Search CSRC

Journal: IEEE Cloud Computing Magazine Abstract: Organizations often struggle to capture the necessary functional capabilities for each cloud-based solution adopted for their information systems. Identifying, defining, selecting, and prioritizing these functional capabilities and the security components that implement and enforce them is surprisin...

Abstract: The National Institute of Standards and Technology (NIST) is developing a cybersecurity performance testbed for industrial control systems. The goal of the testbed is to measure the performance of industrial control systems (ICS) when instrumented with cybersecurity controls in accordance with the b...

Abstract: This ITL Bulletin describes the recent update of NISTIR 7298, Glossary of Key Information Security Terms. NISTIR 7298, Revision 2, provides a summary glossary of terms used in NIST publications and other relevant sources.

Journal: The Next Wave - The National Security Agency's Review of Emerging Technologies Abstract: In December 2011, the White House Office of Science and Technology Policy (OSTP) released the Trustworthy Cyberspace: Strategic Plan for the Federal Cybersecurity Research and Development Program —a framework for a set of coordinated Federal strategic priorities and objectives for cybersecurity rese...

Journal: Software Quality Professional Abstract: The need for human review often causes high costs for testing of graphical interface software. Some testers advocate combinatorial testing, combining strong fault detection with a small number of tests. This article compares combinatorial testing with the traditional method of exhaustive human testi...

Abstract: This bulletin summarizes the information that was published in NIST Interagency Report (NISTIR) 7621, Small Business Information Security: The Fundamentals, by Richard Kissel. The publication presents three major areas that small businesses should address to provide security for their information, s...

NPIVP maintains validation lists for validated PIV Card Applications and PIV Middleware. The PIV Card Application validation list is updated as new PIV Card Applications receive validation certificates from the NPIVP. The PIV Middleware Validation is discontinued beginning with SP 800-73-5 specifications since smart card support is natively supported by most endpoint devices -without the need of PIV middleware. To be listed on the NPIVP validated product list, a product must be tested in a NPIVP Test Facility using approved test methods and test tools. PIV Card Application Validation...

Software Download (last updated February 13, 2020): SP 800-73-4 Test Runner for PIV Card Applications, Middleware and Data Model Note: File is a zipped (.zip) file & is 12.4 MB in size. Depending on Internet speed, this software download may take little time to download to several minutes. Please send an e-mail to piv-dmtester@nist.gov to request for a password to unzip the Test Runner file and/or for any questions you may have.

The CSOR has allocated the following registration branch for objects defined under the ARPA/Air Force-sponsored Information Object Security (IOS) project: {joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) csor(3) iosp(3)}. The IOS project was a multi-year effort to investigate and develop advanced security services to the Internet sponsored by the Advanced Research Project Agency (ARPA) and the Air Force. The architecture developed consists of sequences of components specified in ASN.1. Each component, and subsequent sub-type, carries an object identifier. Most of the...

The tools distributed here are used extensively in testing for security vulnerabilities. Survey article: Simos, D. E., Kuhn, R., Voyiatzis, A. G., & Kacker, R. (2016). Combinatorial Methods in Security Testing. IEEE Computer, 49(10), 80-83. Introduces CT-based approaches for security testing and presents our case studies and experiences so far. The success of the presented research program motivates further intensive research on the field of combinatorial security testing. In particular, security testing for the Internet of Things (IoT) is an area where these approaches may prove...

The field of formal methods covers a broad range of mathematically-based techniques for specifying and verifying properties of software and systems. Formal methods can be very effective for certain classes of problems, but they have gained a reputation for enormous expense. One of the greatest opportunities for cost-effective use of these methods is the union of formal methods with testing. When a formal specification can be used in generating expected test results, the cost of developing the specification can be offset by a great reduction in the otherwise high cost of producing a test...

Algorithm Specifications Algorithm information is available from the Cryptographic Toolkit page. Algorithm Validation Testing Requirements The algorithm validation testing requirements for FIPS 198-1 are specified in: The Keyed-Hash Message Authentication Code (HMAC) Validation System (HMACVS). Testing Notes Prerequisites for HMAC testing are listed in the CAVP Frequently Asked Questions (CAVP FAQ) General Question GEN.5. Test Vectors Use of these test vectors does not replace validation obtained through the CAVP. The test vectors linked below can be used to informally verify the...

Retired Algorithms And Algorithm Components Current retired testing includes the following algorithms and references: DES Data (Message) Authentication Code (MAC) and Key Management Using ANSI X9.17 Message Authentication Code (MAC), FIPS 113 Key Management Using ANSI X9.17, FIPS 171 Algorithms and/or Algorithm Components as detailed in SP800-131A Revision 1 Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths RNG (FIPS 186-2 with Change Notice 1 dated October 5, 2001 (Appendix 3.1 and 3.2), ANSI X9.31 (Appendix A.2.4) and ANSI...

2023 [10-30-2023] Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation Program has been updated. Updated Guidance G.8 Revalidation Requirements – Added requirements in Scenario 3B for a table indicating which certificate fields have been updated. G.17 Remote Testing for Modules – Updated to be consistent with the FIPS 140-3 remote testing guidance. D.4 Requirements for Vendor Affirmation of SP 800-56B- Removed reference to the December 31, 2023 transition. D.9 Key Transport Methods – Updated the language on the December 31, 2023...

The Least Version Principle The least version principle is designed to address which specification version to use when maintaining SCAP content. Under this principle, content is expressed using the minimum specification version, in a series of minor releases, that is necessary to properly address the content's purpose or use-case. This allows for the broadest support within products, while reducing the content maintenance burden that would be required to maintain revisions of content for multiple specification versions.

All questions regarding the implementation and/or use of any PIV Middleware included in the validation list should first be directed to the vendor. SP 800-73-4 PIV Middleware Validation List Certificate # Product Name Vendor Validation Date 24 IDplug PIV Middleware (version 1.4) Idemia 01/02/2024 23 90meter PIV Middleware, Version 1.4 90meter, Inc. 03/13/2018 22 ID-One PIV Client API SP800-73-4 version 2.1.0.0 Oberthur Technologies 06/13/2017

The following products have been placed on the Removed Products List because they do not conform to the requirements of FIPS 201-2 effective since 9/05/14 or to the requirements of FIPS 140-2. All questions regarding the implementation and/or use of any PIV Card Application located on the validation list should first be directed to the vendor. Cert # Product Name Vendor Issue Date/ Update Date FIPS 140-2 validation certificate # and date Product Details Removed Reason 1 PIV End Point Java Card Applet (Version: v1.08[1], v.1.09[2]) for...

- OCIL Schema - Element Dictionary Schema: OCIL Version: 1.0 Release Date: December 29, 2008 VERSION 1.0 The Open Checklist Interactive Language (OCIL) is a language to express a set of questions to be presented to a user and procedures to interpret responses to these questions for the purpose of developing security checklists. Although its intended domain of use is IT security, its generic nature allows for other applications. For instance, it could be used for authoring research surveys, academic course exams, and instructional walkthroughs. This document was originally developed by...

Date: August 18, 2006 Document version: 0.1 This is a draft report and does not represent an official position of The MITRE Corporation. Copyright © 2006, The MITRE Corporation. All rights reserved. Permission is granted to redistribute this document if this paragraph is not removed. This document is subject to change without notice. Table of Contents Summary and Purpose Content Decisions CD.1 Effect vs. Technical Mechanism (Basic CD) CD.2 One Effect/Multiple Technical Mechanisms (Combine) CD.3 One Effect/Multiple Parameter Values (Combine) CD.4 Single Object vs. Parameters...

This page contains resources referenced in the FIPS 140-3 Management Manual Equivalency Regression Test Table It is possible, under certain conditions, for a vendor to list multiple hardware modules under the same certificate. Some of the conditions are defined by the equivalency categories based on the technologies types and difference between the modules within the equivalency categories. For more information regarding equivalency categories and testing level scenarios/categories and usage of the equivalency regression test table presented below, refer to the Management Manual...

The Entropy Validation Server Test System is the process by which a lab may submit all information around an entropy source to receive a validation. This is done by interacting with the Web API offered by the Entropy Validation Server. For information on the protocol, reporting issues, and requesting access, view the GitHub page: https://github.com/usnistgov/esv-server. The same server also accepts submissions for Random Bit Generators demonstrating conformance to SP 800-90C. The protocol is based on ACVP. Information on that can be found here: Automated Cryptographic Validation Testing....

ESV Guidelines and Templates Entropy Assessment Report Template v1.2 is a document to aid in writing entropy assessment reports for all entropy sources. The template is not required, but is recommended to ensure that all requirements from SP 800-90B and associated IGs are covered in the report. The template is available for edits, so labs may customize the colors, branding, or content if desired. Entropy Validation Submission Guidelines outlines the steps required to submit an entropy source to the CMVP through the Entropy Source Validation Test Server. Credentials must be requested...

A generic application (app, for short) of beacon randomness is enabling public-verifiability of randomized procedures. For example, when randomly sampling for audits, auditors are prevented from biasing the selections (or being accused of it), and auditees are prevented from knowing the selections in advance (or being accused of it). An interesting randomness/determinism duality: although beacon applications relate to the use of randomness, their public auditability requires a well specified deterministic operation (which then uses as input the needed random values). The remainder of this...

Property based testing deals with the test oracle problem by specifying a set of properties that can be checked automatically after a test. For example, a property to check for a bank deposit transaction might be "transaction_amount > 0 && new_balance == old_balance + transaction_amount". After a set of properties are defined, random values (within a specified range) can be applied and output checked against the properties. Combinatorial test methods can make this process both more efficient and more thorough. Instead of applying random values, t-way combinations of values can be used....

Official comments on the First Round Signatures should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to pqc-comments@nist.gov The Round 1...