Search CSRC

Self-driving cars and autonomous systems of all types are notoriously difficult challenges for software assurance. Both traditional testing and formal methods are even harder to apply for autonomous systems than in ordinary cases. The key problem is that these systems must be able to function correctly in a vast space of possible input conditions. For example, autonomous vehicles must deal with lighting, rain, fog, pedestrians, animals, other vehicles, road markings, signs, etc. Combinatorial methods are uniquely well suited to analysis and testing for this enormous input space, because by...

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated. Many organizations are in the process of moving to role based access control. The process of developing an RBAC structure for an organization has become known as "role engineering.". Role engineering can be a complex undertaking, For example, in implementing RBAC for a large European bank with over 50,000 employees and 1400 branches serving more than 6 million customers, approximately 1300 roles were discovered. In view of the complexities, RBAC is...

Welcome to the NIST SP 800-53 Public Comment Website The NIST SP 800-53 Public Comment Site was developed to ensure that the SP 800-53 control catalog provides the most comprehensive and up-to-date set of controls/countermeasures to manage security, privacy, and supply chain risk. By modernizing the NIST comment process and moving to an online dataset instead of following a document-based update process, NIST can provide its stakeholders the most up-to-date controls in multiple data formats to manage risk while encouraging use of automation. Stakeholders can provide feedback on...

ISPAB Charter: ISPAB Charter for 2026-2028. Annual Reports: ISPAB Annual Report for Fiscal Year 2025 ISPAB Annual Report for Fiscal Year 2024 ISPAB Annual Report for Fiscal Year 2023 ISPAB Annual Report for Fiscal Year 2022 ISPAB Annual Report for Fiscal Year 2021 ISPAB Annual Report for Fiscal Year 2020 ISPAB Annual Report for Fiscal Year 2019 Annual reports for 1995 - 2018 are found on the GSA web page at: Federal Advisory Committee Act (FACA) . When you reach the site, please select “The Annual Report of the President on Federal Advisory Committees – 1972-1998.”...

FY 2026 ISPAB BOARD MEMBERS Steven Lipner, Former Chairperson Executive Director SAFECode Term Expired May 2026 Edna Conway CEO & Founder EMC Advisors Term Expires January 2030 Anne Dames Distinguished Engineer International Business Machines (IBM) Term Expires November 2028 Michael Duffy Federal Chief Information Security Officer (CISO), Acting Office of Management and Budget With continuing association with the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Homeland Security (DHS) Term Expires January 2028 Bill English Chief Information Officer (CIO) /...

09/05/2014 The NIST PIV Validation Program (NPIVP) has updated its PIV Middleware and PIV Card Application Validation lists to reflect the FIPS 201-2 implementation schedule. This schedule requires that beginning 09/05/14, new and replacement cards issued by Department and Agencies have to conform to FIPS 201-2 when on-boarding or when replacing PIV Cards as they expire over the next 5 years. The impact for the NPIVP Validation Program is that some cards with FIPS 201-1 conformant PIV Card Applications have to be removed from the validation list. Only a few cards on the validated list are...

NIST S/MIME Activities NIST has developed a NIST SP 800-49, Federal S/MIME V3 Client Profile for security and interoperability based on IETF specifications. The profile includes all mandatory features of the (S/MIME V3) IETF RFCs (RFCs 2630 through 2634) with the EXCEPTION that implementation of RFC 2631 Diffie-Hellman Key Agreement cryptographic algorithm mandated in IETF RFC 2630 is NOT required. In addition, the profile mandates certain optional features required for interoperability and security in secure email products. The primary audience is federal agencies, but the profile may be...

The CSOR has allocated the following registration branch for cryptographic algorithm objects: nistAlgorithms OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) } The CSOR only registers NIST-approved cryptographic algorithms. When an algorithm has already been externally assigned an object identifier (e.g., for EdDSA digital signature), no new OID will be assigned in the CSOR arc. Information about externally assigned OIDs is provided toward the end of the page. Registered Objects ASN.1 Modules AES Secure Hash Algorithms...

SEQUENCE COVERING The sequence covering array construct described below was introduced in: D.R. Kuhn, J.M. Higdon, J.F. Lawrence, R.N. Kacker and Y. Lei, "Combinatorial Methods for Event Sequence Testing", First International Workshop on Combinatorial Testing, in Proceedings of the IEEE Fifth International Conference on Software, Testing, Verification and Validation (ICST 2012), Montreal, Quebec, Canada, April 17-21, 2012, pp. 601-609. Preprint The notion of sequence covering has been extended to ordered combination coverage, with a theorem on necessary and sufficient conditions for...

November 21, 2014: NIST requests comments on the latest revision of NIST SP 800-90A, Recommendation for Random Number Generation Using Deterministic Random Bit Generators, which is dated November 2014. This document specifies Deterministic Random Bit Generators based on approved hash functions (as specified in FIPS 180-4), HMAC (as specified in FIPS 198-1) and block ciphers (as specified in FIPS 197 for AES, and SP 800-67 for TDEA). This revision removes the previously approved Dual_EC_DRBG that was based on the use of elliptic curves and includes a number of other changes that are listed in...

The Online Informative Reference Catalog contains all the Reference Data—Informative References and Derived Relationship Mappings (DRMs)—for the National Online Informative References (OLIR) Program. All Reference Data in the Informative Reference Catalog has been validated against the requirements of NIST Interagency Report (IR) 8278A Rev. 1 (Draft), National Online Informative References (OLIR) Program: Submission Guidance for OLIR Developers. If interested in participating in the OLIR program, please refer to the Informative Reference submission page. The OLIR Catalog provides an interface...

Proposed Modes This page contains links to the proposals for block cipher modes of operation (modes, for short) that have been submitted to NIST for consideration. NIST maintains this page in order to facilitate public review of the modes; comments may be submitted to [email protected]. Appearance of a mode in this list does not constitute endorsement or approval by NIST. See the Current Modes page for descriptions of the modes that are currently approved. For each proposal below, links are given to the available documentation, as described in the following list of abbreviations:...

Fundamental background papers These papers established much of the basis for today's interest in combinatorial methods for testing and assurance. The first one provided empirical evidence, across a range of domains, that most failures are triggered by one or two factors interacting, with progressively fewer by three or more factors. Failures involving more than six factors were not seen, and have not been found since. Consequently, covering all 5-way or 6-way combinations can be thought of as "pseudo exhaustive" or "effectively exhaustive" since they cover all, or nearly all, inputs...

Automated test generation is of little value if it only generates data, without the expected results for each set of inputs. The methods described below can generate both inputs and expected outputs. Kuhn DR, D Yaga, Hu, V, Kacker RN, Lei Y. Pseudo-Exhaustive Testing of Rule Based Systems, 30th Intl Conference on Software Engineering and Knowledge Engineering, Redwood City, CA July 1-3, 2018. Kuhn DR, Hu V, Ferraiolo DF, Kacker RN, Lei Y. Pseudo-Exhaustive Testing of Attribute Based Access Control Rules. In2016 IEEE Ninth International Conference on Software Testing, Verification...

The SP 800-90 series on random bit generation may not immediately be updated following the addition of new cryptographic algorithms to NIST’s portfolio. In the time between an algorithm’s approval and the next revision of a 90 series standard, questions often arise regarding the applicability of existing guidelines to the new algorithms. This page provides information and updates on the use of approved algorithms in the NIST random bit generation standards. For the latest implementation guidance from the Cryptographic Module Validation Program (CMVP) see the FIPS 140-3 Implementation Guidance...

Post-quantum candidate algorithm nominations are due November 30, 2017. Call for Proposals Those submission packages that are deemed by NIST to be “complete” will be evaluated for the inclusion of a “proper” post-quantum public-key cryptosystem. To be considered as a “proper” post-quantum public-key cryptosystem (and continue further in the standardization process), the scheme shall meet the following minimum acceptability requirements: The algorithms shall be publicly disclosed and made available for public review and the evaluation process, and for standardization if selected, freely...

A total of fifteen statistical tests were developed, implemented and evaluated. The following describes each of the tests. Frequency (Monobits) Test Description: The focus of the test is the proportion of zeroes and ones for the entire sequence. The purpose of this test is to determine whether that number of ones and zeros in a sequence are approximately the same as would be expected for a truly random sequence. The test assesses the closeness of the fraction of ones to ½, that is, the number of ones and zeroes in a sequence should be about the same. Test For Frequency Within A...

The tools distributed here are used extensively in testing for security vulnerabilities. Survey article: Simos, D. E., Kuhn, R., Voyiatzis, A. G., & Kacker, R. (2016). Combinatorial Methods in Security Testing. IEEE Computer, 49(10), 80-83. Introduces CT-based approaches for security testing and presents our case studies and experiences so far. The success of the presented research program motivates further intensive research on the field of combinatorial security testing. In particular, security testing for the Internet of Things (IoT) is an area where these approaches may prove...

Call for Proposals 4.A Security The security provided by a cryptographic scheme is the most important factor in the evaluation. Schemes will be judged on the following factors: 4.A.1 Applications of Public-Key Cryptography NIST intends to standardize post-quantum alternatives to its existing standards for digital signatures (FIPS 186) and key establishment (SP 800-56A, SP 800-56B). These standards are used in a wide variety of Internet protocols, such as TLS, SSH, IKE, IPsec, and DNSSEC. Schemes will be evaluated by the security they provide in these applications, and in additional...

Short URL: https://csrc.nist.gov/projects/cmvp/sp800-140c The following information is referenced from Section 6.2, Approved Security Functions, of NIST SP 800-140Cr2. Transitions | Block Cipher | Digital Signature | Secure Hash Extendable Output Functions | Message Authentication | Entropy Source DRBG | RBG | Other Security Functions | Change Log 6.2.1 Transitions Barker EB, Roginsky AL (2019) Transitioning the Use of Cryptographic Algorithms and Key Lengths. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-131A, Rev. 2....

The purpose of these courses is to provide those new to risk management with an introduction to key publications associated with the NIST Risk Management Framework (RMF) methodology for managing cybersecurity and privacy risk. The RMF Online Introductory Courses are developed by NIST and available on-demand, and free of charge. Please refer first to the FAQ below for questions about course logistics, topics and content, initial troubleshooting of issues, and certificate of completion and course credit before reaching out to the team with questions. Select a course below to learn...

The following products have been placed on the Removed Products List because they do not conform to the requirements of FIPS 201-2 effective since 9/05/14 or to the requirements of FIPS 140-2. All questions regarding the implementation and/or use of any PIV Card Application located on the validation list should first be directed to the vendor. Cert # Product Name Vendor Issue Date/ Update Date FIPS 140-2 validation certificate # and date Product Details Removed Reason 1 PIV End Point Java Card Applet (Version: v1.08[1], v.1.09[2]) for...

The Federated Testing project is an expansion of the Computer Forensics Tool Testing (CFTT) Program to provide digital forensics investigators and labs with test suites for tool testing and to support shared test reports. The goal of Federated Testing is to help digital forensics investigators to test the tools that they use in their labs and to enable sharing of tool test results within the digital forensics community. Shared Test Suites CFTT has developed test suites that will help you test your forensic tool. The test suites are packaged together in a live Linux .iso file. To test your...

Date Event July 20-21, 2015 First Lightweight Cryptography Workshop at NIST August 11, 2016 (Draft) NIST IR 8114 is published. October 17-18, 2016 Second Lightweight Cryptography Workshop at NIST October 31, 2016 End of public comment period to Draft NISTIR 8114 Public comments received (August 11 - October 31,2016) March 28, 2017 NIST IR 8114, Report on Lightweight Cryptography is published. April 26, 2017 (Draft) Profiles for Lightweight cryptography standardization process is...

The SCAP Release Cycle Changes to SCAP impact a large number of organizations that manage content and provide SCAP Validated Products and Modules and SCAP-related services. A change to SCAP often results in considerable efforts to migrate products, content, and other capabilities to the new SCAP revision. To mitigate risks relating to level-of-effort, timing, and specification changes, revisions to SCAP are managed according to a coordinated process. The following work flow process addresses these concerns. The SCAP release cycle defines a process for managing change relating to SCAP and the...