Search CSRC

Algorithm Specifications Algorithm specifications for current FIPS-approved and NIST-recommended block cipher modes are available from the Cryptographic Toolkit. Current testing includes the following block cipher modes: CMAC (SP 800-38B) XTS-AES (SP 800-38E) CCM (SP 800-38C) KW / KWP / TKW (SP 800-38F)(Key Wrap using AES and Triple-DES) GCM / GMAC / XPN (SP 800-38D and CMVP Annex A) For testing...

The security of SI systems is closely intertwined with the security of the IT infrastructure on which they run and operate. Many organizations are already implementing SP 800-53 controls and have the institutional processes in place to plan control implementations for their organizations, missions, and systems and to assess the effectiveness of the controls for meeting organizational risk management requirements. Control overlays offer organizations or communities of interest ways to further customize the controls (or control baselines) for a specific technology or type of system, mission...

Call for Proposals Each submitted algorithm, together with each submitted reference implementation and optimized implementation, must be made freely available for public review and evaluation purposes worldwide during the period of the post-quantum algorithm search and evaluation. The following signed statements will be required for a submission to be considered complete: 1) statement by the submitter, 2) statement by patent (and patent application) owner(s) (if applicable), and 3) statement by reference/optimized implementations' owner(s). Note that for the last two statements, separate...

The CCE List provides unique identifiers to security-related system configuration issues in order to improve workflow by facilitating fast and accurate correlation of configuration data across multiple information sources and tools. For example, CCE Identifiers are included for the settings in NIST macOS (mSCP); are the main identifiers used for the settings in the U.S. Federal Desktop Core Configuration (FDCC) data file downloads; and provide a mapping between the elements in configuration best-practice documents including the Center for Internet Security’s (CIS) CIS Benchmark...

Note: The following is archived information related to NIST SP 800-179. CSD’s macOS security configuration team is working to develop secure system configuration baselines supporting different operational environments for Apple macOS version 10.12, “Sierra.” These configuration guidelines will assist organizations with hardening macOS technologies and provide a basis for unified controls and settings for federal macOS workstation and mobile system security configurations. The configurations are based on a collection of resources, including the existing NIST macOS configuration guidance, the...

Each title heading is clickable - clicking each title will expand/collapse the list of standards & supporting documents. PIV Standards: FIPS 201-3 - Personal Identity Verification (PIV) of Federal Employees and Contractors (January 2022) Federal Register Notice 2020 Draft comments and dispositions FIPS 201-2 has been withdrawn and is superseded by FIPS 201-3 PIV Card Specifications: SP 800-78-5 - Cryptographic Algorithms and Key Sizes for Personal Identity Verification (July 2024) SP 800-76-2 - Biometric Data Specification for Personal Identity...

Florida Institute for Cybersecurity Research, University of Florida Intrinsic ID, Inc. 710 Lakeway Drive, Suite 100, Sunnyvale, CA 94085 Crypto4A, 1550A Laperriere Avenue, Ottawa, Ontario, Canada 2 Keys Corporation, 20 Eglinton Ave. W., Suite 1500,, Toronto, Ontario, Canada Real Random, LLC. DISCLAIMER: Any mention of commercial products or organizations is for informational purposes only; it is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the products identified are necessarily...

The IUT list is provided as a marketing service for vendors who have a viable contract with an accredited laboratory for the testing of a cryptographic module, and the module and required documentation is resident at the laboratory. The CMVP does not have detailed information about the specific cryptographic module or when the test report will be submitted to the CMVP for validation. When the lab submits the test report to the CMVP, the module will transition from the IUT list to the MIP list. If you would like more information about a specific cryptographic module or its schedule, please...

These are tools and utilities to assess the level of security risks and provide a mechanism to enhance automation for the cybersecurity information exchange. Baldrige Cybersecurity Excellence Builder (BCEB) A self-assessment tool to help organizations better understand the effectiveness of their cybersecurity risk management efforts and identity improvement opportunities in the context of their overall organizational performance. Common Vulnerability Scoring System (CVSS) An open framework for communicating the characteristics and severity of software vulnerabilities. CVSS is well...

Privacy Enhanced Distributed Ledger Technology and Hyperledger Implementation, IEEE Morocco Blockchain Summit, 2024 Privacy Enhanced Distributed Ledger Technology with Hyperledger Fabric, IEEE International Conference on Artificial Intelligence, Blockchain, and Internet of Things, Sept 17, 2023 Redactable Distributed Ledger Technology with Hyperledger Fabric, IEEE Privacy Symposium, Venice, Italy, 2023. Redactable Distributed Ledger Technology for Hyperledger Fabric, International Blockchain Summit, Istanbul, 2022 Rethinking Distributed Ledger Technology and Using it for Access...

At A Glance Purpose: Provide accountability by requiring a senior official to determine if the security and privacy risk based on the operation of a system or the use of common controls, is acceptable. Outcomes: authorization package (executive summary, system security and privacy plan, assessment report(s), plan of action and milestones) risk determination rendered risk responses provided authorization for the system or common controls is approved or denied Resources for Implementers RMF Introductory Online Course RMF Quick Start Guide (QSG): Authorize Step...

Test Runner Software (updated February 13, 2020) SP 800-73-4 Test Runner for PIV Card Applications, Middleware and Data Model Please send an e-mail to [email protected] to request for a password to unzip the Test Runner file and/or for any questions you may have. DISCLAIMER: This software is released by NIST as a service and is expressly provided "AS IS." NIST MAKES NO WARRANTY OF ANY KIND, EXPRESS, IMPLIED OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT AND DATA ACCURACY. NIST DOES NOT REPRESENT OR...

Testing is roughly 50% of the cost of producing consumer software, and can be 90% or more of the cost for a critical application such as aviation. Combinatorial methods can provide huge reductions in this cost.

Autonomous systems must function correctly in an enormous range of environments. For example, self-driving cars must deal with lighting, rain, fog, pedestrians, animals, other vehicles, road markings, signs, etc. How do we ensure that autonomous systems are safe in such complex and rapidly changing environments, when conventional test coverage and formal verification methods cannot be applied? Achieving assured autonomy in any environment requires methods for measuring the input space, to show that the test environment adequately covers real-world conditions that may be encountered....

A [email protected] email list has been established for dialogue regarding NIST's Cipher Modes project. Use the following link to subscribe/unsubscribe: https://groups.google.com/a/list.nist.gov/g/ciphermodes-forum

Combinatorial methods have the potential for enormous savings in chip verification and testing. Additionally, quantitative measures of test completeness can be provided, going beyond current capabilities of conventional chip verification test methods.

The following publications provide general key management guidance: Recommendation for Key Management December 5, 2025: An initial public draft of SP 800-57 Part 1 Revision 6 is available for comment through February 5, 2026. SP 800-57 Part 1 Revision 5 - General This Recommendation provides cryptographic key-management guidance. It consists of three parts. Part 1 provides general guidance and best practices for the management of cryptographic keying material, including definitions of the security services that may be provided when using cryptography and the algorithms and key...

At A Glance Purpose: Maintain ongoing situational awareness about the security and privacy posture of the system and organization to support risk management decisions Outcomes: system and environment of operation monitored in accordance with continuous monitoring strategy ongoing assessments of control effectiveness conducted in accordance with continuous monitoring strategy output of continuous monitoring activities analyzed and responded to process in place to report security and privacy posture to management ongoing authorizations conducted using results of continuous...

FIPS 140-2 (ending Sept-22-2021) Security Requirements for Cryptographic Modules NVLAP accredited Cryptographic and Security Testing (CST) Laboratories perform conformance testing of cryptographic modules. Cryptographic modules are tested against requirements found in FIPS 140-2, Security Requirements for Cryptographic Modules [ PDF ]. Security requirements cover 11 areas related to the design and implementation of a cryptographic module. For each area, a cryptographic module receives a security level rating (1-4, from lowest to highest) depending on what requirements are met. An overall...

The NIST NCCoE has launched a new project, Software Supply Chain and DevOps Security Practices. In early 2023, the project team will be publishing a Federal Register Notice based on the final project description to solicit collaborators to work with the NCCoE on the project. NIST held a virtual workshop in January 2021 on improving the security of DevOps practices; you can access the workshop recording and materials here. A second virtual workshop was held in September 2022 on the planned NCCoE DevSecOps project; the workshop recording and presentations are posted. NIST will leverage existing...

This information is provided for historical purposes. Papers Statistical Testing of Random Number Generators; Proceedings of the 22nd National Information Systems Security Conference, October 1999. Presentations Empirical Statistical Testing of RNGs, 1999 RSA Data Security Conference, San Jose, CA, 1/99. Statistical Testing of RNGs, ANSI X9F1 Meeting, Institute for Defense Analyses, Alexandria, VA, 4/99. Statistical Testing of Random Number Generators, The 22nd National Information Systems Security Conference, Crystal City, VA, 10/99.

The Least Version Principle The least version principle is designed to address which specification version to use when maintaining SCAP content. Under this principle, content is expressed using the minimum specification version, in a series of minor releases, that is necessary to properly address the content's purpose or use-case. This allows for the broadest support within products, while reducing the content maintenance burden that would be required to maintain revisions of content for multiple specification versions.

All questions regarding the implementation and/or use of any validated cryptographic module should first be directed to the appropriate VENDOR point of contact (listed for each entry). General CMVP questions should be directed to [email protected]. Use this form to search for information on validated cryptographic modules. Select the basic search type to search modules on the active validation list. Select the advanced search type to to search modules on the historical and revoked module lists.

At A Glance Purpose: Determine if the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security and privacy requirements for the system and the organization. Outcomes: assessor/assessment team selected security and privacy assessment plans developed assessment plans are reviewed and approved control assessments conducted in accordance with assessment plans security and privacy assessment reports developed remediation actions to address deficiencies in controls are taken security and privacy plans are...

CPRT Roadmap Explore the CPRT Project Roadmap, a strategic guide delineating our three crucial phases. Mappings to NIST Documents Explore the process for developing and submitting standardized mappings that involve NIST cybersecurity and privacy publications. Cross-Reference Comparison Report Tool Browse and compare the mappings and crosswalks of industry standards and frameworks to existing NIST Publications. JSON and CSV downloadable content is available for additional customization of the generated reports.