Search CSRC

Type: Presentation

Type: Presentation

Type: Presentation

Type: Opening Remarks

NIST's Crypto Publication Review Board is proposing to withdraw Special Publications 800-102, "Recommendation for Digital Signature Timeliness." Submit public comments through Monday, May 12, 2025.

NIST is proposing to update Special Publication (SP) 800-38E, "Recommendation for Block Cipher Modes of Operation: the XTS-AES Mode for Confidentiality on Storage Devices." Please submit public comments by March 10, 2023.

NIST's National Cybersecurity Center of Excellence (NCCoE) has released Draft NISTIR 8336, "Background on Identity Federation Technologies for the Public Safety Community." The public comment period ends July 26, 2021.

D.R. Kuhn, R. Kacker and Y.Lei, Random vs. Combinatorial Methods for Discrete Event Simulation of a Grid Computer Network, MODSIM World 2009, Virginia Beach, Virginia, October 14-16, 2009. In Selected Papers Presented at MODSIM World 2009 Conference and Expo, edited by T.E. Pinelli, NASA/CP-2010-216205, National Aeronautics and Space Administration, pp. 83-88. R. Kessel and R. Kacker, A Test of Linearity Using Covering Arrays for Evaluating Uncertainty in Measurement, Advanced Mathematical and Computational Tools in Metrology and Testing (AMCTM VIII), Paris, France, June 23-25, 2008, Series...

DISCLAIMER: The pre-validation list is provided for information purposes only. Participation on the list is voluntary and is a joint decision by the vendor and the NPIVP test facility. Products are listed alphabetically by vendor name. Posting on the list does not imply guarantee of final validation. The following phases describe the pre-validation process. The status of each product in the process is identified in the list. PIV Card Application Testing in Progress There exists a viable contract between a vendor and a NPIVP testing facility for the testing of the vendor’s PIV card...

TMSAD describes a common trust model that can be applied to specifications within the security automation domain, such as Security Content Automation Protocol (SCAP). Since information in the security automation domain is primarily exchanged using Extensible Markup Language (XML), the focus of this model is on the processing of XML documents. The trust model is composed of recommendations on how to use existing specifications to represent signatures, hashes, key information, and identity information in the context of an XML document within the security automation domain. TMSAD Resources...

Submissions should specify a mode of operation for a symmetric (secret) key block cipher algorithm. At a minimum, the mode should support underlying block ciphers with key-block combinations of 128-128, 192-128, and 256-128 bits. However, the specification should be generic – i.e., written to handle other key-block combinations, if they can be supported. Example modes include, but are not limited to, techniques for performing encryption, message authentication, hashing, and random bit generation. It will be helpful to receive variations of Counter mode arising from alternative...

On April 23 and 24, 2012, the NIST ITL Computer Security Division will host a two-day workshop about the cyber security needed for cyber-physical systems (CPSs), with a focus on results of research and real-world deployment experiences. The first day will have speakers that address CPSs across multiple sectors of industry (e.g., automotive, aviation, healthcare). The second day will focus on cyber security needs of CPSs in the electric Smart Grid. Abstracts and slide sets from presenters will be published in a NIST Interagency Report as proceedings of the conference. Goals of the conference:...

This page contains resources referenced in the FIPS 140-3 Management Manual Equivalency Regression Test Table It is possible, under certain conditions, for a vendor to list multiple hardware modules under the same certificate. Some of the conditions are defined by the equivalency categories based on the technologies types and difference between the modules within the equivalency categories. For more information regarding equivalency categories and testing level scenarios/categories and usage of the equivalency regression test table presented below, refer to the Management Manual...

Through virtual events and email list, the Forum provides our members: a venue to exchange information, share ideas and best practices, resources, and knowledge; an ongoing opportunity to leverage the work done in other organizations to reduce possible duplication of effort; and access to a community and network of cybersecurity and privacy professionals across the U.S. federal, state, and local government and at higher education organizations handling federal information. Virtual Events Refer to the Events Page for upcoming Forum meetings and registration information. Forum...

The National Institute of Standards and Technology (NIST) is requesting comments on a new process to solicit, evaluate, and standardize one or more quantum-resistant public-key cryptographic algorithms. Currently, public-key cryptographic algorithms are specified in FIPS 186–4, Digital Signature Standard, as well as special publications SP 800-56A Revision 2, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography and SP 800-56B Revision 1, Recommendation for Pair-Wises Key-Establishment Schemes Using Integer Factorization Cryptography. However, these...

Autonomous systems are increasingly seen in safety-critical domains, such as self-driving vehicles and autonomous aircraft. Unfortunately, methods developed for ultra-reliable software, such as avionics, depend on measures of structural coverage that do not apply to neural networks or other black-box functions often used in machine learning. This problem is recognized and teams are seeking solutions in aviation and other fields. As one notes, "How do we determine that the data gathered to train an AI system is suitably representative of the real world?[1]" This key question is currently...

COSIS leverages a newly launched NIST Control Overlays for Super Intelligence Systems Slack Channel, a hub for the cybersecurity and SI communities to hold discussions related to the development of these overlays. Slack channel members get updates, engage in facilitated discussions with the NIST principal investigators and other subgroup members, share ideas, provide real-time feedback, and contribute to the development of the overlays! All interested parties are welcomed. Join the Slack channel Submit your request using the Google form. By joining the Slack channel, users agree to the...

While SWID Tags demonstrate a possible standards-based way of tracking the state of installed software products, their fitness to support patch management processes depends on the availability and accuracy of deployed tags. Unfortunately, today most vendors never update a tag after it is installed on the endpoint. As a result, these tags fall out of date as soon as that product is updated. Once this happens, these tags are no longer usable for patch or update management as the state of the associated software product will differ from that reported by the tag. To address this issue, vendors...

Last December, the public comment period opened for the Draft Fourth Revision to NIST Special Publication 800-63, Digital Identity Guidelines (Draft NIST SP 800-63-4). The formal comment period is now closed, but we welcome continued discussion and feedback on the draft and potential changes for Revision 4. During the comment period we received over 130 responses and nearly 3,400 comments—nearly double what we received on the previous revision of the Guidelines! To see more information about this event please go here.

The Cyber Security Research Alliance (CSRA) and National Institute of Standards and Technology (NIST) are sponsoring a two day workshop to explore emerging research needs for cybersecurity in cyber-physical systems with the diverse cyber-physical community at large. The sponsoring organizations seek to have lively discussion on the following topics: Buying the Black Box: Security in Acquisition and Implementation Getting Reliable Information on Vulnerabilities and Threats Working with What We Have: Securing the Base Supply Chain: Its Impact on Securing CPS Approaches to Assurance and...

Presentations & Speakers at a Glance: Analytic Portability for Log Analysis, George Cancro, Johns Hopkins Applied Physics Laboratory; Small Agency Telework Challenges, Alan Kikorian, Department of State. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. The Federal Computer Security Program Managers Forum (the "Forum") is an informal group sponsored by the...

Presentations & Speakers at a Glance: .govCAR: Threat-based Approach to Cybersecurity Architecture Reviews, Branko Bokan, DHS; Zero Trust Architecture 101: What it Means for Federal Agencies, Scott Rose, NIST; Identifying Minimum Cybersecurity Features for IoT Devices used by the Federal Government, Michael Fagan, NIST. NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY...

Presentations & Speakers at a Glance: Building a Security Authorization Strategy for Cloud Service Providers, Jaime Noble, DOJ; FIPS 201-2, PIV of Federal Employees and Contractors, Hilde Ferraiolo, NIST. NOTE: THIS MEETING IS OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. GOVERNMENT IDs WILL BE REQUIRED FOR MEETING ENTRANCE. The Federal Computer Security Program Managers Forum (the...

Presentations & Speakers at a Glance: Overview of the Useable Security Program, Mary Theofanos & July Haney, NIST; Security Fatigue, Brian Stanton, NIST; and Adopting Risk Metrics for an Effective Risk Management Program, Debra Graul & Baan Alsinawi, PBGC NOTE: THIS MEETING IS OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY OR ORGANIZATION THEY SUPPORT. GOVERNMENT IDs WILL BE REQUIRED FOR MEETING ENTRANCE. The...

Presentations & Speakers at a Glance: NIST Cyber Risk Scoring Program Overview, Sheldon Pratt, IT Security Assessor, & Santi Kiran, IT Security Assessor, NIST; and Threat-based Risk Profiling Methodology, Zach Baldwin, FedRAMP, Program Manager for Strategy, Innovation, and Technology, GSA, and Tom Volpe, Principal and Subject Matter Expert, VITG NOTE: FORUM MEETINGS ARE OPEN TO ONLY FEDERAL/STATE EMPLOYEES, HIGHER EDUCATION EMPLOYEES, AND THEIR DESIGNATED SUPPORT CONTRACTORS. REGISTRANTS MUST USE A .GOV, .EDU, OR .MIL ADDRESS FOR SIGN-UP. SUPPORT CONTRACTORS MUST INDICATE THE AGENCY...