Search CSRC

June 26, 2026 ESV Document Updates An update to the Random Bit Generator (RBG) Report Template v1.2 has been published. May 7, 2026 ESV Updates The CMVP is now accepting submissions justifying conformance of a random bit generator to SP 800-90C. There are updates to the documents on the Entropy Validation Documents page, adding the RBG Report Template v1.0. March 12, 2025 ESV Document Updates New Public Use Document v1.2 and Entropy Assessment Report v1.2 templates are available. June 25, 2024 ESV Document Updates There are updates to the documents on...

Fully-Homomorphic Encryption (FHE) allows computation of arbitrary functions over encrypted data, without knowing the secret key. This is a Privacy-Enhancing Cryptography (PEC) tool, alongside with Multi-Party Computation (MPC), Zero-Knowledge Proofs (ZKP), Private-Set Intersection (PSI), and others. The NIST PEC program is accompanying FHE developments and initiatives toward future useful standards. FHE is considered in category S5 of the NIST Threshold Call (NISTIR 8214C). Related presentations: • MPTS 2026 (NIST Workshop on Multi-Party Threshold Schemes) hosted three FHE-related...

The United States Government Configuration Baseline (USGCB) - Disclaimer Disclaimer for Microsoft Content Do not attempt to implement any of the settings without first testing them in a non-operational environment. These recommendations have only been tested on Windows 7 Ultimate 32-bit, Windows 7 Ultimate 64-bit, Windows 7 Enterprise x86, and Windows 7 Enterprise x64. These settings may be applicable to other Windows systems and service packs; however, NIST has not tested other Windows based systems with these settings. Please see the National Checklist Program (NCP) website for...

Resources for Implementers NIST SP 800-53 Controls Public Comment Site Comment on Controls & Baselines Suggest ideas for new controls and enhancements Submit comments on existing controls and baselines Track the status of your feedback Participate in comment periods Preview changes to future SP 800-53 releases See More: Infographic and Announcement Download the Control System Cybersecurity Tips & Tactics Infographic --> View/Search Controls & Baselines SP 800-53 Release Search View controls & baselines in browser Search controls & baselines...

CCE entries are currently assigned to configuration issues by members of the CCE Content Team and posted on the public CCE Web site. Operating system vendors are encouraged to coordinate with the CCE Content Team to have CCEs assigned to their configuration controls and/or new platforms. Please contact [email protected] for more information. Typically, a CCE Content Team Analyst first encounters a configuration issue in one of two ways: (1) The most common way an analyst encounters a configuration issue is a configuration guidance statement is in a resource document or audit tool. For example,...

Subscribing to the PEC-Forum The [email protected] mailing list was created to share announcements and questions about the "Privacy-Enhancing Cryptography" (PEC) project. Only subscribed members can send email to the mailing list. Please note that this mailing list should not be used for direct promotion of commercial products. To subscribe, please send an mail to [email protected]. You will receive a response message. Click the "Join" link inside that email to confirm your subscription request. To unsubscribe, please send an email to:...

About: The Federal Cybersecurity Supply Chain Risk Management (C-SCRM) Forum fosters collaboration and the exchange of C-SCRM information among federal organizations to improve the security of federal supply chains. Through periodic meetings and informal exchanges, the Forum offers all agencies that depend upon or guide C-SCRM an opportunity to discuss issues of interest with – and to inform – many of those leading C-SCRM efforts in the federal ecosystem, including the Office of Management and Budget (OMB), the Department of Defense (DOD), the Cybersecurity and Infrastructure Security...

OSCAL is organized in a series of layers that each provides a set of models. A model represents an information structure supporting a specific operational purpose or concept. Each model is comprised of information structures that form an information model for each OSCAL model. This information model is then bound to multiple serialization formats (i.e., XML, JSON, YAML), which represent a concrete data model. Thus, a data model defines how to represent an OSCAL information model in a serialized format. While the syntax of each format differs, all formats for a given model represent the same...

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated. The Sarbanes-Oxley Act establishes a set of requirements for financial systems, to deter fraud and increase corporate accountability. For information technology systems, regulators may need to know who used a system, when they logged in and out, what accesses or modifications were made to what files, and what authorizations were in effect. IT vendors responding to Sarbanes-Oxley (SOX) requirements have adopted RBAC as central to compliance...

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated. The Program Review for Information Security Assistance (PRISMA) project was last updated in 2007; NIST Interagency Report (IR) 7358 and the corresponding PRISMA tool continue to serve as useful resources for high-level guidance and as a general framework, but may not be fully consistent with changes to requirements, standards and guidelines for securing systems. The PRISMA review is based upon five levels of maturity: policy, procedures,...

Discover official and community-maintained resources that support OSCAL. Here you will find the OSCAL GitHub repositories, the OSCAL Gitter Lobby, documentation, documentation, and other community websites to help you collaborate and stay connected with the OSCAL community. NIST OSCAL GitHub (public): https://www.github.com/usnistgov/OSCAL and https://www.github.com/usnistgov/oscal-content The OSCAL Github repository is the primary source for the NIST OSCAL project, containing the OSCAL models, schemas, documentation, examples, and development resources. It is the central collaboration...

RFGs and CMVP Resolutions - Link to Cryptographic Module User Forum (CMUF) webpage where CMVP posts the latest Request For Guidance (RFG) and CMVP Resolutions FIPS 140-3 IG (August 19, 2026) - Latest version of FIPS 140-3 Implementation Guidance (IG) IG Change Summary & Archived Versions [08-19-2026] New Guidance: 1.B Clarifications on the Definition and Requirements of Hybrid Modules Updated Guidance: 2.3.C Processor Algorithm Accelerators (PAA) and Processor Algorithm Implementation (PAI) – (Admin update) Added an...

ABOUT Next Forum | Past Forums Cyber risk has become a topic of core strategic concern for business and government leaders worldwide and is an essential component of an enterprise risk management strategy. The Software and Supply Chain Assurance (SSCA) Forum provides a venue for government, industry, and academic participants from around the world to share their knowledge and expertise regarding software and supply chain risks, effective practices and mitigation strategies, tools and technologies, and any gaps related to the people, processes, or technologies involved. The effort...

The CSOR has allocated the following registration branch for Public Key Infrastructure (PKI) objects: csor-pki ::= {joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101) csor(3) pki(2)} Policies OIDs are allocated in the following arc: csor-certpolicy ::= { csor-pki 1 } For agencies requesting a new policy OID, please send email with OID name, associated document and point of contact information. Additional information on Federal PKI activities is available at: https://www.idmanagement.gov/fpki ACES Registered Objects August 2020: The ACES project is no longer...

Fundamental background papers: Empirical justification for combinatorial testing: D.R. Kuhn, D.R. Wallace, A.M. Gallo, Jr., Software Fault Interactions and Implications for Software Testing, IEEE Transactions on Software Engineering, vol. 30, no. 6, June 2004, pp. 418-421.Abstract; DOI: 10.1109/TSE.2004.24 Preprint. Comment: Investigates interaction level required to trigger faults in a large distributed database system. IPOG algorithm used in construction of covering arrays: Y.Lei, R. Kacker, D.R. Kuhn, V. Okun and J. Lawrence, IPOG: a General Strategy for T-way Software Testing, 14th...

NIST requests your comments on the latest revision of Special Publication 800-90A, Recommendation for Random Number Generation Using Deterministic Random Bit Generators, which is dated November 2014. This document specifies Deterministic Random Bit Generators ...

Short URL: https://csrc.nist.gov/projects/cmvp/sp800-140d The following information is referenced from Section 6.2, Sensitive security parameter generation and establishment methods, of NIST SP 800-140Dr2. Transitions | Symmetric Key Gen. | Key-Based Key Derivation Password-Based Key Deriv. | Asymmetric Key-Pair Gen. Key Agreement | Key Agreement Key Deriv. | Protocol-Suite Key Deriv. Key Transport | Key-Encapsulation Mech. | Entropy Source | DRBG | RBG | Other SSPEM | Change Log 6.2.1 Transitions Barker EB, Roginsky AL (2019) Transitioning the Use of Cryptographic Algorithms and Key...

Publications: 2023: M. Sonmez Turan. Optimizing implementations of Boolean Functions. 8th International Workshop on Boolean Functions and their Applications (BFA). Also at ia.cr/2024/133 2022: M. Sonmez Turan. New Bounds on the Multiplicative Complexity of Boolean Functions. 7th International Workshop on Boolean Functions and their Applications (BFA). Also at ia.cr/2022/1077 2021: M. Sonmez Turan, and R. Peralta, On the Multiplicative Complexity of Cubic Boolean Functions. ia.cr/2021/1041 2020: Calik, C., Turan, M.S. & Peralta, R. Boolean functions with multiplicative complexity 3 and...

Table 2 identifies and describes the decision options available for handling publications. The Crypto Publication Review Board will make its decision proposals and final recommendations to NIST management based on these options. Table 2. Publication Decision Options Publication Decision Option Description Standards (FIPS) NIST Special Publications Reaffirm The publication content is confirmed as current and remains unchanged. NIST determines the publication is current and needs no changes. NIST adds "Publication is current as of <date>."...

Note 2026-Oct-23: In the NIST Randomness Beacon 2.0, Chain 2, the referenced certificateId is incorrect between pulses 1925734 (2026-09-03T21:08:00.000Z) and 1996050 (2026-10-23T13:32:00.000Z). Explanation The correct certificate, i.e., that allows verification of the pulses' signatures in that period, is the one that was integrated from pulse 1996051 onward. This will eventually be documented in the beacon history. NOTICES This is a beta release of the 2.0 Version of the Beacon Service. The first release and data is available at: NIST Randomness Beacon (Version 1.0) May 17, 2024,...

All NPIVP test facilities are third-party laboratories accredited by the National Voluntary Laboratory Accreditation Program (NVLAP) under the Cryptographic and Security Testing (CST) Laboratory Accreditation Program (LAP) to conduct testing for PIV card application and PIV middleware test methods. atsec information security corporation 9130 Jollyville Road Suite 260 Austin, TX 78759 USA Lab Director: Yi Mao TEL: 512-615-7300 FAX: 512-615-7301 NVLAP Lab Code 200658-0 EWA - Canada IT Security Evaluation & Test Facility 55 Metcalfe Street, Suite 1600 Ottawa, Ontario K1P 6L5 Canada Lab...

In order to perform FIPS 140 conformance testing, a laboratory must become an accredited CST laboratory under the National Voluntary Laboratory Accreditation Program (NVLAP). A list of current labs may be found by visiting National Voluntary Laboratory Accreditation Program (NVLAP) / Directory Search and under the "Program" drop-down select “ITST: Cryptographic and Security Testing”. Module testing results produced by an accredited CST laboratory can then be submitted to the CMVP in order to seek FIPS 140 module validation. CST labs and NIST each charge fees for their respective parts of the...

NIST has set up a [email protected] mailing list. The mailing list will be used to discuss the standardization and adoption of secure, interoperable and efficient post-quantum algorithms. You must be subscribed to send email to the mailing list. Please use the instructions below to subscribe. To join: mailto:[email protected] You will receive a response message from [email protected]. Please click the "Join" link inside that email to confirm your subscription request. To unsubscribe: mailto:[email protected] Mailing List...

Completed Specifications and Guidelines The SWID Tag format, defined by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) standard ISO/IEC 19770-2, is a structured metadata format for describing a software product. NIST recommends use of the latest version of this standard, ISO/IEC 19770-2:2015. A SWID Tag document is composed of a structured set of data elements that identify the software product, characterize the product's version, identify the organizations and individuals that had a role in the production and distribution of...

Our conference and journal papers on assured autonomy and explainable AI. We try to include links to the full papers, but for those not yet linked, please contact us for a copy: [email protected]. Papers 2025 Lanus, E., Lee, B., Chandrasekaran, J., Freeman, L. J., Raunak, M. S., Kacker, R. N., & Kuhn, D. R. (2025, March). Data frequency coverage impact on ai performance. In 2025 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) (pp. 258-267). IEEE. Wei, Q., Sikder, F., Feng, H., Lei, Y., Kacker, R., & Kuhn, R. (2025). SmartExecutor:...