Search CSRC

lwc-forum A [email protected] email mailing list has been established for dialogue regarding NIST's Lightweight Cryptography project. It is an unmoderated mailing list; messages addressed to this list are immediately distributed to all the addresses on the list. Only members are allowed to post messages to the list; however, anyone who wishes to do so may add themselves to the list. To join: mailto:[email protected] You will receive a response message from [email protected]. Please click the "Join" link inside that email to confirm your...

Validation Number: 130 Vendor: BMC Software Product Name: BMC Client Management Product Major Version: 12.0.0 Product Version Tested: 12.0.0 Build 140901c Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit Microsoft Windows Vista, SP2, 32 bit Microsoft Windows XP Pro, SP3, 32 bit Red Hat Enterprise Linux 5, 64 bit Red Hat Enterprise Linux 5, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE)...

FIPS 140-3 Management Manual - Latest Version (04-09-2026) The purpose of the CMVP Management Manual is to provide effective management guidance for the CMVP, CST labs, and the vendors who participate in the program. Consumers who procure validated cryptographic modules may also be interested in the contents of this manual. This manual outlines the management activities, processes, and responsibilities that have been assigned to the various participating groups. This manual includes administrative guidance. For technical aspects of the requirements of the referenced...

The [email protected] mailing list is used for announcements and questions about the "Masked Circuits" project (formerly known as the single-device track of the threshold cryptography project). To subscribe: send an mail to [email protected]. Upon receiving an automatic response message, click the "Join" link inside that email to confirm your subscription request. If having difficulty, send a request instead to "masked-circuits (at) nist (dot) gov". We will then manually add your email address. To unsubscribe: send an email to: [email protected]. The...

What have we been up to? Here are some of the latest updates… We are currently in Phase 1 of updating the CPRT roadmap tool. Stay tuned as NIST adds reference data from other publications to this tool and develops features to interact with the data in new ways in the future. Recent CPRT Additions: 02/19/2026 | NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations 02/19/2026 | AI RMF 1.0, Artificial Intelligence Risk Management Framework 02/19/2026 | NIST SP 800-60 Vol. 2 Rev. 1, Guide for Mapping Types of Information and Information...

This page organizes documentation related to the NIST First Call for Multi-Party Threshold Schemes [NIST IR 8214C] (2026). Previews Phase #3: On Sep-30 and Oct-{6,7,13}, 2026, TCPT3 (Threshold Call Preview Talks #3) hosts 24 preview talks. The technical scope is organized across two classes — Class N (NIST-specified primitives) and Class S (Special primitives not specified by NIST) — each with various categories of crypto-systems, as follows: Sign PKE Symm KeyGen FHE ZKPoK Gadgets Class N N1 N2 N3 N4 Class S...

Secure Multiparty Computation (MPC) (Secure) Multiparty Computation (MPC) allows multiple parties to jointly (distributively) perform a computation, using everyone's inputs, but without actually sharing the private inputs with one another. Depending on the desired functionality, each party may also obtain a private output. MPC is one of the main techniques of interest to the PEC project. Reference material about MPC has been collected across a number of events, organized by PEC and MPTC. PEC-STPPA #2 (2021): including talks about PSI and MPC, and conversation. PEC-STPPA #6 (2023):...

The NIST OSCAL team hosts a series of mini workshops for the OSCAL community to learn, share, and connect. Each session explores topics of interest, highlights real-world OSCAL implementations, and gives community members an opportunity to present their work and exchange ideas. Most of the workshops are designed to be accessible to a broad audience and do not require deep technical knowledge of OSCAL. Discussions are interactive, with plenty of opportunities to ask questions and engage with presenters and the OSCAL team. If you are interested in presenting your OSCAL-related work or proposing...

A cryptographic hash algorithm (alternatively, hash "function") is designed to provide a random mapping from a string of binary data to a fixed-size “message digest” and achieve certain security properties. Hash algorithms can be used for digital signatures, message authentication codes, key derivation functions, pseudo random functions, and many other security applications. The Federal Information Processing Standard (FIPS 180-4), Secure Hash Standard, specifies seven cryptographic hash algorithms for Federal use, and is widely adopted by the information technology industry as well. In...

DON'T assume that 2-way combinations (pairwise testing) will be enough. Empirical data, documented in papers on this site, show that 2-way combinations are important, but a large proportion of faults involve more than two parameters. but DO consider the appropriate level of t-way combinations to be used. It is reasonable to expect that 30% or more of the faults that need to be found in testing may require three factors for detection. DON’T try to develop the input model (the parameters and test values) only from use cases. Considering only use cases is likely to lead to missing some...

Examples of combinatorial coverage achieved by real-world test suites in various application domains. The test suites studied in these examples were designed using conventional methods, i.e., they were not developed using ACTS or another covering array tool. Application Config t = 2 t = 3 t = 4 t = 5 t = 6 Reference Spacecraft control 132754262 0.940 0.831 0.668 0.536 Maximoff, J. R., Kuhn, D. R., Trela, M. D., &...

NOTICES The public key certificate used to verify beacon records expired on 7 May, 2017. The beacon signing key has also changed. Users can download the public key. Version 2.0 is described at NIST Randomness Beacon (Version 2.0 Beta) NIST Randomness Beacon (Prototype Implementation; Version 1.0) -- Replaced by Version 2.0 WARNING: DO NOT USE BEACON GENERATED VALUES AS SECRET CRYPTOGRAPHIC KEYS. This prototype implementation generates full-entropy bit-strings and posts them in blocks of 512 bits every 60 seconds. Each such value is sequence-numbered, time-stamped and signed, and...

Comments Received on SP 800-172r3 (FPD) Below are comments received on the final public draft of SP 800-172r3, Enhanced Security Requirements for Protecting Controlled Unclassified Informa tion The public comment period closed on January 16, 2026. All comments submitted during the public comment period for Draft NIST SP 800-172r3 will be posted below without change or redaction, so commenters should not include information they do not wish to be posted (e.g., personal or business information). Date Received From 29 September 2025 Aboubacar Camara...

The NIST maintains a validation list of all validated PIV Card Application (past and present). The list is maintained in descending order of certificate numbers and is updated as new PIV Card Applications receive validation certificates from the NPIVP. All questions regarding the implementation and/or use of any PIV Card Application located on the validation list should first be directed to the vendor. Cert # Product Name Vendor Issue Date/Update Date FIPS 140-2/3 validation certificate # and date Product Details...

Comments Received on Draft SP 800-171B Below are comments received on Draft Special Publication 800-171B, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations – Enhanced Security Requirements for Critical Programs and High Value Assets. The public comment period closed on August 2, 2019. Please note that comments on the Public Cost Analysis are submitted and posted to www.regulations.gov/docket?D=DOD-2019-OS-0072 (Regulations.gov docket no. DOD-2019-OS-0072). All comments submitted during the public comment period for Draft NIST SP 800-171B will be posted...

The following specifications comprise SCAP version 1.1. Protocol SCAP: Security Content Automation Protocol Version: 1.1 Status: Final Specification: NIST SP 800-126 Rev. 1 Tools SCAP Content Validation Tool Earlier versions of this tool are end of life and are no longer available. The current version validates content conforming to SCAP versions 1.2, 1.3, and 1.4. It does not validate SCAP 1.0 or 1.1. Download it from the SCAP 1.4 page. Languages XCCDF: The eXtensible Configuration Checklist Description Format Version: 1.1.4 Specification: NIST IR 7275 revision 3 Web site: xccdf...

The NIST PQC team will host talks -- open to the public -- relating to the 3rd Round of the NIST PQC standardization process. Date Speaker Title Media March 26, 2021 11:00am - 12:00pm* Prasanna Ravi Temasek Labs, Nanyang Technological University Sujoy Sinha Roy Graz University of Technology Side-Channel Analysis of Lattice-based PQC Candidates Presentation Video February 23, 2021 11:00am - 12:00pm David Jao University of Waterloo Implementation of isogeny-based cryptography Presentation Video...

Protecting Controlled Unclassified Information (CUI) in nonfederal systems and organizations is critical to federal agencies. The suite of guidance (NIST Special Publication (SP) 800-171, SP 800-171A, SP 800-172, and SP 800-172A) focuses on protecting the confidentiality of CUI and recommends specific security requirements to achieve that objective. Comments Received SP 800-171 Revision 3 (Final Public Draft) and SP 800-171A Revision 3 (Initial Public Draft) February 21, 2024: NIST issues summary and analysis of comments received in response to SP 800-171 Revision 3 (final public...

The following is an excerpt from NIST Internal Report (NISTIR) 8060: Guidelines for the Creation of Interoperable Software Identification (SWID) Tags. The SWID specification defines four types of SWID tags: primary, patch, corpus, and supplemental. Primary Tag: A SWID Tag that identifies and describes a software product is installed on a computing device. Patch Tag: A SWID Tag that identifies and describes an installed patch which has made incremental changes to a software product installed on a computing device. Corpus Tag: A SWID Tag that identifies and describes an installable...

The following table lists the ten Finalists of the lightweight crypto standardization process. Official comments on the Finalists should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the lwc-forum Google group subscribers will also be forwarded to the lwc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask...

Download the SP 800-53 Controls in Different Data Formats Note that NIST Special Publication (SP) 800-53, 800-53A, and SP 800-53B contain additional background, scoping, and implementation guidance in addition to the controls, assessment procedures, and baselines. This NIST SP 800-53 database represents the derivative format of controls defined in NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations. If there are any discrepancies noted in the content between these NIST SP 800-53 and 53A derivative data formats and the latest published NIST SP...

The following specifications comprise SCAP version 1.3. Protocol SCAP: Security Content Automation Protocol Version: 1.3 Status: Final Specification: NIST Special Publication (SP) 800-126 rev 3 Specification Annex: NIST Special Publication (SP) 800-126 rev 3 Annex XML Schema: Source Data Stream, Constructs Example: Source Data Stream Example Schematron: Instructions and Download Tools SCAP Content Validation Tool Earlier versions of this tool are end of life and are no longer available. The current version validates content conforming to SCAP versions 1.2, 1.3, and 1.4. It does not...

The following specifications comprise SCAP version 1.2. Protocol SCAP: Security Content Automation Protocol Version: 1.2 Status: Final Specification: NIST Special Publication (SP) 800-126 rev 2 XML Schema: Source Data Stream, Constructs Example: Source Data Stream Example Schematron: Instructions and Download Errata: NIST Special Publication (SP) 800-126 Rev 2 Errata Change Proposals: Summer 2011 Developer Days (May 31, 2011) Tools SCAP Content Validation Tool Earlier versions of this tool are end of life and are no longer available. The current version validates content...

Upcoming ISPAB Meetings: No meetings are scheduled at this time. Updates will be provided as they become available. Stay in the Know! Sign up for new meeting notifications or reach out to the ISPAB team directly via email. ARCHIVE: Meetings Held in 2026 January 21-22, 2026 (Hybrid) Federal Register Notice Announcing Meeting Agenda Meeting Minutes Additional Details on the January 2026 Event Page Meetings Held in 2025 July 16-17, 2025 (Virtual) Federal Register Notice Announcing Meeting Agenda Meeting Minutes Link to July 2025 Event...

Note 2026-11-04: This is an experimental page, subject to changes. Table of Categories Sign PKE Symm KeyGen FHE ZKPoK Gadgets Class N N1 N2 N3 N4 Class S S1 S2 S3 S4 S5 S6 S7 Grid of Previews 60 previews: 26 from phase 1; 10 from phase 2; 24 from phase 3. Grid of Systems "Previewed" for Submission to the Threshold Call Updated on 2026-11-04 (preview phases 1, 2, 3) Adamas...