Search CSRC

Journal: Journal of Cryptology Abstract: In this work, we present several new generic second-preimage attacks on hash functions. Our first attack is based on the herding attack and applies to various Merkle–Damgard-based iterative hash functions. Compared to the previously known long-message second-preimage attacks, our attack offers more...

Conference: 10th International Conference on Security and Privacy in Communication Networks (SecureComm 2014) Abstract: Enterprise networks are migrating to the public cloud to acquire computing resources for promising benefits in terms of efficiency, expense, and flexibility. Except for some public services, the enterprise network islands in cloud are expected to be absolutely isolated from each other. However, some...

Abstract: Attribute-Based Access Control (ABAC) is a logical access control methodology where authorization to perform a set of operations is determined by evaluating attributes associated with the subject, object, requested operations, and, in some cases, environment conditions against policy, rules, or rela...

Conference: First International Workshop on Combinatorial Testing (CT 2012) Abstract: Combinatorial Testing (CT) is a systematic way of sampling input parameters of the software under test (SUT). A t-way combinatorial test set can exercise all behaviors of the SUT caused by interactions between t input parameters or less. Although combinatorial testing can provide fault detection cap...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-119, Guidelines for the Secure Deployment of IPv6. Written by Sheila Frankel of NIST, Richard Graveman of RFG Security, John Pearce of Booz Allen Hamilton and Mark Rooks of L-1 Identity Solutions (formerly of Boo...

In: Encyclopedia of Cryptography and Security Abstract: Biometric technologies establish or verify the personal identity of previously enrolled individuals based on biological or behavioural characteristics. Over the past several years the marketplace for biometric-based applications has widened significantly since they are now increasingly being used in...

In: Handbook of Information and Communication Security Abstract: Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents, which are violations or imminent threats of violation of computer security policies, acceptable use policies, or standard security practices. An i...

Conference: 9th International Symposium on Experimental Algorithms (SEA 2010) Abstract: A new technique for combinational logic optimization is described. The technique is a two-step process. In the first step, the non-linearity of a circuit – as measured by the number of non-linear gates it contains – is reduced. The second step reduces the number of gates in the linear components of...

Conference: 9th Symposium on Identity and Trust on the Internet (IDtrust '10) Abstract: This paper describes and contrasts two families of schemes that enable a user to purchase digital content without revealing to anyone what item he has purchased. One of the basic schemes is based on anonymous cash, and the other on blind decryption. In addition to the basic schemes, we present and c...

Abstract: Firewalls are essential devices or programs that help organizations protect their networks and systems, and help home users protect their computers, from hostile attacks, break-ins, viruses, and malicious software. Firewalls control the flow of network traffic between networks and between hosts that...

Conference: 5th International Workshop on Security Measurements and Metrics, 2009 (MetriSec 2009) Abstract: The Common Vulnerability Scoring System (CVSS) is a specification for measuring the relative severity of software vulnerabilities. Finalized in 2007, CVSS version 2 was designed to address deficiencies found during analysis and use of the original CVSS version. This paper analyzes how effectively CV...

Abstract: The National Institute of Standards and Technology is in the process of selecting a new cryptographic hash algorithm through a public competition. The new hash algorithm will be referred to as “SHA-3” and will complement the SHA-2 hash algorithms currently specified in FIPS 180-3, Secure Hash Standa...

In: Safety and Security in Multiagent Systems: Research Results from 2004-2006 Abstract: Mobile commerce and location-aware services promise to combine the conveniences of both online and offline bricks-and-mortar services. Just as agent-enabled desktop computers can be used to improve a user s e-commerce experience, so can agent-enabled mobile devices be used to improve a user s mobile...

Conference: 14th Australasian Conference on Information Security and Privacy (ACISP 2009) Abstract: This paper characterizes collision preserving padding rules and provides variants of Merkle-Damgard (MD) which are having less or no overhead costs due to length. We first show that suffix-free property of padding rule is necessary as well as sufficient to preserve the collision security of MD hash...

Abstract: Many organizations employees and contractors use enterprise telework technologies to perform work from external locations. Most teleworkers use remote access technologies to interface with an organization's non-public computing resources. The nature of telework and remote access technologies permitt...

In: Wiley Handbook of Science and Technology for Homeland Security Abstract: The goal of cyber security standards is to improve the security of information technology (IT) systems, networks, and critical infrastructures. A cyber security standard defines both functional and assurance requirements within a product, system, process, or technology environment. Well-developed cy...

Journal: Journal of Computer Security Abstract: An attack graph models the causal relationships between vulnerabilities. Attack graphs have important applications in protecting critical resources in networks against sophisticated multi-step intrusions. Currently, analyses of attack graphs largely depend on proprietary implementations of specializ...

Abstract: FIPS 201, "Personal Identity Verification (PIV) of Federal Employees and Contractors," and its associated special publications define a method to perform biometric match-off-card authentication of a PIV cardholder when the PIV card is inserted into a contact smart card reader. Today, many smart card...

Abstract: The Common Vulnerability Scoring System (CVSS) provides an open framework for communicating the characteristics and impacts of IT vulnerabilities. The National Vulnerability Database (NVD) provides specific CVSS scores for virtually all publicly known vulnerabilities. Federal agencies can use the Fe...

Abstract: This report covers the work conducted within the National Institute of Standards and Technology's Computer Security Division during the Fiscal Year 2006. It discusses all projects and programs within the Division, staff highlights, and publications. For many years, the Computer Security Division (CS...

Abstract: NIST SP 800-92 helps organizations develop, implement and maintain effective processes for managing logs, which contain information about specific events occurring within information technology (IT) systems and networks. The information is recorded in logs by the systems¿ software and applications,...

Abstract: The use of mobile handheld devices within the workplace is expanding rapidly. These devices are no longer viewed as coveted gadgets for early technology adopters, but have instead become indispensable tools that offer competitive business advantages for the mobile workforce. While these devices prov...

Abstract: This report covers the work conducted within the National Institute of Standards and Technology's Computer Security Division during the Fiscal Year 2005. It discusses all projects and programs within the Division, staff highlights, and publications. For many years, the Computer Security Division (CS...

Abstract: This report covers the work conducted within the National Institute of Standards and Technology's Computer Security Division during Fiscal Year 2004. It discusses all projects and programs within the Division, staff highlights, and publications. For many years, the Computer Security Division (CSD) h...

Abstract: This report covers the work conducted within the National Institute of Standards and Technology's Computer Security Division during the Fiscal Year 2003. It discusses all projects and programs within the Division, staff highlights, and publications. For many years, the Computer Security Division (CS...