Search CSRC

The following sections detail the Schematron rules for SCAP 1.3. SCAP Schematron Rules The SCAP Schematron Rules are ISO Schematron rules written to check many of the requirements documented in NIST SP 800-126 Rev 3. They are for informational purposes only; they do not supercede the requirements in the specification. The rules are subject to change at anytime. Instructions on how to use the resource are provided in the included scap-rules-readme.txt. Version: 1.3.5 Released: 08/06/2020 Download: SCAP Schematron Package SHA-256:...

The following sections detail the Schematron rules for SCAP 1.2. SCAP Schematron Rules The SCAP Schematron Rules are ISO Schematron rules written to check many of the requirements documented in NIST SP 800-126 Rev 2. They are for informational purposes only; they do not supercede the requirements in the specification. The rules are subject to change at anytime. Instructions on how to use the resource are provided in the included readme.txt. Version: 1.2.6 Released: 12/16/2016 Download: SCAP Schematron Package SHA-1: BBFD29657FB9B9F3EB48A3D021817FBB1DB8E21D SHA-256:...

Application in distributed systems J.F. DeFranco, D.F. Ferraiolo, D. R. Kuhn, and J.D. Roberts, "A Trusted Federated System to Share Granular Data Among Disparate Database Resources", IEEE Computer, Mar, 2021. D.F. Ferraiolo, J.F. DeFranco, D. R. Kuhn, and J.D. Roberts, "A New Approach to Data Sharing and Distributed Ledger Technology: A Clinical Trial Use Case", IEEE Network, Jan, 2021. Foundations and background Kuhn, D. R. (2022). A Data Structure for Integrity Protection with Erasure Capability. NIST CSWP 25 (final version of Kuhn 2018 paper below) Kuhn, R., Yaga, D., & Voas,...

Title / Topic Description Executive Order (EO) 14028 On Improving The Nation's Cybersecurity Executive Order 14028, “Improving the Nation’s Cybersecurity” marks a renewed commitment and prioritization of federal cybersecurity modernization and strategy. To keep pace with modern technological advancements and evolving threats, the Federal Government continues to migrate to the cloud. In support of these efforts, the Secretary of Homeland Security acting through the Director of the Cybersecurity and Infrastructure Security Agency...

PEC tools include a variety of cryptographic primitives, protocols and techniques useful for enabling privacy. This page uses simplified illustrations of "ideal functionalities" to convey a brief intuition about some representative PEC tools. It should be noted that real protocols for these PEC tools use cryptographic techniques in place of the trusted party (\(\mathcal{F}\)) represented in the figures. Zero Knowledge Proof of Knowledge (ZKPoK) A ZKPoK allows a prover to prove knowledge of a secret \(\color{red}w\) (also called witness), without disclosing it to the verifier. The secret is...

Assessing Security Requirements for Controlled Unclassified Information Purpose Assessment procedures and a methodology that can be employed to conduct assessments of the CUI security requirements in NIST SP 800-171. Scope A system security plan describes how the SP 800-171 security requirements are met. The plan describes the system boundary; the environment in which the system operates; how the requirements are implemented; and the relationships with or connections to other systems. The scope of the assessments conducted using the procedures described in SP 800-171A are guided and...

Property based testing deals with the test oracle problem by specifying a set of properties that can be checked automatically after a test. For example, a property to check for a bank deposit transaction might be "transaction_amount > 0 && new_balance == old_balance + transaction_amount". After a set of properties are defined, random values (within a specified range) can be applied and output checked against the properties. Combinatorial test methods can make this process both more efficient and more thorough. Instead of applying random values, t-way combinations of values can be used....

The Computer Forensic Reference DataSet Portal (CFReDS) is a gateway to documented digital forensic image datasets. These datasets can assist in a variety of tasks including tool testing, developing familiarity with tool behavior for given tasks, general practitioner training and other unforeseen uses that the user of the datasets can devise. Most datasets have a description of the type and locations of significant artifacts present in the dataset. There are descriptions and finding aides to help you locate datasets by the year produced, by author, or by attributes of the dataset. All of the...

While the public comment period on SP 800-171 and SP 800-171A continues, the SP 800-172 update has begun. Here’s what you can expect. The enhanced security requirements for protecting CUI will be modified to match the structure of the requirements in SP 800-171, Revision 3. The enhanced security requirements will align with the structure and content of the controls and control enhancements in SP 800-53, Revision 5. Enhanced security requirements will be added to address new threats and vulnerabilities. Changes to the enhanced security requirements will support the future development of...

Papers Weiss, A., Gautham, S., Jayakumar, A. V., Elks, C. R., Kuhn, D. R., Kacker, R. N., & Preusser, T. B. (2021). Understanding and fixing complex faults in embedded cyberphysical systems. Computer, 54(1), 49-60. Jayakumar, A. V., Gautham, S., Kuhn, R., Simons, B., Collins, A., Dirsch, T., ... & Elks, C. (2020, October). Systematic software testing of critical embedded digital devices in nuclear power applications. In 2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) (pp. 85-90). IEEE. Elks, C., Jayakumar, A., Collins, A., Hite, R., Karles, T.,...

For technical inquiries, send e-mail to [email protected], or contact: Lily Chen National Institute of Standards and Technology 100 Bureau Drive, Stop 8930, Gaithersburg, MD 20899-8930 P: +1 301-975-6974 or via fax at +1 301-975-8670 Email: [email protected] Answers to germane questions will be posted at https://www.nist.gov/pqcrypto. Questions and answers that are not pertinent to this announcement may not be posted. NIST will endeavor to answer all questions in a timely manner.

Overview of the Documentation and Governance for the FIPS 140-3 Cryptographic Module Validation Program Federal Information Processing Standards Publication (FIPS) 140-3 became effective September 22, 2019, permitting CMVP to begin accepting validation submissions under the new scheme beginning September 2020. The FIPS 140-3 standard introduces some significant changes in the management over the previous standard. Rather than encompassing the module requirements directly, FIPS 140-3 references International Organization for Standardization/International Electrotechnical Commission (ISO/IEC)...

Call for Proposals The cover sheet of a submission package shall contain the following information: Name of the proposed cryptosystem. Principal submitter’s name, e-mail address, telephone, organization, and postal address. Name(s) of auxiliary submitter(s). Name of the inventor(s)/ developer(s) of the cryptosystem. Name of the owner, if any, of the cryptosystem (normally expected to be the same as the submitter). Signature of the submitter. (optional) Backup point of contact (with telephone, fax, postal address, and e-mail address).

We often get the question whether patching/updating a FIPS validation module (particularly when there is a significant security-related reason such as addressing a CVE) will invalidate that module’s FIPS status. The original version would maintain its validation but the new version that includes the patch/update would not be validated. Changing the code of the module results in that portion being untested and the CMVP is only able to make validation assurances for the tested configuration. As noted in our guidance: The tested/validated module version, operational environment upon which it...

Background NIST cryptography standards (Federal Information Processing Standards, or “FIPS”) and other publications (typically specified in the Special Publication (SP) 800 series) are intended to protect non-national security federal information and information systems. Outside the Federal Government, these publications are voluntarily relied upon across many sectors to promote economic development and protect sensitive personal and corporate information. Cryptography standards and other publications must be reviewed and maintained regularly because of rapid technological advances, the...

An [email protected] email mailing list has been established for dialogue regarding NIST's RBG project. It is an unmoderated mailing list; messages addressed to this list are immediately distributed to all the addresses on the list. To join: mailto:[email protected] You will receive a response message from [email protected]. Please click the "Join" link inside that email to confirm your subscription request. To unsubscribe: mailto:[email protected]

Physical Unclonable Function (PUF) Vulnerabilities Combination frequency differencing (CFD) can be used to analyze the susceptibility of physical unclonable functions (PUFs) to machine learning attacks. Preliminary results suggest that the method may be useful for identifying bit combinations that have a disproportionately strong influence on PUF response bit values. Kuhn, D. R., Raunak, M. S., Prado, C., Patil, V. C., & Kacker, R. N. (2022, April). "Combination Frequency Differencing for Identifying Design Weaknesses in Physical Unclonable Functions". In 2022 IEEE International Conference...

A module validation caveat may warn a user of specific stipulations, conditions, or limitations of a module, to assist in making a risk determination on its usage. The examples below list the potential caveats for a FIPS 140-3 validation (for a list of FIPS 140-2 caveats, see Implementation Guidance G.13 #4). A caveat may be added, modified or expanded by the CMVP during the validation process. Interim Validation Caveats Interim validation The module: Has been fully tested, evaluated for conformance to FIPS 140-3, and recommended for validation by an accredited CST...

An essential type of security risk analysis is to determine the level of compromise possible for important hosts in a network from a given starting location. This is a complex task as it depends on the network topology, security policy in the network as determined by the placement of firewalls, routers and switches and on vulnerabilities in hosts and communication protocols. Traditionally, this type of analysis is performed by a red team of computer security professionals who actively test the network by running exploits that compromise the system. Red team exercises are effective, however...

ARCHIVED: The NIST HIPAA Security Rule Toolkit is no longer supported, and is provided here only for historical purposes. HIPAA Security Rule Toolkit The NIST HIPAA Security Toolkit Application is intended to help organizations better understand the requirements of the HIPAA Security Rule, implement those requirements, and assess those implementations in their operational environment. Target users include, but are not limited to, HIPAA covered entities, business associates, and other organizations such as those providing HIPAA Security Rule implementation, assessment, and compliance...

Validation Number: 137 Vendor: Microsoft Corporation Product Name: SCAP Extensions for Microsoft System Center Configuration Manager Product Major Version: 3.0 Product Version Tested: v3.0.1154.0 Tested Platforms: Microsoft Windows 7, 64 bit Microsoft Windows 7, 32 bit SCAP 1.2 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Validated Product Vendor Provided SCAP Information Dates Tested: 1/20/2015 - 6/9/2015...

The overlays listed are based on security and privacy controls included in the current revision of NIST SP 800-53. Supply Chain Overlay Name: NIST SP 800-161, Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations Overlay Publication Date: May 2022 Technology or System: Cyber Supply Chain Overlay Author: Jon Boyens (NIST), Angela Smith (NIST), Nadya Bartol (BCG), Kris Winkler (BCG), Alex Holbrook (BCG), Matthew Fallon (BCG) Overview: Identification and augmentation of cybersecurity supply chain risk management (C-SCRM)-related controls in SP...

Our initial planning for the CPRT project comprises three phases: Phase 1: Free the Data We are currently in Phase 1, which involves developing the data format and freeing the data from a selection of our guidelines and frameworks with broad impact. This data is typically locked into publications. By moving it into a shared repository using a newly-developed unified data format, we will now be able to offer new ways to interact with and download the data. Phase 1 offers only basic tools for interacting within each reference datasets. Phase 2: Manage the Data Phase 2 in late 2023 will...

In January 2022, the George Mason University Cryptographic Engineering Research Group (CERG) team published three calls to assist in evaluating protected implementations of the finalists: Call for Protected Hardware Implementations, targeting low-cost modern FPGAs Call for Protected Software Implementations, targeting low-cost modern embedded processors Call for Side-Channel Security Evaluation Labs The NIST team encourages submitters and third parties to contribute to this initiative. Performance benchmarking results are provided in the following pages: Microcontroller...

Assessment: The action of evaluating, estimating, or judging against defined criteria. Different types of assessment (i.e., qualitative, quantitative, and semi-quantitative) are used to assess risk. Some types of assessment yield measures. Assessment Result(s): The output or outcome of an assessment. Measurement: The process of obtaining quantitative values using quantitative assessment. Measures: Quantifiable and objective values resulting from measurement. Metrics: Measures and assessment results designed to track progress, facilitate decision-making and improve performance with respect...