Search CSRC

Since announcing KECCAK as the winning algorithm of the SHA-3 Cryptographic Hash Algorithm Competition on October 2, 2012, NIST has consulted with the Keccak design team and the cryptographic community in its effort to specify Keccak as the new SHA-3 Standard. The table below shows major events in the development of FIPS 202, SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions. Date Event 10/02/2012 SHA-3 competition ended; KECCAK announced as the winner. (NIST News Release) 02/06/2013 KECCAK team’s visit and presentation on SHA-3....

Research tools to support combinatorial testing. No license is required and there are no restrictions on distribution or use. All software is provided free of charge and will remain free in the future. NIST is an agency of the US Government, so this software is public domain. You are free to include it and redistribute it in commercial products if desired. ACTS is in Java, and will run on any platform with the latest Java release (Java free download is at java.com). There are many users running current Windows, Mac OS, and Linux systems. ACTS Basic version download: Java .jar file. No...

Latest research: Combinatorial Frequency Differencing. NIST Cybersecurity Whitepaper.- Describes measures of the frequency of combination coverage and difference between Class and Non-class elements in machine learning classification problems. Illustrates application of these methods for identifying weaknesses in physical unclonable function implementations. Combinatorial Coverage Difference Measurement. NIST Cybersecurity Whitepaper.- Introduces a variety of measures that can be applied to understanding differences in combination coverage. Also see our User Manual for the coverage...

All questions regarding the implementation and/or use of any validated cryptographic module should first be directed to the appropriate VENDOR point of contact (listed for each entry). SEARCH our database of validated modules. The validated modules search provides access to the official validation information of all cryptographic modules that have been tested and validated under the Cryptographic Module Validation Program as meeting requirements for FIPS 140-1, FIPS 140-2, and FIPS 140-3. The search results list all issued validation certificates that meet the supplied search criteria and...

Human-centered cybersecurity (HCC) (also known as usable security) involves the social, organizational, and technological influences on people’s understanding of and interactions with cybersecurity. By taking a human-centered cybersecurity approach, we can both improve people's cybersecurity experiences and achieve better cybersecurity outcomes. This Google Group provides a forum for human-centered cybersecurity researchers, cybersecurity and IT practitioners, and human factors experts to share ideas, best practices, and potential engagement opportunities. Read the September 2024 NIST Blog...

XCCDF - The Extensible Configuration Checklist Description Format XCCDF is a specification language for writing security checklists, benchmarks, and related kinds of documents. An XCCDF document represents a structured collection of security configuration rules for some set of target systems. The specification is designed to support information interchange, document generation, organizational and situational tailoring, automated compliance testing, and compliance scoring. The specification also defines a data model and format for storing results of benchmark compliance testing. The intent...

Archived. This page is archived for informational purposes only. See End-of-Life Announcement: NIST SCAP Validation Program. Security Content Automation Protocol Validated Products and Modules This webpage contains a list of products and modules that have been validated by NIST as conforming to the Security Content Automation Protocol (SCAP) and its component standards. SCAP validated products and modules have completed formal testing at an NVLAP accredited laboratory and meet all requirements as defined in NIST IR 7511. A module is defined as a software component that may be embedded in...

Short URL: https://csrc.nist.gov/projects/cmvp/sp800-140b This page provides information related to preparing, submitting, coordinating, and finalizing a module for the CMVP. These are the how-to processes and procedures used at the point a CMVP lab has completed testing and is ready to create and submit the package. Module Package Creation Module Information Structure (MIS) Resources To facilitate automated verification and processing of the modules, much of the information needs to be submitted in a structured and organized format. The CMVP uses JSON as the submission format to...

Abstract: Picture Archiving and Communication System (PACS) is defined by the Food and Drug Administration (FDA) as a Class II device that “provides one or more capabilities relating to the acceptance, transfer, display, storage, and digital processing of medical images. Its hardware components may include wo...

This 1-day virtual conference will focus on DevSecOps and ZTA as foundational approaches in multi-cloud environments. They facilitate rapid secure application development, promote interoperability, and mitigate threats in a perimeter-less environment. The emphasis will be on delivery of DevSecOps and ZTA constructs through use of a “service mesh architecture” – a high-assurance operational infrastructure. These assurances are made available through new tool sets and open-source SDKs, that, through configuration and API calls, enable features such as mutual TLS, secure service discovery,...

The following NIST documents were created to brief a blue ribbon Committee of Visitors (COV) charged with reviewing the agency’s cryptographic standards and guidelines program by NIST’s primary independent advisory panel, the Visiting Committee on Advanced Technology (VCAT). The VCAT held a public meeting on July 14, 2014 to discuss the recommendations from the COV members and finalize a report detailing recommendations to NIST on steps to strengthen its cryptographic standards and guidelines program. The VCAT's report, along with the individual recommendations of the COV members, are...

The National Cybersecurity Center of Excellence (NCCoE) has released the initial public draft of NIST IR 8496 for public comment. The comment period closes on January 9, 2024.

Click for Conference Video Timestamps Title Speaker Description Timestamp Conference Overview Michaela Iorga OSCAL Strategic Outreach Director, NIST Summarizing the timeline of the event 25:39 Opening Remarks Andre Mendes CIO, DoC The advancements of the technology realm and how it relates to Cybersecurity and OSCAL 28:51 OSCAL & A New Way of Doing Software in Federal Robert Wood CISO, Center for Medicare and Medicaid Services, HHS The culture of OSCAL and its innovative...

This event will provide a ninety-minute overview of the new NIST DRAFT Special Publication (SP) 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations. This virtual event will feature an introduction by Dr. Ron Ross, and an overview of the updates to Draft SP 800-53, Revision 5 by Victoria Pillitteri, Naomi Lefkovitz and Jon Boyens. A FAQ about Draft NIST SP 800-53, Revision 5 is available at: https://go.usa.gov/xvEHT (also available in PDF format). The virtual event will be recorded and available for playback on the registration site (link:...

Shortcut URL: https://csrc.nist.gov/bcm/authentication-for-confidentiality-modes Authenticity is a goal that includes two types of assurance for data: its integrity (i.e., that the data is unaltered from its original form) and origin (i.e., that the data was in fact generated at its purported source). Authentication is a process (e.g., a cryptographic technique) for providing assurance of authenticity. Cryptographic authentication implies some form of data expansion (i.e., an increase in the size of the protected data). Authenticity is a critical requirement for most information technology...

Authority: This work is being initiated pursuant to NIST’s responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107–347. Call for Additional Digital Signature Schemes for the Post-Quantum Cryptography Standardization Process (PDF) Closed June 1, 2023 Submission packages must be received by NIST by June 1, 2023. Submission packages received before March 1, 2023, will be reviewed for completeness by NIST; the submitters will be notified of any deficiencies by March 31, 2023, allowing time for deficient packages to be amended by the submission...

Authority: This work is being initiated pursuant to NIST’s responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107–347. The submission deadline of November 30, 2017 has passed. Please see the Round 1 Submission page for a list of complete and proper submsisions. The Call for Proposals is available for historical reference. Background In recent years, there has been a substantial amount of research on quantum computers – machines that exploit quantum mechanical phenomena to solve mathematical problems that are difficult or intractable for...

Participate in the inaugural 30-day comment period for a minor (errata) release of SP 800-53 Rev. 5. Submit your comments on proposed changes through August 12, 2022.

DISCLAIMER: The pre-validation list is provided for information purposes only. Participation on the list is voluntary and is a joint decision by the vendor and the NPIVP test facility. Products are listed alphabetically by name. Posting on the list does not imply guarantee of final validation. The following phases describe the pre-validation process. The status of each product in the process is identified in the list. PIV Middleware Testing in Progress There exists a viable contract between a vendor and a NPIVP testing facility for the testing of the vendor’s PIV Middleware. The PIV...

The initial public draft (ipd) of NIST Special Publication (SP) 800-172 Revision 3, Enhanced Security Requirements for Protecting Controlled Unclassified Information (CUI), is available for comment. The public comment period is open through January 17, 2025.

NIST is releasing Draft Special Publication (SP) 800-204, "Security Strategies for Microservices-based Application Systems." Public comments are due by April 26, 2019.

Type: Presentation

Type: Presentation

Type: Presentation

Type: Presentation