Search CSRC

Conference: The Third SHA-3 Candidate Conference Abstract: The sponge construction, designed by Bertoni, Daemen, Peeters, and Asscheis, is the framework for hash functions such as Keccak, PHOTON, Quark, and spongent. The designers give a keyed sponge construction by prepending the message with key and prove a bound on its pseudorandomness in the ideal permu...

Abstract: Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider...

Abstract: The objective of this document is to provide test requirements and test assertions that could be used to validate the compliance/conformance of two PIV components: PIV middleware and PIV card application with the specification in NIST SP 800-73-3, Interfaces for Personal Identity Verification.

Journal: IT Professional Abstract: We analyzed data from the National Vulnerability Database (NVD). Designed and operated by the National Institute of Standards and Technology (NIST) with support from the Department of Homeland Security, the NVD provides fine-grained search capabilities of all publicly reported software vulnerabiliti...

Journal: Crossroads Abstract: Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction. However, the security readiness of cloud computing is commonl...

Abstract: This document is based on the discussions and conclusions of the Privilege (Access) Management Workshop held on 1-3 September, 2009 at the Gaithersburg, Maryland facilities of the National Institute of Standards and Technology (NIST), sponsored by NIST and the National Security Agency (NSA). This do...

In: Towards Trustworthy Elections: New Directions in Electronic Voting Abstract: In this paper, we develop methods for constructing vote-buying/coercion attacks on end-to-end voting systems, and describe vote-buying/coercion attacks on three proposed end-to-end voting systems: Punchscan, Pret-a-voter, and ThreeBallot. We also demonstrate a different attack on Punchscan, which co...

Abstract: This report concerns the theoretical and practical issues with automatically populating mobile devices with reference test data for use as reference materials in validation of forensic tools. It describes an application and data set developed to populate identity modules and highlights subtleties in...

Abstract: More than 100 years ago, Lord Kelvin insightfully observed that measurement is vital to deep knowledge and understanding in physical science. During the last few decades, researchers have made various attempts to develop measures and systems of measurement for computer security with varying degrees...

Abstract: Bluetooth is an open standard for short-range radio frequency communication. Bluetooth technology is used primarily to establish wireless personal area networks. It has been integrated into many types of business and consumer devices, including cellular phones, personal digital assistants, laptops...

Conference: 2008 International Conference on Security and Management (SAM 2008) Abstract: Phone managers are non-forensic tools sometimes used by forensic investigators to recover data from a cell phone when no suitable forensic tool is available for the device. While precautions can be taken to preserve the integrity of data on a cell phone, inherent risks exist. Applying a forensic fil...

Abstract: This Standard describes a keyed-hash message authentication code (HMAC), a mechanism for message authentication using cryptographic hash functions. HMAC can be used with any iterative Approved cryptographic hash function, in combination with a shared secret key.

Journal: IEEE Security & Privacy Abstract: Since the discovery of collision attacks against several well-known cryptographic hash functions in 2004, a rush of new cryptanalytic results cast doubt on the current hash function standards. The relatively new NIST SHA-2 standards aren't yet immediately threatened, but their long-term viability is...

Abstract: This bulletin summarizes some of NIST’s activities to support biometric standards and measurements, and updates the ITL Bulletin issued in May 2001 detailing NIST’s biometric technology and standards activities: Biometrics – Technologies for Highly Secure Personal Authentication, by Fernando L. Podi...

Abstract: This bulletin summarizes some of NIST's efforts to help federal agencies implement Federal Information Processing Standard (FIPS) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors. The standard, which was approved by the Secretary of Commerce in February 2005, supports i...

Abstract: This ITL Bulletin helps to educate readers about the HIPAA Security Rule and to improve understanding of the meaning of the security standards set out in the Security Rule. This publication is also designed to direct readers to helpful information in other NIST publications on individual topics the...

Abstract: While intrusion detection systems are becoming ubiquitous defenses in today's networks, currently we have no comprehensive and scientifically rigorous methodology to test the effectiveness of these systems. This paper explores the types of performance measurements that are desired and that have been...

Abstract: The National Institute of Standards and Technology (NIST), Information Technology Laboratory, Computer Security Division, has developed this S/MIME (Secure / Multipurpose Internet Mail Extensions) client profile as guidance in the development and procurement of commercial-off-the-shelf (COTS) S/MIME...

Abstract: Today more than ever, timely response to vulnerabilities is critical to maintain the operational availability, confidentiality, and integrity of information technology (IT) systems. To assist federal agencies and industry respond to vulnerabilities in a timely manner, ITL recently released two new p...

Journal: IEEE Computer Abstract: Government studies have identified potential vulnerabilities in the public switched network that could be exploited by hostile users. As the telecommunications industry moves toward greater openness and more services are added, the potential for abuse is likely to increase. The US government's effor...

Abstract: The Workshop on NSFNET/NREN Security was hosted by NIST and sponsored by NSF to address the need for improving the security of national computer networks. Emphasis was on identifying off-the-shelf security technology that could be implemented in the NSF Network, especially to control access to the s...

Conference: 15th National Computer Security Conference Abstract: The number of personal computer viruses continues to grow at an alarming rate. Many of these viruses are variants (i.e., close relatives) of "old" viruses. This often results in less than accurate identification of viruses. The consequences of this can be distressing: virus removal software fails, s...

Abstract: This National Institute of Standards and Technology Interagency Report (NISTIR) presents the Federal Deposit Insurance Corporation's (FDIC) PBX Administrator's Security Standards . It was developed to provide a generic set of security standards to phone system administrators and users throughout FDI...

Conference: Ninth Annual Pacific Northwest Software Quality Conference Abstract: This paper provides information about the National Institute of Standards and Technology (NIST) effort to produce a comprehensive set of standards and guidelines for the assurance of high integrity software. In particular, the paper presents the results of a Workshop on the Assurance of High Integri...

Abstract: While excellent progress has been made in computer technology, very little has been done to inform users of the vulnerability of data and information to such threats as unauthorized modification, disclosure, and destruction, either deliberate or accidental. This guide will make users aware of some o...