Search CSRC

Comments Sought on Updates to Cyber Supply Chain Risk Management Practices for Systems and Organizations (Draft NIST SP 800-161, Revision 1)

The initial public draft of NIST AI 100-2 (2003 edition), Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, is now available for public comment.

The NCCoE has released Draft NIST IR 8441, Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN). The comment period closes July 14, 2023.

NIST's Crypto Publication Review Board invites comments on parts 2 and 3 of Special Publication (SP) 800-57, "Recommendation for Key Management."

The NIST National Cybersecurity Center of Excellence (NCCoE) has published Final NIST IR 8441, Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN).

After two public comment periods, NIST has decided to revise Special Publication 800-135 Rev. 1, "Recommendation for Existing Application-Specific Key Derivation Functions."

Journal: Computer (IEEE Computer) Abstract: Metamorphic testing (MT) can enhance security testing by providing an alternative to using a test oracle, which is often unavailable or impractical. The authors report how MT detected previously unknown bugs in real-world critical applications such as code obfuscators, giving evidence that software...

NIST is publishing NIST IR 8323r1 (revision 1), Foundational PNT Profile: Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services.

The NIST National Cybersecurity Center of Excellence (NCCoE) has released the final version of NIST Special Publication 1800-45, "Cybersecurity for the Water and Wastewater Sector: Build Architecture", demonstrating how to securely enable remote access to operational technology for critical infrastructure.

Abstract:

Abstract: A wide range of software products (also known as code)—including firmware, operating systems, mobile applications, and application container images—must be distributed and updated in a secure and automatic way to prevent forgery and tampering. Digitally signing code provides both data integrity to p...

NIST is currently reviewing SP 800-132, "Recommendation for Password-Based Key Derivation: Part 1: Storage Applications," (2010) and is requesting public feedback on all aspects of the publication by February 24, 2023.

NIST's Crypto Publication Review Board has requested initial public comments on NIST Special Publications (SP) 800-56A, 800-56B, and 800-56C, in the "Recommendations for Key Establishment" subseries. The comment period is open through January 31, 2025.

NIST is currently reviewing Special Publication (SP) 800-106, "Randomized Hashing for Digitial Signatures," (2009) and is requesting public feedback on all aspects of the publication by March 16, 2022.

Conference: 6th International Conference on Networks & Communications (NETCOM 2014) Abstract: Virtualized Infrastructures are increasingly deployed in many data centers. One of the key components of this virtualized infrastructure is the virtual network - a software-defined communication fabric that links together the various Virtual Machines (VMs) to each other and to the physical host on w...

Conference: 17th International Workshop on Cryptographic Hardware and Embedded Systems (CHES 2015) Abstract: Random numbers are essential for cryptography. In most real-world systems, these values come from a cryptographic pseudorandom number generator (PRNG), which in turn is seeded by an entropy source. The security of the entire cryptographic system then relies on the accuracy of the claimed amount of e...

NIST's Crypto Publication Review Board has requested initial public comments on NIST Special Publication 800-102, Recommendation for Digital Signature Timeliness. The comment period is open through January 14, 2025.

Conference: International Symposium on Experimental Algorithms Abstract: Efficient circuits for multiplication of binary polynomials use what are known as Karatsuba recurrences. These methods divide the polynomials of size (i.e. number of terms) k⋅n into k pieces of size n. Multiplication is performed by treating the factors as degree- (k−1) polynomials, with multiplicat...

NIST Internal Report (IR) 8500A ipd (initial public draft), Blockchain-Based Secure Software Assets Management (BloSS@M), outlines a modernized conceptual approach for transforming how software assets are acquired, tracked, and secured across an interagency ecosystem.

A second public draft of NIST SP 1308, NIST CSF 2.0: Cybersecurity, Enterprise Risk Management, and Workforce Management Quick-Start Guide, is available for public comment through January 7, 2026.

NIST is initiating a revision of Special Publication (SP) 800-213A, Internet of Things (IoT) Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog, and has posted a Pre-Draft Call for Comments. This update aims to incorporate lessons learned, align with recent frameworks like CSF 2.0 and SP 800-53 Rev. 5.2.0, and address the evolving IoT threat landscape. This follows the draft update to SP 800-213 Rev. 1.

NIST's Crypto Publication Review Board is proposing to revise Special Publication (SP) 800-135 Revision 1, "Recommendation for Existing Application-Specific Key Derivation Functions." Submit public comments through Friday, June 14, 2024.

Conference: 14th IEEE International Conference on Service-Oriented System Engineering Abstract: A timestamp is a critical component in many applications, such as proof of transaction ordering or analyzing algorithm performance. This paper reports on a method called Verified Timestamping (VT) that improves the standard timestamp protocol. VT was developed at the National Institute of Standards...

NIST Special Publication (SP) 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations," represents a multi-year effort to develop the next generation of controls needed to strengthen and support the Federal Government and critical infrastructure sectors.

Conference: Evaluation and Assessment in Software Engineering (EASE) Abstract: Combinatorial interaction testing (CIT) is a well-known technique, but industrial experience is needed to determine its effectiveness in different application domains. We present a case study introducing a unified framework for generating, executing and verifying CIT test suites, based on the open-s...