Search CSRC

NIST Special Publication 800-160, Volume 3 Systems Security Engineering Considerations for Software Assurance NIST Special Publication 800-160, Volume 4 Systems Security Engineering Considerations for Hardware Assurance

The following NIST-authored publications are directly related to this project. NIST SP 800-232 (initial public draft), Ascon-Based Lightweight Cryptography Standards for Constrained Devices: Authenticated Encryption, Hash, and Extendable Output Functions Call for Algorithms: Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process (August 27, 2018) Retired White Paper, Profiles for the Lightweight Cryptography Standardization Process (retired August 27, 2018) Federal Register Notice, Announcing Request for Nominations for Lightweight...

The following publications specify methods for establishing cryptographic keys. Symmetric Block Ciphers SP 800-71, Key Establishment Using Symmetric Block Ciphers (DRAFT) July 2, 2018: NIST requests public comments on NIST SP 800-71. Most current key management systems are based on public key cryptography. However, with the emergence of quantum computing technology—which can break many public key algorithms currently in use—symmetric key cryptography may offer alternatives for key establishment. Symmetric key cryptography is more computationally efficient than public key...

At A Glance Purpose: Carry out essential activities to help prepare all levels of the organization to manage its security and privacy risks using the RMF Outcomes: key risk management roles identified organizational risk management strategy established, risk tolerance determined organization-wide risk assessment organization-wide strategy for continuous monitoring developed and implemented common controls identified Resources for Implementers RMF Online Introductory Course RMF Quick Start Guide (QSG): Prepare Step FAQs Privacy Risk Assessment Methodology (PRAM)...

The SSDF uses these established secure development practice documents as references. Note that these references were current at the time SSDF version 1.1 was published, and may no longer be current. NIST Publications General Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1 National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (SP 800-181) Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5) Software Development Cybersecurity Supply Chain Risk Management Practices for Systems and...

Algorithm Specifications Algorithm specifications for Key Agreement Schemes and Key Confirmation (SP800-56A) are available from the Cryptographic Toolkit. Algorithm Validation Testing Requirements The algorithm validation testing requirements for SP 800-56A are specified in: The KAS Validation System (KASVS) Testing Notes Prerequisites for KAS testing are listed in the CAVP Frequently Asked Questions (CAVP FAQ) General Question GEN.5. Test Vectors Use of these test vectors does not replace validation obtained through the CAVP. The test vectors linked below can be used...

Algorithm Specifications Algorithm specifications for Key Agreement Schemes and Key Confirmation (SP800-56A) are available from the Cryptographic Toolkit. Algorithm Validation Testing Requirements The algorithm validation testing requirements for SP 800-56A are specified in: The KAS Validation System (KASVS) Testing Notes Prerequisites for KAS testing are listed in the CAVP Frequently Asked Questions (CAVP FAQ) General Question GEN.5. Test Vectors Use of these test vectors does not replace validation obtained through the CAVP. The test vectors linked below can be used...

Although most combinatorial testing problems have varying numbers of values per variable, in some cases all variables have the same number of values and a pre-computed array can be found. NIST library of pre-computed covering arrays Arrays are available for t=2 to t=5, with 2 to 6 values per variable, and for t=6 with 2 to 5 values per variable. Large collection of covering arrays available for download (Jose Torres-Jimenez) Data on the smallest uniform covering array sizes for up to 20,000 variables for t=2, and up to 10,000 for t=3 through t=6. (Note that this database...

Software Download (last updated February 13, 2020): SP 800-73-4 Test Runner for PIV Card Applications, Middleware and Data Model Note: File is a zipped (.zip) file & is 12.4 MB in size. Depending on Internet speed, this software download may take little time to download to several minutes. Please send an e-mail to [email protected] to request for a password to unzip the Test Runner file and/or for any questions you may have.

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated. The Program Review for Information Security Assistance (PRISMA) project was last updated in 2007; NIST Interagency Report (IR) 7358 and the corresponding PRISMA tool continue to serve as useful resources for high-level guidance and as a general framework, but may not be fully consistent with changes to requirements, standards and guidelines for securing systems. Download

Papers Covering Array Library Seminars & Talks & Tutorial Combinatorial Methods For Modeling & Simulation Workshop Papers DOs and DON'Ts of testing

Tutorial (English or Espanol) on combinatorial methods for software testing (pdf) ACTS User Guide - how to use the ACTS test generation tool (pdf) ACTS API manual - how to invoke ACTS functions from other code (zip) Combinatorial Coverage Measurement - explains various coverage measurements and how to use the tool for computing these. There is also a manual for the command line version of the CCM tool. Fault ID user manual - for tool that helps identify likely fault-triggering combinations in failing tests PEV tool user manual - testing rule-based expert systems or business rule...

Workshops Date September 24-26, 2025 Sixth PQC Standardization Conference (In-Person / Virtual) Venue: NIST Gaithersburg, Maryland, USA Call for Papers April 10-12, 2024 Fifth PQC Standardization Conference (In-Person) Hilton Washington DC/Rockville Hotel Rockville, MD Call for Papers November 29- December 1, 2022 Fourth PQC Standardization Conference Virtual Call for Papers June 7-9, 2021 Third...

Algorithm Specifications Algorithm specifications for current FIPS-approved and NIST-recommended digital signature algorithms are available from the Cryptographic Toolkit. Current testing includes the following algorithms: DSA | ECDSA | RSA (in FIPS 186-4) DSA | ECDSA | RSA (in FIPS 186-2) Algorithm Validation Testing Requirements FIPS 186-4 Digital Signature Algorithm (DSA) Digital Signature Algorithm Validation System (DSA2VS) specifies validation testing requirements for the DSA algorithm in FIPS 186-4. Testing Notes Prerequisites for DSA...

The Assessment Cases available for download correspond with NIST Special Publication 800-53, Revision 3. The assessment cases were developed by an interagency working group that has disbanded. Assessment cases for consistency with SP 800-53A Rev 4 or newer will not be developed but the existing assessment cases may continue to be applied and also may be used as a model to extrapolate assessment cases for controls added or changed in NIST SP 800-53 Revision 4 or newer. Cautionary Note: The assessment cases developed for this project are not the only acceptable assessment cases; rather, the...

NIST's Policy on Hash Functions - December 15, 2022 December 15, 2022 NIST is announcing a timeline for a transition for SHA-1. See this announcement for details. After 12/31/2030, any FIPS 140 validated cryptographic module that has SHA-1 as an approved algorithm will be moved to the historical list. NIST recommends that federal agencies transition away from SHA-1 for all applications as soon as possible. Federal agencies should use SHA-2 or SHA-3 as an alternative to SHA-1. Further guidance will be available soon. Send questions on the transition to [email protected]....

Below are the resources provided by the CMVP for use by testing laboratories and vendors. [10-22-2019] IG G.19.2 Hardware Equivalency Table This table is used as an additional resource to IG G.19 Operational Equivalency Testing for HW Modules.

The following are selected examples of additional resources supporting incident response preparation. General Incident Response Programs, Policies, and Plans Carnegie Mellon University, Incident Management (includes plan, policy, and reporting templates, and incident declaration criteria) Computer Crime & Intellectual Property Section (CCIPS), U.S. Department of Justice, Best Practices for Victim Response and Reporting of Cyber Incidents Cybersecurity & Infrastructure Security Agency (CISA), Incident Response Plan (IRP) Basics NIST, Guide for Cybersecurity Event Recovery (SP...

The purpose of the United States Government Configuration Baseline (USGCB) initiative is to create security configuration baselines for Information Technology products widely deployed across the federal agencies. Formal definitions of these baseline settings, as well as detailed documentation relating to the settings are provided in the following sub-pages. These pages also provide the supporting reference material for implementing and verifying USGCB settings on target systems. The following list represents the currently available USGCB content, grouped by the product vendor for which the...

The MIP list contains cryptographic modules on which the CMVP is actively working on. For a module to transition from Pending Review to Review, the lab must first pay the NIST Cost Recovery fee, and then the report will be assigned as resources become available. The validation process is a joint effort between the CMVP, the laboratory and the vendor and therefore, for any given module, the action to respond could reside with the CMVP, the lab or the vendor. This list provides some granularity into which entity has the action. The various circumstances that can trigger "Hold" are stated in the...

Security Requirements for Protecting CUI Purpose Recommended security requirements for protecting the confidentiality of CUI: (1) when the CUI is resident in a nonfederal system and organization; (2) when the nonfederal organization is not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency; and (3) where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or governmentwide policy for the CUI category listed in the CUI...

Algorithm Specifications Algorithm specifications for current FIPS-approved and NIST-recommended secure hashing algorithms are available from the Cryptographic Toolkit. Current testing includes the following algorithms: SHA-1 and SHA-2 Hash functions: SHA-1 SHA-224 SHA-256 SHA-384 SHA-512 SHA-512/224 SHA-512/256 (in FIPS 180-4) SHA-3 Hash functions: SHA3-224 SHA3-256 SHA3-384 SHA3-512 and XOFs: SHAKE128 SHAKE256 (in FIPS 202) Algorithm Validation Testing Requirements FIPS 202, "SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions" Secure Hash Algorithm-3...

A block cipher mode of operation (mode for short) is a method that uses a block cipher to provide an information service, such as confidentiality or authentication. NIST approves the following block cipher modes of the approved block ciphers in the Special Publication (SP) 800-38 series. SP 800-38A specifies the confidentiality modes: Electronic Codebook (ECB), Cipher Block Chaining (CBC), Cipher Feedback (CFB), Output Feedback (OFB), and Counter (CTR) modes. Additionally, SP 800-38A Addendum specifies three variants of ciphertext stealing (CS) for the CBC mode: the CBC-CS1, CBC-CS2, and...

At A Glance Purpose: Select, tailor, and document the controls necessary to protect the system and organization commensurate with risk Outcomes: control baselines selected and tailored controls designated as system-specific, hybrid, or common controls allocated to specific system components system-level continuous monitoring strategy developed security and privacy plans that reflect the control selection, designation, and allocation are reviewed and approved Resources for Implementers SP 800-53 and SP 800-53B Introductory Online Courses RMF Quick Start Guide...

Algorithm Specifications Algorithm specifications for current FIPS-approved and NIST-recommended block cipher algorithms are available from the Cryptographic Toolkit. Current testing includes the following algorithms: AES TDES Skipjack Algorithm Validation Testing Requirements Block Ciphers Advanced Encryption Standard Algorithm (AES) The Advanced Encryption Standard Algorithm Validation System(AESAVS) specifies validation testing requirements for the ECB(Electronic Codebook), CBC (Cipher Block Chaining), OFB (Output Feedback), CFB (Cipher Feedback) and CTR (Counter) modes for...