Search CSRC

I. Introduction NIST scientific or technical Public Working Groups bring together organizations actively engaged in the specific field of interest and consist of subject-matter experts who collaborate to determine best practices and to develop consensus standards. During the past decade, NIST has convened multi-disciplinary cloud computing working groups to take on specific challenges that impact the broad US Government adoption of complex cloud-based solutions that combine services from more than one cloud service provider (CSP). The change in technical operations and control dynamics for...

Official comments on the Selected Algorithms should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to pqc-comments@nist.gov July 2022: The...

Why are we doing this? NIST seeks to : Accelerate the adoption of our cybersecurity and privacy standards, guidelines, and frameworks by making it much easier for users of NIST products to identify, locate, compare, and customize content across NIST’s standards, guidelines, and practices. Add value to our existing reference datasets by delivering human- and machine-consumable reference datasets. The CPRT provides a centralized, standardized, and modernized mechanism for managing reference datasets, eventually creating the opportunity to correlate and establish relationships...

In January 2022, the George Mason University Cryptographic Engineering Research Group (CERG) team published three calls to assist in evaluating protected implementations of the finalists: Call for Protected Hardware Implementations, targeting low-cost modern FPGAs Call for Protected Software Implementations, targeting low-cost modern embedded processors Call for Side-Channel Security Evaluation Labs The NIST team encourages submitters and third parties to contribute to this initiative. Performance benchmarking results are provided in the following pages: Microcontroller...

Validation Number: 146 Vendor: BMC Product Name: BMC Client Management Product Major Version: 21 Product Version Tested: 21.02.03 Tested Platforms: Microsoft Windows 7 SP1 64-bit Microsoft Windows 8.1 SP0 64-bit Microsoft Windows 10 SP0 64-bit Microsoft Windows Server 2012 R2 SP0 64-bit Red Hat Enterprise Linux 6 64-bit Red Hat Enterprise Linux 7 64-bit SCAP 1.3 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Option Validated...

Validation Number: 147 Vendor: Naval Information Warfare Center (NIWC) Atlantic Product Name: SCAP Compliance Checker Product Major Version: 5 Product Version Tested: 5.6.0.1 Tested Platforms: Microsoft Windows 10 SP0 32-bit Microsoft Windows 10 SP0 64-bit Microsoft Windows Server 2012 R2 SP0 64-bit Red Hat Enterprise Linux 7 64-bit Apple Mac OS 10.11 (OS X El Capitan) SCAP 1.3 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE)...

Secure Multiparty Computation (MPC) (Secure) Multiparty Computation (MPC) allows multiple parties to jointly (distributively) perform a computation, using everyone's inputs, but without actually sharing the private inputs with one another. Depending on the desired functionality, each party may also obtain a private output. MPC is one of the main techniques of interest to the PEC project. Reference material about MPC has been collected across a number of events, organized by PEC and MPTC. PEC-STPPA #2 (2021): including talks about PSI and MPC, and conversation. PEC-STPPA #6 (2023):...

The NIST OSCAL team hosts a series of mini workshops for the OSCAL community to learn, share, and connect. Each session explores topics of interest, highlights real-world OSCAL implementations, and gives community members an opportunity to present their work and exchange ideas. Most of the workshops are designed to be accessible to a broad audience and do not require deep technical knowledge of OSCAL. Discussions are interactive, with plenty of opportunities to ask questions and engage with presenters and the OSCAL team. If you are interested in presenting your OSCAL-related work or proposing...

The NIST PQC team will host talks -- open to the public -- relating to the NIST PQC standardization process. To propose a talk, please send an email to Dr. Maxime Bros at pqc-seminars@nist.gov To subscribe to the mailing list and get notifications about coming talks, please send an email to pqc-seminars+subscribe@list.nist.gov (more detailed instructions here). Instructions to connect (PDF) # Date Speaker Title Media 22 January 7, 2025 10:00am - 11:00am** Dr. Sarah Arpin, Virginia Polytechnic Institute and State University, USA and...

Welcome to the Computer Forensics Tool Testing (CFTT) Project Web Site. There is a critical need in the law enforcement community to ensure the reliability of computer forensic tools. The goal of the Computer Forensic Tool Testing (CFTT) project at the National Institute of Standards and Technology (NIST) is to establish a methodology for testing computer forensic software tools by development of general tool specifications, test procedures, test criteria, test sets, and test hardware. The results provide the information necessary for toolmakers to improve tools, for users to make informed...

The primary goal of the Tool Catalog is to provide an easily searchable catalog of forensic tools. This enables practitioners to find tools that meet their specific technical needs. The Catalog provides the ability to search by technical parameters based on specific digital forensics functions, such as disk imaging or deleted file recovery. Note: tool information is provided by the vendor. Any mention of commercial or non-commercial products is for information only and does not imply that a product has been tested. https://toolcatalog.nist.gov/

Validation Number: 148 Vendor: HCL Technologies Ltd. Product Name: HCL BigFix Product Major Version: 11 Product Version Tested: 11.0.2.125 Tested Platforms: Microsoft Windows 10 SP0 64-bit Red Hat Enterprise Linux 7 64-bit SCAP 1.3 Capabilities: Authenticated Configuration Scanner Validated Product Vendor Provided SCAP Information Dates Tested: 09/12/2024 - 05/29/2025 Report Submitted: 08/19/2025 DTR Version: Security...

Private Set Intersection (PSI) enables two (or more) parties, each with a private set, to identify which are the common elements across the sets, while not revealing information about the non-common elements. For example, two persons with privates lists of contacts can use PSI to determine which contacts they have in common. This is a very special case of Multiparty Computation (MPC), with well-known feasible solutions. More generally, a Private Set Operation (PSO) can relate to an arbitrary set operation, where the input sets remain private (i.e., beyond what each party [or coalition of...

Learn OSCAL Through an Immersive Online Escape Room Experience The NIST OSCAL Team is excited to share an immersive online escape room experience designed to help community members learn OSCAL in a hands-on, engaging way. Rather than traditional presentations or documentation walkthroughs, this escape room invites participants to actively apply OSCAL concepts in realistic scenarios. By solving challenges and progressing through the experience, users will gain a deeper, more practical understanding of how OSCAL supports modern security assessment and authorization workflows. The escape...

Official comments on the Third Round Candidates should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to pqc-comments@nist.gov. The...

(All presentations in .pdf format.) Federal Register Notice Announcing Meeting Minutes NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems Ron Ross, Computer Security Division, NIST Trusted Computing Group Secure Platform Specifications and Implementations Monty Wiseman, Intel Corporation Draft NIST Special Publication 800-58, Security Considerations for Voice Over IP Systems Rick Kuhn, Computer Security Division, NIST If you have any questions or need information please e-mail Annie Sokol .

Purpose To evaluate current personal identity verification technologies, systems, components, techniques, and procedures that would satisfy requirements for identifying Federal employees and contractors seeking access to Federal facilities and information systems. Topics Personal identity source document (ISD) authentication; verifying a claim of identity using fingerprint or facial images; use of security tokens such as integrated circuit cards for storing and processing identity credentials; communicating with security token reader/writers via electronic contact and contact-less methods;...

This workshop explores innovative and practical applications of pairing-based cryptography. Pairings have been used to create identity-based encryption schemes, but are also a useful tool for solving other cryptographic problems. We hope to encourage the development of new security applications and communication between researchers, developers and users. Tuesday, June 3, 2008 8:00 am Bus departs Gaithersburg Holiday Inn for NIST 8:30 am - 9:00 am Registration and Continental Breakfast (Sponsored by Trend Micro) 9:00 am - 9:15 am...

A CKM Workshop was held at NIST on June 8-9, 2009. Approximately 100 people participated in the Workshop at NIST on-site and approximately 90 people participated via a Webcast service. The program consisted of five keynote speakers addressing various aspects of future electronic communications, computing, and cryptography. Another twenty-five speakers addressed various technical aspects of current and future key management systems, including key management policies, algorithms, distribution methods, and user control software interfaces. Workshop Agenda and Presentations Cryptographic Key...

On October 13-14, NIST sponsored an End-to-End Voting System Workshop designed to bring together researchers in cryptography, security, and usability and election practitioners including election officials and voting system manufacturers to explore the security and usability properties of this type of innovative voting system. Keynote talks described the fundamental notation of end-to-end voting systems and a State and election official’s perspective on innovative voting systems. A tutorial on how end-to-end voting systems work provided a common background for the workshop participants. A...

Presentations & Speakers at a Glance: Measure More, Spend Less on the Way to Better Security – John Streufert, U.S. Department of State. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the National Institute of Standards and Technology (NIST) to promote the...

Presentations & Speakers at a Glance: Federal Virtual Training Environment (FedVTE) & Federal Cybersecurity Training Exercise (FedCTE), Benjamin Scribner, DHS; and Supply Chain Risk Management, Marianne Swanson. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by...

As part of its initiative to ensure that the Internet continues to spawn growth and innovation, the Department of Commerce will hold a symposium on "Cybersecurity and Innovation in the Information Economy" on July 27, 2010, at the Ronald Reagan Building and International Trade Center in Washington, D.C. The event is designed for all interested stakeholders to participate and comment on the relationship between cybersecurity in the commercial space and innovation in the Internet economy, with particular emphasis on businesses that operate non-critical infrastructure. Several senior...

During this two-day workshop, NIST introduced Draft FIPS 201-2 and elicited questions, comments and feedback. Presentations Overview (Goals of the workshop, purpose of the revision, overall revision process, summary of proposed changes) Hildegard Ferraiolo, NIST Identity Proofing and Registration (OPM Springer memo, source documents, chain-of-trust, Central Verification System) William MacGregor, NIST Issuance and Maintenance (Special rule for pseudonyms, grace period, name change by card-holder, re-key, post-issuance updates, verification data reset) Ketan Mehta, Booz Allen Hamilton PIV...

Presentations & Speakers at a Glance: Application Security Costs, Tim Howard; and Application Security in the SDLC, Terry Fletcher, FAA. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the National Institute of Standards and Technology (NIST) to promote the...