Search CSRC

Self-driving cars and autonomous systems of all types are notoriously difficult challenges for software assurance. Both traditional testing and formal methods are even harder to apply for autonomous systems than in ordinary cases. The key problem is that these systems must be able to function correctly in a vast space of possible input conditions. For example, autonomous vehicles must deal with lighting, rain, fog, pedestrians, animals, other vehicles, road markings, signs, etc. Combinatorial methods are uniquely well suited to analysis and testing for this enormous input space, because by...

Autonomous systems are increasingly seen in safety-critical domains, such as self-driving vehicles and autonomous aircraft. Unfortunately, methods developed for ultra-reliable software, such as avionics, depend on measures of structural coverage that do not apply to neural networks or other black-box functions often used in machine learning. This problem is recognized and teams are seeking solutions in aviation and other fields. As one notes, "How do we determine that the data gathered to train an AI system is suitably representative of the real world?[1]" This key question is currently...

Combinatorial methods improve security assurance in two ways: Reducing vulnerabilities - Multiple studies show that about two-thirds of security vulnerabilities result from ordinary coding errors that can be exploited (for example, lack of input validation). By identifying errors more efficiently, combinatorial testing can reduce vulnerabilities as well. Specialized security testing - We have been able to achieve huge improvements in fault detection for cryptographic software, hardware Trojan horse and malware, web server security, access control systems, and others. Below are some...

Latest research: Combinatorial Frequency Differencing. NIST Cybersecurity Whitepaper.- Describes measures of the frequency of combination coverage and difference between Class and Non-class elements in machine learning classification problems. Illustrates application of these methods for identifying weaknesses in physical unclonable function implementations. Combinatorial Coverage Difference Measurement. NIST Cybersecurity Whitepaper.- Introduces a variety of measures that can be applied to understanding differences in combination coverage. Also see our User Manual for the coverage...

Through virtual events and email list, the Forum provides our members: a venue to exchange information, share ideas and best practices, resources, and knowledge; an ongoing opportunity to leverage the work done in other organizations to reduce possible duplication of effort; and access to a community and network of cybersecurity and privacy professionals across the U.S. federal, state, and local government and at higher education organizations handling federal information. Virtual Events Refer to the Events Page for upcoming Forum meetings and registration information. Forum...

The Automated Cryptographic Validation Testing System (ACVTS) comprises two main environments that support the Automated Cryptographic Validation Protocol (ACVP): the demonstration environment (ACVTS Demo aka “Demo”) and the production environment (ACVTS Prod aka “Prod”). Demo is a sandbox-style environment in which users may test their algorithm implementations and ACVP client applications. The Demo environment should be considered semi-volatile, meaning that any information stored in it is subject to loss at any time, though we do strive to keep the environment as stable and intact as...

Algorithm Specifications Algorithm specifications for current FIPS-approved and NIST-recommended random number generators are available from the Cryptographic Toolkit. Current testing includes the following algorithm: DRBG (SP 800-90A) Algorithm Validation Testing Requirements Deterministic Random Bit Generators (DRBG) The DRBG Validation System (DRBGVS) specifies validation testing requirements for the DRBG algorithm in SP800-90A . Testing Notes Prerequisites for DRBG testing are listed in the CAVP Frequently Asked Questions (CAVP FAQ) General Question GEN.5. Test Vectors...

Algorithm Specifications Algorithm specifications for current FIPS-approved and NIST-recommended secure hashing algorithms are available from the Cryptographic Toolkit. Current testing includes the following algorithms: SHA-1 and SHA-2 Hash functions: SHA-1 SHA-224 SHA-256 SHA-384 SHA-512 SHA-512/224 SHA-512/256 (in FIPS 180-4) SHA-3 Hash functions: SHA3-224 SHA3-256 SHA3-384 SHA3-512 and XOFs: SHAKE128 SHAKE256 (in FIPS 202) Algorithm Validation Testing Requirements FIPS 202, "SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions" Secure Hash Algorithm-3...

What is Human-Centered Cybersecurity? Human-centered cybersecurity is an approach that considers human needs, motivations, behaviors, abilities, and limitations when developing and implementing cybersecurity products, processes, policies, and services. Within an organizational context, human-centered cybersecurity is a multi-faceted concept that includes: Security culture - establishing organization-wide values, attitudes, and beliefs that contribute to better cybersecurity outcomes Human-system interactions – understanding and designing security systems that align with human psychology...

NIST Special Publication 800-160, Volume 3 Systems Security Engineering Considerations for Software Assurance NIST Special Publication 800-160, Volume 4 Systems Security Engineering Considerations for Hardware Assurance

Publications: Daniel Borbor, Lingyu Wang, Sushil Jajodia, Anoop Singhal,"Securing Networks Against Unpatchable and Unknown Vulnerabilities Using Hetrogeneous Hardening Options", 31st IFIP Conference on Data and Application Security and Privacy (DBSEC 2017), Philadelphia, Pennsylvania, July 19-21, 2017. Xiaoyan Sun, Anoop Singhal, Peng Liu,"Towards Actionable Mission Impact Assessment in the Context of Cloud Computing", 31st IFIP Conference on Data and Application Security and Privacy (DBSEC 2017), Philadelphia, Pennsylvania, July 19-21, 2017. Changwei Liu, Anoop Singhal, Duminda...

As part of a holistic risk management strategy and applying the information security concept of defense-in-depth, organizations should employ appropriate configuration settings on commercial information technology products that compose their organizational systems. These products include, for example, mainframe computers, workstations, portable and mobile devices, and network components. Requirements to establish mandatory configuration settings derive from the Federal Information Security Management Act as implemented by FIPS 200 and NIST Special Publication 800-53 (Control CM-6,...

Publications: 2023: M. Sonmez Turan. Optimizing implementations of Boolean Functions. 8th International Workshop on Boolean Functions and their Applications (BFA). Also at ia.cr/2024/133 2022: M. Sonmez Turan. New Bounds on the Multiplicative Complexity of Boolean Functions. 7th International Workshop on Boolean Functions and their Applications (BFA). Also at ia.cr/2022/1077 2021: M. Sonmez Turan, and R. Peralta, On the Multiplicative Complexity of Cubic Boolean Functions. ia.cr/2021/1041 2020: Calik, C., Turan, M.S. & Peralta, R. Boolean functions with multiplicative complexity 3 and...

Short URL: https://csrc.nist.gov/pqc-standardization FIPS 203, FIPS 204, and FIPS 205, which specify algorithms derived from CRYSTALS-Dilithium, CRYSTALS-KYBER, and SPHINCS+, were published August 13, 2024. FALCON was also selected and will be published in FIPS 206 (in development). See NIST IR 8413, Status Report of the Third Round of the NIST Post-Quantum Cryptography Standardization Process. HQC was selected for standardization on March 11, 2025. See NIST IR 8545, Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process. Additional Digital...

Official comments on the Second Round Candidate Algorithms should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to pqc-comments@nist.gov The...

The following table summarizes the first several years of FIPS 140-3 development. Date Activity 2/12/2005 Federal Register Notice: Announcing Development of Federal Information Processing Standard (FIPS) 140-3, a Revision of FIPS 140-2, Security Requirements for Cryptographic Modules. 2/28/2005 Public comment period ended for new and revised requirements for FIPS 140-3. 9/26/2005-9/29/2005 Physical Security Testing Workshop 3/31/2007 NIST completed preparing the first public draft of FIPS 140-3 and began the NIST /...

Archived. This page is archived for informational purposes only. See End-of-Life Announcement: NIST SCAP Validation Program. Security Content Automation Protocol Validated Products and Modules This webpage contains a list of products and modules that have been validated by NIST as conforming to the Security Content Automation Protocol (SCAP) and its component standards. SCAP validated products and modules have completed formal testing at an NVLAP accredited laboratory and meet all requirements as defined in NIST IR 7511. A module is defined as a software component that may be embedded in...

SCAP Discussion List (View and Subscribe) The SCAP team at NIST maintains a moderated discussion list that users can post to, regarding the Security Content Automation Protocol (SCAP). This is the primary discussion list for on-going development of SCAP v2.This list is moderate in volume. SCAPv2 Subgroup Lists There are a number of existing SCAPv2 community subgroups that are working on more specific areas of work: SCAPv2 Content Metadata and Repositories (View and Subscribe) SCAPv2 Applicability Language (View and Subscribe) SCAPv2 OVAL and Checking Languages (View and...

The MIP list contains cryptographic modules on which the CMVP is actively working on. For a module to transition from Pending Review to Review, the lab must first pay the NIST Cost Recovery fee, and then the report will be assigned as resources become available. The validation process is a joint effort between the CMVP, the laboratory and the vendor and therefore, for any given module, the action to respond could reside with the CMVP, the lab or the vendor. This list provides some granularity into which entity has the action. The various circumstances that can trigger "Hold" are stated in the...

Fundamental background papers: Empirical justification for combinatorial testing: D.R. Kuhn, D.R. Wallace, A.M. Gallo, Jr., Software Fault Interactions and Implications for Software Testing, IEEE Transactions on Software Engineering, vol. 30, no. 6, June 2004, pp. 418-421.Abstract; DOI: 10.1109/TSE.2004.24 Preprint. Comment: Investigates interaction level required to trigger faults in a large distributed database system. IPOG algorithm used in construction of covering arrays: Y.Lei, R. Kacker, D.R. Kuhn, V. Okun and J. Lawrence, IPOG: a General Strategy for T-way Software Testing, 14th...

Post-quantum candidate algorithm nominations are due November 30, 2017. Call for Proposals NIST will form an internal selection panel composed of NIST employees for the technical evaluations of the submitted algorithms. This panel will analyze the submitted algorithms and review public comments that are received in response to the posting of the “complete and proper” submissions. The panel will also take into account all presentations, discussions and technical papers presented at the PQC standardization conferences, as well as other pertinent papers and presentations made at other...

The Asset Reporting Format (ARF) is a data model to express the transport format of information about assets, and the relationships between assets and reports. The standardized data model facilitates the reporting, correlating, and fusing of asset information throughout and between organizations. ARF is vendor and technology neutral, flexible, and suited for a wide variety of reporting applications. The Emerging Specifications Discussion List is available for developers interested in ARF and other emerging security automation standards. Please subscribe to this list through the SCAP...

TMSAD describes a common trust model that can be applied to specifications within the security automation domain, such as Security Content Automation Protocol (SCAP). Since information in the security automation domain is primarily exchanged using Extensible Markup Language (XML), the focus of this model is on the processing of XML documents. The trust model is composed of recommendations on how to use existing specifications to represent signatures, hashes, key information, and identity information in the context of an XML document within the security automation domain. TMSAD Resources...

Validation Number: 143 Vendor: Rapid7 Product Name: Nexpose Product Major Version: 6 Product Version Tested: 6.4.16 Tested Platforms: Microsoft Windows 7, SP1, 64 bit Microsoft Windows Vista, SP2, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Validated Product Vendor Provided SCAP Information Dates Tested: 7/1/2016 - 2/2/2017...

Validation Number: 141 Vendor: ThreatGuard Product Name: Secutor Compliance Automation Toolkit (S-CAT) Product Major Version: 5 Product Version Tested: 5.1.3.11 Tested Platforms: Microsoft Windows XP Professional, SP3, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows 7, SP1, 32 bit Microsoft Windows 7, SP1 64 bit Microsoft Windows 8.1, 32 bit Microsoft Windows 8.1, 64 bit Microsoft Windows Server 2012, 64 bit Red Hat Enterprise Linux 5, 32 bit Red Hat Enterprise Linux 5, 64...