identity Guidelines Webinar Series will focus on the evolving nature of authentication technology and how organizations and NIST are addressing new innovations in the space. Panelists will discuss phishing-resistant authentication, trends in MFA such as FIDO and Passkeys, and the challenges of moving on from SMS authentication. Series Overview This is part of the Digital Identity Guidelines Webinar Series. In furtherance of NIST’s effort to gain critical input on the Draft Fourth Revision to NIST Special Publication 800-63, Digital Identity Guidelines (Draft...

Public Law 100-235, "The Computer Security Act of 1987," mandated NIST and OPM to create guidelines on computer security awareness and training based on functional organizational roles. Guidelines were produced in the form of NIST Special Publication 800-16 titled, "Information Technology Security Training Requirements: A Role- and Performance-Based Model." The learning continuum modeled in this guideline provides the relationship between awareness, training, and education. The publication also contains a methodology that can be used to develop training courses for a number of audiences which...

[Redirects to https://www.nist.gov/itl/csd/biometrics/biometric-conformance-test-software-biocts] The Computer Security Division (CSD) supports the development of national and international biometric standards and promotes conformity assessment through: Participation in the development of biometric standards Sponsorship of conformance testing methodology standard projects Development of associated conformance test architectures and test suites Leadership in national (link is external) and international (link is external) standards development bodies Visit the Biometric Conformance...

The circuit complexity project, part of the Cryptographic Technology Group, operates within the Computer Security Division, in the Information Technology Laboratory at NIST. The project is focused on researching circuit complexity, and developing reference material about circuits. Motivation and goals Circuit complexity is a topic of great relevance to cryptography. Optimization of circuits leads to efficiency improvement in a wide range of algorithms and protocols, such as for symmetric-key and public-key cryptography, zero-knowledge proofs and secure multi-party...

Users of the former "Crypto Toolkit" can now find that content under this project. It includes cryptographic primitives, algorithms and schemes are described in some of NIST's Federal Information Processing Standards (FIPS), Special Publications (SPs) and NIST Internal/Interagency Reports (NISTIRs). Crypto Standards and Guidelines Activities Block Cipher Techniques Crypto Publications Review Digital Signatures Hash Functions Interoperable Randomness Beacons Key Management Lightweight Cryptography (LWC) Message Authentication Codes (MACs) Multi-Party Threshold Cryptography...

The Computer Security Division is working with the Department of Homeland Security (DHS) to develop guidance on Computer Security Incident Coordination (CSIC). The goal of CSIC is to help diverse collections of organizations to effectively collaborate in the handling of computer security incidents. Effective collaboration raises numerous issues on how and when to share information between organizations, and in what form information should be shared. Because different organizations may have substantially different capabilities for responding to attacks, diagnosing causes, and handling sensitive...

Privacy Enhancing Lightweight Distributed Ledger Technology When is blockchain a problem for privacy? Immutability can be a problem because private information stored in a blockchain cannot be deleted. Laws and regulations may require that users be allowed to remove private information at their request. Thus there is a need for redactable blockchain and redactable distributed ledger technology. When is blockchain a problem for security? Immutability can be a problem because security sensitive information stored in a blockchain cannot be deleted. Security policies may require deleting...