Search CSRC

Abstract: This document addresses the need for effective data protection strategies in the evolving realm of cloud-native network architectures, including multi-cloud environments, service mesh networks, and hybrid infrastructures. By extending foundational data classification concepts, it provides a framewor...

Abstract: Hash functions that compute a fixed-length message digest from arbitrary length messages are widely used for many purposes in information security. This document provides security guidelines for achieving the required or desired security strengths when using cryptographic applications that employ th...

Abstract: Cryptographic keys are vital to the security of internet security applications and protocols. Many widely-used internet security protocols have their own application-specific Key Derivation Functions (KDFs) that are used to generate the cryptographic keys required for their cryptographic functions....

Abstract: Cryptographic hash functions that compute a fixed- length message digest from arbitrary length messages are widely used for many purposes in information security. This document provides security guidelines for achieving the required or desired security strengths when using cryptographic applications...

Abstract: This ITL Bulletin summarizes Special Publication (SP) 800-47, Security Guide for Interconnecting Information Technology Systems. That publication provides guidance for planning, establishing, maintaining, and terminating secure yet cost-effective interconnections between IT systems that are owned an...

NIST has released Special Publication (SP) 800-88r2 (Revision 2), Guidelines for Media Sanitization.

A new NIST cybersecurity white paper is available, Security Considerations for Code Signing.

NIST has published NIST SP 800-204, Security Strategies for Microservices-based Application Systems.

Abstract: This document provides federal agencies with a guide for implementing attributes in access control systems. Attributes enable a logical access control methodology where authorization to perform a set of operations is determined by evaluating attributes associated with the subject, object, requested...

Abstract: This Recommendation provides cryptographic key management guidance. It consists of three parts. Part 1 provides general guidance and best practices for the management of cryptographic keying material. Part 2 provides guidance on policy and security planning requirements for U.S. government agencies....

Abstract: This bulletin summarizes the information that was published in NIST Interagency Report (NISTIR) 7621, Small Business Information Security: The Fundamentals, by Richard Kissel. The publication presents three major areas that small businesses should address to provide security for their information, s...

Abstract: Based on the Federal IT Security Assessment Framework, ITL’s governmentwide information security assessment tool, Automated Security SelfEvaluation Tool (ASSET), assists federal agencies in improving the security of their information systems and resources. ASSET automates the completion of ITL’s sec...

Abstract: This document introduces broadband communication technologies, and the security considerations associated with them. It discusses the use of a personal firewall, which is essential in protecting a home computer from intrusion; provides instructions on how to configure PCs and web browsers for added...

Abstract: Risk Management is the process of identifying risk, assessing risk, and taking steps to reduce risk to an acceptable level. Organizations use risk assessment, the first step in the risk management methodology, to determine the extent of the potential threat, vulnerabilities, and the risk associated...

Abstract: This ITL Bulletin summarizes Special Publication (SP) 800-26, Security Self-Assessment Guide for Information Technology Systems. Adequate security of information and the systems that process it is a fundamental management responsibility. Agency officials must understand the current status of their i...

Abstract: A cryptographic, Key Notarization System is proposed for computer networks to protect personal (nonshared) files, to communicate securely both on and off-line with local and remote users, to protect against key substitution, to authenticate system users, to authenticate data, and to provide a digita...

Abstract: This document presents a technique for conducting a risk analysis of an ADP facility and related assets. Risk analysis produces annual loss exposure values based on estimated costs and potential losses. The annual loss exposure values are fundamental to the cost effective selection of safeguards for...

Abstract: This Recommendation specifies techniques for the derivation of additional keying material from a secret key—either established through a key establishment scheme or shared through some other manner—using pseudorandom functions HMAC, CMAC, and KMAC.

Abstract: This Recommendation specifies techniques for the derivation of additional keying material from a secret key—either established through a key establishment scheme or shared through some other manner—using pseudorandom functions HMAC, CMAC, and KMAC.

Abstract: This Recommendation specifies techniques for the derivation of keying material from a shared secret established during a key-establishment scheme defined in NIST Special Publications 800-56A or 800-56B.

Abstract: This Recommendation specifies techniques for the derivation of keying material from a shared secret established during a key-establishment scheme defined in NIST Special Publications 800-56A or 800-56B.

Abstract: This Recommendation specifies techniques for the derivation of additional keying material from a secret key, either established through a key establishment scheme or shared through some other manner, using pseudorandom functions.

Abstract: The purpose of this document is to provide additional recommendations on the Personal Identity Verification (PIV) Card color-coding for designating employee affiliation. The recommendations in this document complement FIPS 201 in order to increase the reliability of PIV card visual verification.

Abstract: The primary purpose of this register is to specify names that uniquely identify Computer Security Objects (CSOs). Unique names can be used to reference objects during the negotiation of security services for a transaction or application. The register is also a repository of parameters associated wit...

Abstract: This is the NIST Threshold Call, calling for public submissions of multi-party threshold schemes, and other related crypto-systems, to support the United States' National Institute of Standards and Technology (NIST) in gathering a public body of reference materials on advanced cryptography. In a thr...