Search CSRC

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated.   The Program Review for Information Security Assistance (PRISMA) project was last updated in 2007; NIST Interagency Report (IR) 7358 and the corresponding PRISMA tool continue to serve as useful resources for high-level guidance and as a general framework, but may not be fully consistent with changes to requirements, standards and guidelines for securing systems. Option two of a PRISMA review focuses on the strategic aspects and the technical...

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated.   The Program Review for Information Security Assistance (PRISMA) project was last updated in 2007; NIST Interagency Report (IR) 7358 and the corresponding PRISMA tool continue to serve as useful resources for high-level guidance and as a general framework, but may not be fully consistent with changes to requirements, standards and guidelines for securing systems. The PRISMA review is based upon five levels of maturity: policy, procedures,...

ARCHIVED PROJECT: This project is no longer being supported. The content is no longer being updated, and the information may be outdated.   The Program Review for Information Security Assistance (PRISMA) project was last updated in 2007; NIST Interagency Report (IR) 7358 and the corresponding PRISMA tool continue to serve as useful resources for high-level guidance and as a general framework, but may not be fully consistent with changes to requirements, standards and guidelines for securing systems. Download

ARCHIVED: The NIST HIPAA Security Rule Toolkit is no longer supported, and is provided here only for historical purposes. HIPAA Security Rule Toolkit The NIST HIPAA Security Toolkit Application is intended to help organizations better understand the requirements of the HIPAA Security Rule, implement those requirements, and assess those implementations in their operational environment. Target users include, but are not limited to, HIPAA covered entities, business associates, and other organizations such as those providing HIPAA Security Rule implementation, assessment, and compliance...

The SCAP Release Cycle Changes to SCAP impact a large number of organizations that manage content and provide SCAP Validated Products and Modules and SCAP-related services. A change to SCAP often results in considerable efforts to migrate products, content, and other capabilities to the new SCAP revision. To mitigate risks relating to level-of-effort, timing, and specification changes, revisions to SCAP are managed according to a coordinated process. The following work flow process addresses these concerns. The SCAP release cycle defines a process for managing change relating to SCAP and the...

SCAP Checklists Security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications. SCAP Enumeration and Mapping Data Feeds SCAP related reference data for tool developers, integrators and SCAP Validated Product users.

SCAP must evolve continuously to meet the changing needs of the community. As a result, multiple versions of SCAP may be available at any given time. The following list presents the versions that are currently available. The current effective version is SCAP 1.3. Protocol SCAP: Security Content Automation Protocol Version: 1.4 (IPD) Status: IPD (Initial Public Distribution) Specification: NIST SP 800-126 Rev. 4 Annex: NIST SP 800-126 Rev. 4 Annex   SCAP: Security Content Automation Protocol Version: 1.3 Status: Final Specification: NIST SP 800-126 Rev. 3 Annex: NIST SP 800-126 Rev....

The SCAP community is a public/private partnership consisting of interested parties from industry, research and educational institutions, and government that are working to advance automation and standardization of technical security operations. Involvement in SCAP extends to email-based discussion lists, conferences, and various technical working groups sponsored by a variety of organizations. SCAP Email Discussion Lists SCAP Discussion List (View and Subscribe) The SCAP team at NIST maintains a moderated discussion list that users can post to, regarding the Security Content Automation...

The Least Version Principle The least version principle is designed to address which specification version to use when maintaining SCAP content. Under this principle, content is expressed using the minimum specification version, in a series of minor releases, that is necessary to properly address the content's purpose or use-case. This allows for the broadest support within products, while reducing the content maintenance burden that would be required to maintain revisions of content for multiple specification versions.

The following memoranda provide official guidance relating to the USGCB initiative: September 15, 2010 CIO Council Memo May 7, 2010 CIO Council Memo Additional Memoranda OMB Memo M-07-11 OMB Memo M-07-18 OMB Memo 19 Dec OMB Memo M-08-22

2017.01.27 - Microsoft Virtual PC Windows 7 32-bit VHD (USGCB-Windows7-VPC-x86-1.1.x.0-20110124.zip) - End of Life (EOL). This VHD is no longer supported and is unavailable. 2015.04.20 - USGCB SCAP 1.2 Content Final Release for Microsoft Windows XP, Windows Vista, Windows 7, Windows XP Firewall, Windows Vista Firewall, Windows 7 Firewall, Internet Explorer 7, and Internet Explorer 8 posted. 2015.02.25 - USGCB SCAP 1.2 Content Release Candidate 1 for Microsoft Windows XP, Windows Vista, Windows 7, Windows XP Firewall, Windows Vista Firewall, Windows 7 Firewall, Internet Explorer 7, and...

The purpose of the United States Government Configuration Baseline (USGCB) initiative is to create security configuration baselines for Information Technology products widely deployed across the federal agencies. Formal definitions of these baseline settings, as well as detailed documentation relating to the settings are provided in the following sub-pages. These pages also provide the supporting reference material for implementing and verifying USGCB settings on target systems. The following list represents the currently available USGCB content, grouped by the product vendor for which the...

The United States Government Configuration Baseline (USGCB) - Disclaimer Disclaimer for Microsoft Content Do not attempt to implement any of the settings without first testing them in a non-operational environment. These recommendations have only been tested on Windows 7 Ultimate 32-bit, Windows 7 Ultimate 64-bit, Windows 7 Enterprise x86, and Windows 7 Enterprise x64. These settings may be applicable to other Windows systems and service packs; however, NIST has not tested other Windows based systems with these settings. Please see the National Checklist Program (NCP) website for...

The following is a list of algorithms with example values for each algorithm. This list may not always accurately reflect all Approved* algorithms. Please refer to the actual algorithm specification pages for the most accurate list of algorithms. Encryption - Block Ciphers Visit the Block Cipher Techniques Page FIPS 197 - Advanced Encryption Standard (AES) AES-AllSizes AES-128 AES-192 AES-256 SP 800-67 - Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher TDES FIPS 185 - Escrowed Encryption Standard containing the Skipjack algorithm Skipjack...

NIST S/MIME Activities NIST has developed a NIST SP 800-49, Federal S/MIME V3 Client Profile for security and interoperability based on IETF specifications. The profile includes all mandatory features of the (S/MIME V3) IETF RFCs (RFCs 2630 through 2634) with the EXCEPTION that implementation of RFC 2631 Diffie-Hellman Key Agreement cryptographic algorithm mandated in IETF RFC 2630 is NOT required. In addition, the profile mandates certain optional features required for interoperability and security in secure email products. The primary audience is federal agencies, but the profile may be...

Some content from historical NIST crypto projects is included here: Advanced Encryption Standard (AES) Development Effort

The circuit files with the straight-line programs (SLPs) are stored in our GitHub page, here: https://github.com/usnistgov/Circuits/tree/master/data/slp AES implementations The AES Circuits repository on GitHub is more comprehensive and updated more frequently. AES S-Box circuits added in 2026 The following are selected examples of AES circuits over the basis {AND, XOR, XNOR}. Metrics of interest: A (#AND), AD (AND depth), G (#Gates), GD (Gate depth). In one table, "Tuple Metric" (1st column) indicates a sequence of metrics for which the referenced circuit is a good representative...

Publications:  2023: M. Sonmez Turan. Optimizing implementations of Boolean Functions. 8th International Workshop on Boolean Functions and their Applications (BFA). Also at ia.cr/2024/133 2022: M. Sonmez Turan. New Bounds on the Multiplicative Complexity of Boolean Functions. 7th International Workshop on Boolean Functions and their Applications (BFA). Also at ia.cr/2022/1077 2021: M. Sonmez Turan, and R. Peralta, On the Multiplicative Complexity of Cubic Boolean Functions. ia.cr/2021/1041 2020: Calik, C., Turan, M.S. & Peralta, R. Boolean functions with multiplicative complexity 3 and...

In March 2019, NIST received 57 submissions to be considered for standardization. The first round of the NIST lightweight cryptography standardization process began with the announcement of 56 Round 1 Candidates in April 2019 and ended in August 2019.   The status report on the first round is available here. The following table lists the Round 1 Candidates: History of Updates                                              Download all Zip Files (53 MB) does not include IP Statements Candidate Algorithm Information Submitters Comments ACE Zip File...

The second round of the NIST lightweight cryptography standardization process began when NIST announced the 32 Round 2 Candidates in August 2019. Round 2 concluded when the finalists were announced in March 2021. The status report on the second round is available here. The following table lists the Round 2 Candidates:   History of Round 2 Updates Download all Round 2 Zip Files (96 MB)    Candidate Algorithm Information Submitters Comments ACE Zip File (2MB) Specification Changelog Algorithm Update (Sep 2020) Website...

lwc-forum A [email protected] email mailing list has been established for dialogue regarding NIST's Lightweight Cryptography project. It is an unmoderated mailing list; messages addressed to this list are immediately distributed to all the addresses on the list. Only members are allowed to post messages to the list; however, anyone who wishes to do so may add themselves to the list.  To join: mailto:[email protected] You will receive a response message from [email protected].  Please click the "Join" link inside that email to confirm your...

Short URL: https://csrc.nist.gov/pqc-standardization FIPS 203, FIPS 204, and FIPS 205, which specify algorithms derived from CRYSTALS-Dilithium, CRYSTALS-KYBER, and SPHINCS+, were published August 13, 2024. FALCON was also selected and will be published in FIPS 206 (in development). See NIST IR 8413, Status Report of the Third Round of the NIST Post-Quantum Cryptography Standardization Process. HQC was selected for standardization on March 11, 2025. See NIST IR 8545, Status Report on the Fourth Round of the NIST Post-Quantum Cryptography Standardization Process. Additional Digital...

Official comments on the First Round Candidate Algorithms should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to [email protected] The...

Official comments on the Second Round Candidate Algorithms should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to [email protected] The...