Search CSRC

Abstract: Mars, RC6, Rijndael, Serpent and Twofish were selected as finalists for the Advanced Encryption Standard (AES). To evaluate the finalists’ suitability as random number generators, empirical statistical testing is commonly employed. Although it widely believed that these five algorithms are indeed ra...

Abstract: In this bulletin, the term “active content” is used in its broadest sense to refer to electronic documents that are able to automatically carry out or trigger actions without the intervention of a user. Examples of active content include PostScript documents, Java applets, JavaScript, word processin...

Abstract: A workshop was held at the National Institute of Standards and Technology (NIST) on February 10-11, 2000 to examine public key-based key establishment techniques that are currently available and to discuss the approach to the development of a Key Management Standard for Federal Government use.

Abstract: This bulletin summarizes a new ITL document, NIST Special Publication (SP) 800-21, Guideline for Implementing Cryptography in the Federal Government. That publication provides guidance to federal agencies on selecting cryptographic controls to protect sensitive unclassified information. The guidelin...

Abstract: This standard specifies a suite of algorithms which can be used to generate a digital signature. Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition, the recipient of signed data can use a digital signature in provin...

Conference: 15th Annual Computer Security Applications Conference, 1999 (ACSAC '99) Abstract: Decoupling authorization logic from application logic allows applications with fine-grain access control requirements to be independent of a particular access control policy and from factors that are used in authorization decisions as well as access control models, no matter how dynamic those polici...

Abstract:

Abstract: CSPP provides the guidance necessary to develop compliant Common Criteria protection profiles for near-term, achievable, security baselines using commercial off-the-shelf (COTS) information technology. CSPP accomplishes this purpose by:--describing a largely policy-neutral, notional information syst...

Abstract:

Abstract: The purpose of this document is to provide guidance to Federal agencies on how to select cryptographic controls for protecting Sensitive Unclassified1 information. This document focuses on Federal standards documented in Federal Information Processing Standards Publications (FIPS PUBs) and the crypt...

Conference: Fourth ACM Workshop on Role-Based Access Control (RBAC '99) Abstract: The Role Based Access Control (RBAC) model and mechanism have proven to be useful and effective. This is clear from the many RBAC implementations in commercial products. However, there are many common examples where access decisions must include other factors, in particular, relationships between en...

Abstract: The selective application of technological and related procedural safeguards is an important responsibility of every Federal organization in providing adequate security to its electronic data systems. This publication specifies two cryptographic algorithms, the Data Encryption Standard (DES) and the...

Conference: 22nd National Information Systems Security Conference Abstract: The Proceedings of the 22nd National information Systems Security Conference (NISSC), held October 18-21, 1999, in Arlington, Virginia.

Abstract: Mobile agent technology offers a new computing paradigm in which a program, in the form of a software agent, can suspend its execution on a host computer, transfer itself to another agent-enabled host on the network, and resume execution on the new host. The use of mobile code has a long history dat...

Journal: Journal of Research of the National Institute of Standards and Technology Abstract: In 1997, the National Institute of Standards and Technology (NIST) initiated a process to select a symmetric-key encryption algorithm to be used to protect sensitive (unclassified) Federal information in furtherance of NIST’s statutory responsibilities. In 1998, NIST announced the acceptance of 15 c...

Abstract: The National Institute of Standards and Technology (NIST) Modes of Operation Validation System for the Triple Data Encryption Algorithm (TMOVS) specifies the procedures involved in validating implementations of the Triple DES algorithm in ANSI X9.52 - 1998, Triple Data Encryption Algorithm Modes of...

Abstract: Effective intrusion detection capability is an elusive goal, not solved easily or with a single mechanism. However, mobile agents go a long way toward realizing the ideal behavior desired in an Intrusion Detection System (IDS). This report is an initial foray into the relatively unexplored terrain o...

Abstract:

Journal: IEEE Communications Magazine Abstract: Electronic commerce over the Internet is now tens of billions of dollars per year and growing. This article describes how objects used in EC can be located and protected from unauthorized access. It discusses the three kinds of EC: customer interactions with a business, business interactions with ot...

Abstract: One of the criteria used to evaluate the Advanced Encryption Standard candidate algorithms was their demonstrated suitability as random number generators. That is, the evaluation of their output utilizing statistical tests should not provide any means by which to computationally distinguish them fro...

Abstract:

Abstract:

Abstract:

Abstract:

Journal: ACM Transactions on Information and System Security Abstract: This paper describes NIST's enhanced RBAC model and our approach to designing and implementing RBAC features for networked Web servers. The RBAC model formalized in this paper is based on the properties that were first described in Ferraiolo and Kuhn [1992] and Ferraiolo et al. [1995], with adjustme...