Search CSRC

Conference: Second International Workshop on Lightweight Cryptography for Security and Privacy (LightSec 2013) Abstract: Lightweight cryptography aims to provide sufficient security with low area/power/energy requirements for constrained devices. In this paper, we focus on the lightweight encryption algorithm specified and approved in NRS 009-6-7:2002 by Electricity Suppliers Liaison Committee to be used with tokens i...

Abstract: The Domain Name System (DNS) is a distributed computing system that enables access to Internet resources by user-friendly domain names rather than IP addresses, by translating domain names to IP addresses and back. The DNS infrastructure is made up of computing and communication entities called Name...

Conference: 2013 International Conference on Security and Cryptography (SECRYPT) Abstract: Computer systems are vulnerable to both known and zero-day attacks. Although known attack patterns can be easily modeled, thus enabling the definition of suitable hardening strategies, handling zero-day vulnerabilities is inherently difficult due to their unpredictable nature. Previous research has...

Abstract: The National Institute of Standards and Technology (NIST) has received numerous requests to provide a summary glossary for our publications and other relevant sources, and to make the glossary available to practitioners. As a result of these requests, this glossary of common security terms has been...

Conference: 6th IEEE International Conference on Software Security and Reliability (SERE'12) Abstract: Reducing power consumption has become a crucial design tenet for both mobile and other small computing devices that are not constantly connected to a power source. However, unlike devices that have a limited and predefined set of functionality, recent mobile smart phone devices have a very rich set...

Conference: 2011 International Conference on Security & Management (SAM 2011), WORLDCOMP'11 Abstract: Quantifying security risk is an important and yet difficult task in enterprise network risk management, critical for proactive mission assurance. Even though metrics exist for individual vulnerabilities, there is currently no standard way of aggregating such metrics. We developed a quantitative mode...

Conference: Fast Software Encryption 2011 (FSE 2011) Abstract: Analyzing desired generic properties of hash functions is an important current area in cryptography. For example, in Eurocrypt 2009, Dodis, Ristenpart and Shrimpton introduced the elegant notion of "Preimage Awareness" (PrA) of a hash function H^P , and they showed that a PrA hash function followed...

Abstract: NIST’s Information Technology Lab awarded the Supply Chain Management Center of the Robert H. Smith School of Business at the University of Maryland in College Park a grant in support of the development of cyber supply chain best practice guidelines by NIST. In October, 2010, the Supply Chain Manage...

Abstract: The purpose of Special Publication 800-39 is to provide guidance for an integrated, organization-wide program for managing information security risk to organizational operations (i.e., mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation...

Journal: IT Professional Abstract: Managing information systems security is an expensive and challenging task. Many different and complex software components- including firmware, operating systems, and applications-must be configured securely, patched when needed, and continuously monitored for security. Most organizations have an ex...

Conference: 11th International Conference on Cryptology (INDOCRYPT 2010) Abstract: In this paper we propose a new sequential mode of operation – the Fast wide pipe or FWP for short – to hash messages of arbitrary length. The mode is shown to be (1) preimage-resistance preserving, (2) collision-resistance-preserving and, most importantly, (3) indifferentiable from a random oracle u...

Abstract: This bulletin summarizes the information presented in NISTIR 7497, Security Architecture Design Process for Health Information Exchanges (HIEs). The publication describes a systematic approach to designing a technical security architecture for the exchange of health information by building on common...

Abstract: This bulletin summarizes the information in Federal Information Processing Standard (FIPS) Publication 186-3, Digital Signature Standard (DSS). Approved in June 2009 by the Secretary of Commerce for use by federal government agencies in protecting the government's information and information systems...

Abstract: This bulletin summarizes information about the Risk Management Framework (RMF) and points to NIST standards and guidelines that assist agencies in achieving effective security for their information technology (IT) systems. The RMF guides agencies through a series of steps, taking into account the ri...

Journal: IT Professional Abstract: IT systems have long been at risk from vulnerable software, malicious actions, or inadvertent user errors, in addition to run-of-the-mill natural and human-made disasters. As we discussed in the last issue ( Surviving Insecure IT: Effective Patch Management, pp. 49 51), effective patch management is...

In: Encyclopedia of Biometrics Abstract: Common Biometric Exchange Formats Framework (CBEFF) provides a standardized set of definitions and procedures that support the interchange of biometric data in standard data structures called CBEFF biometric information records (BIRs). CBEFF permits considerable flexibility regarding BIR structures...

Conference: 9th International Conference on Cryptology in India (INDOCRYPT 2008) Abstract: Online ciphers are those ciphers whose ciphertexts can be computed in an online manner. HCBC1 and HCBC2 are two known examples of Hash Cipher Block Chaining online ciphers. HCBC1 is secure against chosen plaintext adversary (or called CPA-secure) whereas HCBC2 is secure against chosen ciphertext adv...

Abstract: This bulletin summarizes information disseminated in NIST Special Publication (SP) 800-123, Guide to General Server Security: Recommendations of the National Institute of Standards and Technology, which was written by Karen Scarfone and Wayne Jansen of NIST and by Miles Tracy of Federal Reserve Info...

Abstract: The purpose of this document is to assist organizations in planning and conducting technical information security tests and examinations, analyzing findings, and developing mitigation strategies. The guide provides practical recommendations for designing, implementing, and maintaining technical info...

Journal: IEEE Security & Privacy Abstract: Recognizing that the 32-bit addresses used by the current version of the Internet Protocol (IPv4) would soon be depleted, the Internet Engineering Task Force (IETF) has been developing its successor, Internet Protocol version 6 (IPv6). This has been a more complex undertaking than simply changing im...

Abstract: This bulletin summarizes the information that was disseminated by the National Institute of Standards and Technology (NIST) in a November 2007 Federal Register Notice. NIST is soliciting candidates for a new and robust cryptographic hash algorithm for use by Federal government agencies in protecting...

Conference: 41st Hawaii International Conference on System Sciences (HICSS) Abstract: Cell phones are an emerging but rapidly growing area of computer forensics. While cell phones are becoming more like desktop computers functionally, their organization and operation are quite different in certain areas. For example, most cell phones do not contain a hard drive and rely instead on fl...

Abstract: This bulletin summarizes the guidance developed by NIST and published in NISTIR 7435 to help IT managers to make sense of data about the vulnerabilities of their information systems and to take appropriate actions that will protect their systems and information. The bulletin explains the Common Vuln...

Abstract: Radio frequency identification (RFID) is a form of automatic identification and data capture technology that uses electric or magnetic fields at radio frequencies to transmit information. An RFID system can be used to identify many types of objects, such as manufactured goods and animals. RFID techn...

Abstract: This bulletin explains the need for the use of digital forensic techniques, which can help organizations respond more effectively to information security incidents, and protect the confidentially, integrity and availability of their information and systems. While generally associated with law enforc...