Search CSRC

The Federal Cybersecurity and Privacy Professionals Forum is an informal group sponsored by the National Institute of Standards and Technology (NIST) to promote the sharing of system security and privacy information among federal, state, and local government, and higher education employees. The Forum maintains an extensive e-mail list and holds quarterly meetings to discuss current issues and items of interest to those responsible for protecting non-national security systems. For more information about the Forum and instructions on how to join, see: https://csrc.nist.gov/Projects/forum. View...

Abstract: This work evaluates the validity of the Common Vulnerability Scoring System (CVSS) Version 3 "base score" equation in capturing the expert opinion of its maintainers. CVSS is a widely used industry standard for rating the severity of information technology vulnerabilities; it is based on human exper...

Conference: Seventeenth IFIP 11.9 International Conference on Digital Forensics Abstract: Attacks on the Internet of Things are increasing. Unfortunately, transparency and accountability that are paramount to securing Internet of Things devices are either missing or implemented in a questionable manner. Security auditing is a promising solution that has been applied with success in other...

Abstract: On-demand access to public safety data is critical to ensuring that public safety and first responder (PSFR) personnel can deliver the proper care and support during an emergency. This necessitates heavy reliance on mobile platforms while in the field, which may be used to access sensitive informati...

Abstract: Mobile devices provide access to vital workplace resources while giving employees the flexibility to perform their daily activities. Securing these devices is essential to the continuity of business operations. While mobile devices can increase efficiency and productivity, they can also leave sensi...

Conference: Fourteenth International Conference on Software Engineering Advances (ICSEA 2019) Abstract: Previous work presented a theoretical model based on the implicit Bitcoin specification for how an entity might issue a protocol native cryptocurrency that mimics features of fiat currencies. Protocol native means that it is built into the blockchain platform itself and is not simply a token running...

Abstract: Federal Information Processing Standards (FIPS) Publication 201-2, “Personal Identity Verification (PIV) of Federal Employees and Contractors,” establishes a standard for a PIV system based on secure and reliable forms of identity credentials issued by the federal government to its employees and con...

Abstract: This document proposes a reference design on how to architect enterprise-class protection for mobile devices accessing corporate resources. The example solutions presented here can be used by any organization implementing an enterprise mobility management solution. This project contains two distinct...

In: Handling and Exchanging Electronic Evidence Across Europe Abstract: This paper describes the evolution of a community-developed, standardized specification language for representing and exchanging information in the broadest possible range of cyber-investigation domains, including digital forensic science, incident response, and counter terrorism. A primary motivati...

Conference: 7th International Workshop on Post-Quantum Cryptography (PQCrypto 2016) Abstract: Recently, Gligoroski et al. proposed code-based encryption and signature schemes using list decoding, blockwise triangular private keys, and a nonuniform error pattern based on “generalized error sets.” The general approach was referred to as "McEliece in the World of Escher." This paper demonstrate...

In: Encyclopedia of Biometrics Abstract: Conformance testing is the method that is used to determine if a product, process or system (known as an implementation under test) satisfies the requirements specified in the base standard. The goal of conformance testing is to capture enough of the requirements of the base standard and test them u...

In: Encyclopedia of Biometrics Abstract: Common Biometric Exchange Formats Framework (CBEFF) provides a standardized set of definitions and procedures that support the interchange of biometric data in standard data structures called CBEFF biometric information records (BIRs). CBEFF permits considerable flexibility regarding BIR structures...

Conference: 10th International Conference on Security and Privacy in Communication Networks (SecureComm 2014) Abstract: Enterprise networks are migrating to the public cloud to acquire computing resources for promising benefits in terms of efficiency, expense, and flexibility. Except for some public services, the enterprise network islands in cloud are expected to be absolutely isolated from each other. However, some...

In: Encyclopedia of Biometrics Abstract: Common Biometric Exchange Formats Framework (CBEFF) provides a standardized set of definitions and procedures that support the interchange of biometric data in standard data structures called CBEFF biometric information records (BIRs). CBEFF permits considerable flexibility regarding BIR structures...

Driver for the National Checklist Program. The National Archives and Records Administration (NARA) is sponsoring a FAR clause regarding SP 800-171.

This involves sharing cyber threat information within or between organizations. Cyber threat information is any information related to a threat that might help an organization protect itself against a threat or detect the activities of an actor. Such information may include: i) indicators; ii) tactics, techniques and procedures (TTPs); iii) security alerts; iv) threat intelligence reports; or v) tool configurations. (Extracted from SP 800-150 (2nd Draft), Section 2)

The ability of a system or component to function under stated conditions for a specified period of time. [SP 800-160 Volume 2, Appendix B]

07/01/2018 The CMVP's symmetric key wrapping transition plan to comply to NIST SP 800-38F (as specified in SP 800-131A) has been completed (see 12/20/17 Notice) As a result, the NIST PIV Validation Program has updated its PIV Card Application Validation List by moving affected modules with PIV Card Applications to the Removed Product’s List. 06/30/2018 The two 1-year extensions to continue issue PIV Cards with RNG rather than with DRBG ended June 30th 2018. As a result, the NIST PIV Validation Program has removed listings of PIV Card with RNG implementation from the PIV Card Application...

The CSOR has allocated the following registration branch for cryptographic algorithm objects: nistAlgorithms OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) } The CSOR only registers NIST-approved cryptographic algorithms. When an algorithm has already been externally assigned an object identifier (e.g., for EdDSA digital signature), no new OID will be assigned in the CSOR arc. Information about externally assigned OIDs is provided toward the end of the page. Registered Objects ASN.1 Modules AES Secure Hash Algorithms...

Research tools to support combinatorial testing. No license is required and there are no restrictions on distribution or use. All software is provided free of charge and will remain free in the future. NIST is an agency of the US Government, so this software is public domain. You are free to include it and redistribute it in commercial products if desired. ACTS is in Java, and will run on any platform with the latest Java release (Java free download is at java.com). There are many users running current Windows, Mac OS, and Linux systems. ACTS Basic version download: Java .jar file. No...

ISPAB Charter: ISPAB Charter for 2026-2028. Annual Reports: ISPAB Annual Report for Fiscal Year 2025 ISPAB Annual Report for Fiscal Year 2024 ISPAB Annual Report for Fiscal Year 2023 ISPAB Annual Report for Fiscal Year 2022 ISPAB Annual Report for Fiscal Year 2021 ISPAB Annual Report for Fiscal Year 2020 ISPAB Annual Report for Fiscal Year 2019 Annual reports for 1995 - 2018 are found on the GSA web page at: Federal Advisory Committee Act (FACA) . When you reach the site, please select “The Annual Report of the President on Federal Advisory Committees – 1972-1998.”...

Version 1.07 enabling tools for PKI client software developers This page contains conformance tests for relying parties that validate X.509 certification paths. Each test consists of a set of X.509 certificates and CRLs. The tests are fully described in the Conformance Testing of Relying Party Client Certificate Path Processing Logic document. The goal for the first release of these tests was to address the X.509 features used in the DoD Class 3 PKI. While this test suite remains available for use, it has been superseded by the Public Key Interoperability Test Suite (PKITS), which...

July 15, 2024 NIST Releases SP 800-73-5 and SP 800-78-5 including comment dispositions for SP 800-73-5 (Part 1, Part 2, and Part 3) and SP 800-78-5. September 27, 2023 Personal Identity Verification (PIV) Interfaces, Cryptographic Algorithms, and Key Sizes: Drafts of SP 800-73-5 and SP 800-78-5 Available for Public Comment In January 2022, NIST revised Federal Information Processing Standard (FIPS) 201, which establishes standards for the use of Personal Identity Verification (PIV) Credentials – including the credentials on PIV Cards. NIST Special Publication (SP) 800-73-5: Parts 1–3 and...

Each title heading is clickable - clicking each title will expand/collapse the list of standards & supporting documents. PIV Standards: FIPS 201-3 - Personal Identity Verification (PIV) of Federal Employees and Contractors (January 2022) Federal Register Notice 2020 Draft comments and dispositions FIPS 201-2 has been withdrawn and is superseded by FIPS 201-3 PIV Card Specifications: SP 800-78-5 - Cryptographic Algorithms and Key Sizes for Personal Identity Verification (July 2024) SP 800-76-2 - Biometric Data Specification for Personal Identity...

Test Runner Software (updated February 13, 2020) SP 800-73-4 Test Runner for PIV Card Applications, Middleware and Data Model Please send an e-mail to piv-dmtester@nist.gov to request for a password to unzip the Test Runner file and/or for any questions you may have. DISCLAIMER: This software is released by NIST as a service and is expressly provided "AS IS." NIST MAKES NO WARRANTY OF ANY KIND, EXPRESS, IMPLIED OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT AND DATA ACCURACY. NIST DOES NOT REPRESENT OR...