Search CSRC

Abstract: The National Institute of Standards and Technology (NIST) began working on RBAC in the early 1990s after a study of federal agency security needs identified the need to develop a better method for managing large networked systems and complex access issues (Ferraiolo, Gilbert, and Lynch, 1992). Over...

Journal: Journal of Research of the National Institute of Standards and Technology Abstract: In 1997, the National Institute of Standards and Technology (NIST) initiated a process to select a symmetric-key encryption algorithm to be used to protect sensitive (unclassified) Federal information in furtherance of NIST’s statutory responsibilities. In 1998, NIST announced the acceptance of 15 c...

Abstract: Computer security assurance provides a basis for one to have confidence that security measures, both technical and operational, work as intended. Use of products with an appropriate degree of assurance contributes to security and assurance of the system as a whole and thus should be an important fac...

Conference: 9th Annual Computer Security Applications Conference Abstract: The Secure Data Network System (SDNS) program has developed a security architecture based on the International Standardization Organization (ISO) Reference Model for Open Systems Interconnection (OSI). The SDNS standards include a key management protocol (KMP) designed to provide key material to low...

Abstract: This National Institute of Standards and Technology Interagency Report (NISTIR) presents the National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook . The Handbook provides NASA's overall approach to automated information systems security including: program goa...

Abstract: This National Institute of Standards and Technology Interagency Report (NISTIR) presents a risk assessment methodology developed by the U.S. Department of Energy. This NISTIR contains Volume I: DOE Risk Assessment Guideline Instructions. Resource Table, and Completed Sample and Volume II: DOE Risk A...

Journal: Journal of Research of the National Institute of Standards and Technology Abstract: The National Computer Systems Laboratory (NCSL) of the National Institute of Standards and Technology (NIST) and the National Computer Security Center (NCSC) of the Department of Defense (DoD) co-sponsored the Twelfth National Computer Security Conference held in Baltimore, Maryland on October 10-13...

Abstract: Recommendations are provided to promote accuracy, integrity, and security in computerized vote-tallying, and to improve confidence in the results produced. The recommendations respond to identified problems, and concern software, hardware, operational procedures, and institutional changes. It is pro...

Abstract: Manufacturing supply chains are vital to national security and economic resilience. As these networks become increasingly complex, tracing products back to their origins becomes more difficult and exposes acquirers to greater risks from logistical disruptions, fraud, and counterfeit materials. To ad...

Abstract: Each year, the Federal Government spends more than $140 billion on research and development (R&D). Approximately $40 billion is used to support intramural research and Federally funded R&D centers, a relatively small portion of which goes to the National Institutes of Standards and Technolog...

Abstract: This document provides guidelines on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements. OT encompasses a broad range of programmable systems and devices that interact with the physical environment, such as industrial control sys...

Abstract: Securing sensitive data within databases is a paramount concern for modern applications. Traditional database access control mechanisms often fall short in providing the fine-grained control and centralized management required to mitigate evolving security threats. This paper examines the limitation...

Abstract: Due diligence research is the investigative process of researching all available, pertinent information about a given supplier or product so that informed decisions can be made on new acquisitions or existing systems. This Quick-Start Guide provides cybersecurity supply chain risk management (C-SCRM...

Abstract: The Security Content Automation Protocol (SCAP) is a multi-purpose framework of component specifications that support automated configuration, vulnerability, patch checking, security measurement, and technical control compliance activities. The SCAP version 1.4 specification is defined by the combin...

Abstract: This guideline focuses on the authentication of subjects who interact with government information systems over networks to establish that a given claimant is a subscriber who has been previously authenticated. The result of the authentication process may be used locally by the system performing the...

Abstract: The National Institute of Standards and Technology (NIST) hosted an in-person, all-day workshop on February 27, 2024, to discuss existing and emerging cybersecurity threats and mitigation techniques for semiconductors throughout their life cycle. The workshop obtained valuable feedback from industry...

Journal: IT Professional Abstract: Identifying the software weaknesses exploited by attacks supports efforts to reduce developer introduction of vulnerabilities and to guide security code review efforts. A weakness is a bug or fault type that can be exploited through an operation that results in a security-relevant error. Ideally, th...

Conference: 7th Deep Learning Security and Privacy Workshop Abstract: This paper investigates one type of social engineering scam, where unsuspecting users inadvertently consent to hidden financial obligations by performing routine online actions, such as making a purchase. Terms and conditions, often dense and overlooked, can be a vehicle for these scams, embedding d...

Abstract: NoSQL database systems and data stores often outperform traditional RDBMS in various aspects, such as data analysis efficiency, system performance, ease of deployment, flexibility/scalability of data management, and users’ availability. However, with an increasing number of people storing sensitive...

Abstract: A new batch of "complete and proper" digital signature schemes submissions has recently been published by NIST as part of its process for establishing post-quantum cryptographic standards. This note communicates an attack on the 3WISE digital signature scheme that the submitters did not wish to with...

Abstract: Recently a completely new post-quantum digital signature scheme was proposed using the so called "scrap automorphisms." The structure is inherently multivariate, but differs significantly from most of the multivariate literature in that it relies on sparsity and rings containing zero divisors. In th...

Abstract: High-performance computing (HPC) is a vital computational infrastructure for processing large data volumes, performing complex simulations, and conducting advanced machine learning model training. As such, HPC is a critical component of scientific discovery, innovation, and economic competitiveness....

Abstract: The approved sensitive security parameter generation and establishment methods listed in this publication replace the ones listed in International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 19790 Annex D and ISO/IEC 24759 paragraph 6.16, within the context o...

Abstract: Trapdoor claw-free functions (TCFs) are immensely valuable in cryptographic interactions between a classical client and a quantum server. Typically, a protocol has the quantum server prepare a superposition of two-bit strings of a claw and then measure it using Pauli-\(X\) or \(Z\) measurements. In...

Abstract: A graph is \(k\)-chordal if it does not have an induced cycle with length greater than \(k\). We call a graph chordal if it is \(3\)-chordal. Let \(G\) be a graph. The distance between the vertices \(x\) and \(y\), denoted by \(d_G(x,y)\), is the length o...