Search CSRC

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-117, Guide To Adopting and Using the Security Content Automation Protocol (SCAP), Version 1.0: Recommendations of the National Institute of Standards and Technology. The publication, which was written by Stephen...

Abstract: Smart Grid technologies will introduce millions of new intelligent components to the electric grid that communicate in much more advanced ways (e.g., two-way communications, and wired and wireless communications) than in the past. This report is for individuals and organizations who will be addressi...

Journal: IT Professional Abstract: Enterprise security, often considered a burden for system administrators and users alike, is one of the most rapidly evolving areas of IT. The articles in this issue can help IT professionals who want to be intelligent providers or consumers of secure products and services.

Abstract: This document describe a framework (with the acronym ERO-AA) for establishing an infrastructure for authentication and authorization of Emergency Response officials (ERO) who respond to various types of man-made and natural disasters. The population of individuals authenticated and authorized under...

Conference: Sixth International Conference on Information Assurance and Security (IAS 2010) Abstract: Attribute relations in access control mechanisms or languages allow accurate and efficient specification of some popular access control models. However, most of the access control systems including today s de-facto access control protocol and specification language, XACML, does not provide sufficien...

Conference: The Second SHA-3 Candidate Conference Abstract: A hash function is near-collision resistant, if it is hard to find two messages with hash values that differ in only small number of bits. In this study, we used hill climbing methods to find near-collisions for some of the second round SHA-3 candidates. We practically obtained (i) 72-bit near-colli...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-53A, Revision 1, Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans. The revised guide updates an earlier guide for assessing...

Conference: 2010 Electronic Voting Technology Workshop/ Workshop on Trustworthy Elections (EVT/WOTE '10) Abstract: The term "end-to-end verifiability" has been used over the past several years to describe multiple voting system proposals. The term has, however, never been formally defined. As a result, its meaning tends to change from voting system to voting system. We propose a definition for end-to-end verifia...

Conference: First International Conference on Cryptology and Information Security in Latin America, LATINCRYPT 2010 Abstract: Hamsi is one of the second round candidates of the SHA-3 competition. In this study, we present non-random differential properties for the compression function of Hamsi-256. Based on these properties, we first demonstrate a distinguishing attack that requires a few evaluations of the compression fun...

Journal: IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences Abstract: Feedback shift registers are basic building blocks for many cryptographic primitives. Due to the insecurities of Linear Feedback Shift Register (LFSR) based systems, the use of Nonlinear Feedback Shift Registers (NFSRs) became more popular. In this work, we study the feedback functions of NFSRs with...

Abstract: The objective of this document is to provide test requirements and test assertions that could be used to validate the compliance/conformance of two PIV components: PIV middleware and PIV card application with the specification in NIST SP 800-73-3, Interfaces for Personal Identity Verification.

Abstract: The purpose of this document is to provide an overview of the Security Content Automation Protocol (SCAP). This document discusses SCAP at a conceptual level, focusing on how organizations can use SCAP-enabled tools to enhance their security posture. It also explains to IT product and service vendor...

Conference: 4th International Conference on Electronic Voting (EVOTE2010) Abstract: We present Sigma ballots, a new type of ballot to be used in secure elections. Sigma ballots use the random order of candidates introduced by Pret a Voter, combined with the confirmation codes of Scantegrity II. These ballots can be produces by a DRE machine with a slightly modified VVPAT, or can be...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-34, Rev. 1, Contingency Planning Guide for Federal Information Systems. This publication updates federal contingency planning practices by integrating risk management and system development life cycle considerati...

Journal: IT Professional Abstract: We analyzed data from the National Vulnerability Database (NVD). Designed and operated by the National Institute of Standards and Technology (NIST) with support from the Department of Homeland Security, the NVD provides fine-grained search capabilities of all publicly reported software vulnerabiliti...

Journal: International Journal of Next Generation Computing Abstract: Today’s computer systems face sophisticated attackers who combine multiple vulnerabilities to penetrate networks with devastating impact. The overall security of a network cannot be determined by simply counting the number of vulnerabilities. To accurately assess the security of networked systems, o...

Abstract: Web services are currently a preferred way to architect and provide complex services. This complexity arises due to the composition of new services and dynamically invoking existing services. These compositions create service inter-dependencies that can be misused for monetary or other gains. When a...

Abstract: Special Publication 800-53A, Revision 1 provides guidelines for developing security assessment plans and associated security control assessment procedures that are consistent with Special Publication 800-53, Revision 3, Recommended Security Controls for Federal Information Systems and Organizations,...

Abstract: This bulletin is written to assist federal departments and agencies to meet their information security training responsibilities. Determining who has significant responsibilities for information security is the crucial first step that allows an organization to focus its information security trainin...

Conference: 24th Annual IFIP WG 11.3 Working Conference on Data and Applications Security (DBSec 2010) Abstract: Authentication assurance level taxonomies that have been specified in many real-world smart identity token deployments do not fully reflect all the security properties associated with their underlying authentication mechanisms. In this paper we describe the development and application of a new metho...

Abstract: NIST Special Publication 800-73-3 introduces the ability to store retired Key Management Keys within the Personal Identity Verification (PIV) Card Application on a PIV Card. This paper complements SP 800-73-3 by providing some of the rationale for the design of the mechanism for storing retired Key...

Journal: Crossroads Abstract: Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction. However, the security readiness of cloud computing is commonl...

Journal: Computer (IEEE Computer) Abstract: Role based access control (RBAC) is a popular model for information security. It helps reduce the complexity of security administration and supports the review of permissions assigned to users, a feature critical to organizations that must determine their risk exposure from employee IT system access...

Abstract: This publication assists organizations in understanding the purpose, process, and format of information system contingency planning development through practical, real-world guidelines. This guidance document provides background information on interrelationships between information system contingenc...

Conference: 9th International Symposium on Experimental Algorithms (SEA 2010) Abstract: A new technique for combinational logic optimization is described. The technique is a two-step process. In the first step, the non-linearity of a circuit – as measured by the number of non-linear gates it contains – is reduced. The second step reduces the number of gates in the linear components of...