Search CSRC

ESV Guidelines and Templates Entropy Assessment Report Template v1.2 is a document to aid in writing entropy assessment reports for all entropy sources. The template is not required, but is recommended to ensure that all requirements from SP 800-90B and associated IGs are covered in the report. The template is available for edits, so labs may customize the colors, branding, or content if desired. Entropy Validation Submission Guidelines outlines the steps required to submit an entropy source to the CMVP through the Entropy Source Validation Test Server. Credentials must be requested...

How Can We Help? The most common reasons users contact the NIST Cybersecurity Supply Chain Risk Management (C-SCRM) team are to: Request more information about C-SCRM technical documents (e.g., clarifying a concept from a Special Publication (SP) such as Cybersecurity Supply Chain Risk Management for Systems and Organizations [SP 800-161 Revision 1]). Questions and comments about Cybersecurity Supply Chain Risk Management (C-SCRM) are always welcome and can be directed to [email protected]. Join a C-SCRM E-mail Listserv. The following Listservs are available: Federal C-SCRM...

The preliminary draft "Toward a PEC use-case suite (Draft)" remains open to public comments. Abstract: This document motivates the development of a privacy-enhancing cryptography (PEC) use-case suite. This would constitute a set of proofs of concepts, showcasing the use of cryptographic tools for enabling privacy in various applications. This is not a proposal, but rather a sketch idea to motivate initial public feedback, which can be useful to determine a potential process towards a PEC use-case suite. Keywords: cryptography, privacy; privacy-enhancing cryptography (PEC); reference...

NIST seeks to accelerate the adoption of our cybersecurity and privacy standards, guidelines, and frameworks by making it much easier for users of NIST products to identify, locate, compare, and customize content across NIST’s standards, guidelines, and practices. This will also add value to our existing NIST guidance by delivering human- and machine-consumable information. What is the Cybersecurity and Privacy Reference Tool (CPRT)? The CPRT provides a centralized, standardized, and modernized mechanism for managing reference datasets (and offers a consistent format for accessing reference...

Algorithm Specifications Beginning in 2011, validation testing of individual algorithm components was made available. Many situations exist where the specifications of an algorithm standard are implemented in multiple cryptographic boundaries. For example, PIV Smartcard applications may implement one part of an algorithm on the smartcard and another part of the algorithm on the smartcard reader. Possible reasons for implementing an algorithm this way is processing limitations or size constraints. In this situation, the algorithm validation testing of the complete algorithm can't be utilized...

The suite of NIST information security risk management standards and guidelines is not a "FISMA Compliance checklist." Federal agencies, contractors, and other sources that use or operate a federal information system use the suite of NIST Risk Management standards and guidelines to develop and implement a risk-based approach to manage information security risk. FISMA emphasizes the importance of risk management. Compliance with applicable laws, regulations, executive orders, directives, etc. is a byproduct of implementing a robust, risk-based information security program. The NIST Risk...

Post-quantum candidate algorithm nominations are due November 30, 2017. Call for Proposals NIST will form an internal selection panel composed of NIST employees for the technical evaluations of the submitted algorithms. This panel will analyze the submitted algorithms and review public comments that are received in response to the posting of the “complete and proper” submissions. The panel will also take into account all presentations, discussions and technical papers presented at the PQC standardization conferences, as well as other pertinent papers and presentations made at other...

More complex cryptographic functions use other cryptographic primitives as building blocks to securely perform the desired operations. The Automated Cryptographic Validation Test System (ACVTS) testing of higher level cryptographic functions focuses on the algorithm itself and not the other algorithms that may also be used. This means it is required that prerequisite algorithms are tested separately in order to receive a cryptographic algorithm validation. The following tables outline the prerequisite requirements for ACVTS. Symmetric Key Algorithm Mode...

Retired Algorithms And Algorithm Components Current retired testing includes the following algorithms and references: DES Data (Message) Authentication Code (MAC) and Key Management Using ANSI X9.17 Message Authentication Code (MAC), FIPS 113 Key Management Using ANSI X9.17, FIPS 171 Algorithms and/or Algorithm Components as detailed in SP800-131A Revision 1 Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths RNG (FIPS 186-2 with Change Notice 1 dated October 5, 2001 (Appendix 3.1 and 3.2), ANSI X9.31 (Appendix A.2.4) and ANSI...

Call for Proposals All electronic data shall be provided either in a zip file, or on a single CD-ROM, DVD, or USB flash drive labeled with the submitter’s name, as well as the name of the proposed cryptosystem. 2.C.1 Implementations Two implementations are required in the submission package: a reference implementation and an optimized implementation. The goal of the reference implementation is to promote understanding of how the submitted algorithm may be implemented. Since this implementation is intended for reference purposes, clarity in the implementation code is more important than the...

Test PKI Info | Sample Messages | Version 1 Test Cards | Email List In order to facilitate the development of applications and middleware that support the Personal Identity Verification (PIV) Card, the National Institute of Standards and Technology (NIST) has developed a set of test PIV Cards, which are available for purchase as a NIST Special Database. An overview of the test PIV Cards is provided in NIST 8347, NIST Test Personal Identity Verification (PIV) Cards Version 2. NISTIR 8347 also contains technical details about the contents of each of the test cards in the set....

FIPS 140-3 Logo Usage and Application What are the official FIPS 140-3 validated product logos? or For validated products, the logo must be accompanied by the "FIPS 140-3 Validated" and the certificate number. If a product has a FIPS 140-3 module internal to the product, "FIPS 140-3 Inside" and the certificate number must also accompany the logo. The FIPS 140-3 logo is a Certification Mark of NIST, which does not imply product endorsement by NIST, the U.S. or Canadian Governments. What are the guidelines for the use of the FIPS 140-3 logo? Both phrases "FIPS 140-3 Validated" and...

This research grew out of our 2001 paper on failures in medical device software, which found that the failures were triggered by only 1 to 4 variables interacting. Surprisingly, although "pairwise" testing had been popular for many years, no one had looked at the actual distribution of failures by number of interacting factors. We continued this work and published other papers finding that all, or nearly all, software failures involve interactions among a small number of variables, no more than 6, in thousands of failure reports. Below are some of our research areas. If you'd like to find out...

Base EaaS Architecture Without A Decentralized Root Of Trust In this example, the client system is equipped with a Hardware Root of Trust (HRT) device. Examples of HRT devices are the Trusted Platform Module, Intel® Identity Protection Technology, and the ARM® TrustZone technology. The client system runs a dedicated software application capable of interfacing with the local HRT device on the one end and with the EaaS on the other end. The application communicates with the entropy server using standard plaintext protocols, such as HTTP. The dedicated application initiates the procedure for...

Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise's computing assets. CPE names product classes rather than specific installed instances, which lets security tools make consistent, automated decisions for asset management, vulnerability management, and configuration management. This page is the entry point for the CPE specification. It gives a high-level overview of the CPE versions and the work now under way on the next major revision. Each version has its own...

These are reference sources for frameworks, algorithms validation, software assurance, testing, and other measurements related to information security. Automated Combinatorial Testing for Software Combinatorial or t-way testing is a proven method for more effective software testing at lower cost. The research toolkit can make sure that there are no simultaneous input combinations that might inadvertently cause a dangerous error. Cryptographic Algorithm Validation Program (CAVP) The NIST Cryptographic Algorithm Validation Program provides validation testing of Approved (i.e.,...

The following are selected examples of additional resources supporting the incident response life cycle. Vulnerability and Threat Information CISA, Automated Indicator Sharing (AIS) CISA, CISA Cyber Threat Indicator and Defensive Measure Submission System CISA, Cybersecurity Alerts & Advisories CISA, Cybersecurity Directives CISA, Ransomware Vulnerability Warning Pilot (RVWP) The MITRE Corporation, MITRE ATT&CK National Council of ISACs (NCI) NIST, Guide to Cyber Threat Information Sharing (SP 800-150) NIST, National Vulnerability Database (NVD) NIST, Recommendations for...

AES Implementations have been validated as conforming to the Advanced Encryption Standard (AES) Algorithm, as specified in Federal Information Processing Standard Publication 197, Advanced Encryption Standard, using the tests found in the Advanced Encryption Standard Algorithm Validation Suite (AESAVS). CCM Implementations have been validated as conforming to the Counter with Cipher Block Chaining-Message Authentication Code (CCM), as specified in Special Publication 800-38C, using tests described in the CCM Validation System (CCMVS). Component...

Version 1.07 enabling tools for PKI client software developers This page contains conformance tests for relying parties that validate X.509 certification paths. Each test consists of a set of X.509 certificates and CRLs. The tests are fully described in the Conformance Testing of Relying Party Client Certificate Path Processing Logic document. The goal for the first release of these tests was to address the X.509 features used in the DoD Class 3 PKI. While this test suite remains available for use, it has been superseded by the Public Key Interoperability Test Suite (PKITS), which...

The Automated Cryptographic Validation Testing System (ACVTS) comprises two main environments that support the Automated Cryptographic Validation Protocol (ACVP): the demonstration environment (ACVTS Demo aka “Demo”) and the production environment (ACVTS Prod aka “Prod”). Demo is a sandbox-style environment in which users may test their algorithm implementations and ACVP client applications. The Demo environment should be considered semi-volatile, meaning that any information stored in it is subject to loss at any time, though we do strive to keep the environment as stable and intact as...

2007 [11-30-2007] -- Non-Compliance update to Certificate #733 RNG (Cert. #216) changed to non-compliant. This RNG shall not be used for any services requiring the use of random bits. [10-12-2007] -- Federal Register Notice DEPARTMENT OF COMMERCE National Institute of Standards and Technology Docket No. 070321067–7068–01 Public Draft of Federal Information Processing Standard (FIPS) 140-3, a revision of FIPS 140-2, Security Requirements for Cryptographic Modules AGENCY: National Institute of Standards and Technology (NIST), Department of Commerce. ACTION: Public comment period...

NPIVP maintains validation lists for validated PIV Card Applications and PIV Middleware. The PIV Card Application validation list is updated as new PIV Card Applications receive validation certificates from the NPIVP. The PIV Middleware Validation is discontinued beginning with SP 800-73-5 specifications since smart card support is natively supported by most endpoint devices -without the need of PIV middleware. To be listed on the NPIVP validated product list, a product must be tested in a NPIVP Test Facility using approved test methods and test tools. PIV Card Application Validation...

Short URL: https://csrc.nist.gov/pqc-standardization FIPS 203, FIPS 204, and FIPS 205, which specify algorithms derived from CRYSTALS-Dilithium, CRYSTALS-KYBER, and SPHINCS+, were published August 13, 2024. FALCON was also selected and will be published in FIPS 206 (in development). See NIST IR 8413, Status Report of the Third Round of the NIST Post-Quantum Cryptography Standardization Process. HQC was selected for standardization on March 11, 2025. See NIST IR 8545, Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process. Additional Digital...

Cryptographic Key Management (CKM) is a fundamental part of cryptographic technology and is considered one of the most difficult aspects associated with its use. Of particular concern are the scalability of the methods used to distribute keys and the usability of these methods. NIST has undertaken an effort to improve the overall key management strategies used by the public and private sectors in order to enhance the usability of cryptographic technology, provide scalability across cryptographic technologies, and support a global cryptographic key management infrastructure. CKMS Publications...

NIST includes here a list of events which may be of interest to those involved with post-quantum cryptography. In particular, this list is intended to include events which will promote research in the main areas involved with our post-quantum cryptography standardization project. For example, workshops devoted to the families comprising the Round 2 candidates (lattices, codes, isogenies, multivariate, etc). It should be noted that NIST is not affiliated with or involved with the organizing of these workshops, and is providing this list as a source of information for the community. Any...