Search CSRC

Call for Proposals Each submitted algorithm, together with each submitted reference implementation and optimized implementation, must be made freely available for public review and evaluation purposes worldwide during the period of the post-quantum algorithm search and evaluation. The following signed statements will be required for a submission to be considered complete: 1) statement by the submitter, 2) statement by patent (and patent application) owner(s) (if applicable), and 3) statement by reference/optimized implementations' owner(s). Note that for the last two statements, separate...

Call for Proposals 4.A      Security The security provided by a cryptographic scheme is the most important factor in the evaluation. Schemes will be judged on the following factors: 4.A.1 Applications of Public-Key Cryptography NIST intends to standardize post-quantum alternatives to its existing standards for digital signatures (FIPS 186) and key establishment (SP 800-56A, SP 800-56B). These standards are used in a wide variety of Internet protocols, such as TLS, SSH, IKE, IPsec, and DNSSEC. Schemes will be evaluated by the security they provide in these applications, and in additional...

Call for Proposals 4.B      Cost As the cost of a public-key cryptosystem can be measured on many different dimensions, NIST will continually seek public input regarding which performance metrics and which applications are most important. If there are important applications that require radically different performance tradeoffs, NIST may need to standardize more than one algorithm to meet these diverse needs. 4.B.1 Public Key, Ciphertext, and Signature Size Schemes will be evaluated based on the sizes of the public keys, ciphertexts, and signatures that they produce. All of these may be...

Call for Proposals 4.C      Algorithm and Implementation Characteristics 4.C.1 Flexibility Assuming good overall security and performance, schemes with greater flexibility will meet the needs of more users than less flexible schemes, and therefore, are preferable. Some examples of “flexibility” may include (but are not limited to) the following: The scheme can be modified to provide additional functionalities that extend beyond the minimum requirements of public-key encryption, KEM, or digital signature (e.g., asynchronous or implicitly authenticated key exchange, etc.). It is...

The following sections detail the Schematron rules for SCAP 1.3. SCAP Schematron Rules The SCAP Schematron Rules are ISO Schematron rules written to check many of the requirements documented in NIST SP 800-126 Rev 3. They are for informational purposes only; they do not supercede the requirements in the specification. The rules are subject to change at anytime. Instructions on how to use the resource are provided in the included scap-rules-readme.txt. Version: 1.3.5 Released: 08/06/2020 Download: SCAP Schematron Package SHA-256:...

The following sections detail the Schematron rules for SCAP 1.2. SCAP Schematron Rules The SCAP Schematron Rules are ISO Schematron rules written to check many of the requirements documented in NIST SP 800-126 Rev 2. They are for informational purposes only; they do not supercede the requirements in the specification. The rules are subject to change at anytime. Instructions on how to use the resource are provided in the included readme.txt. Version: 1.2.6 Released: 12/16/2016 Download: SCAP Schematron Package SHA-1: BBFD29657FB9B9F3EB48A3D021817FBB1DB8E21D SHA-256:...

XCCDF Benchmark: XCCDF Sample for Cisco IOS XCCDF Sample for Cisco IOS Status: draft (as of 2004-10-07) Version: 0.12.1 Applies to: Cisco IOS Routers version 11.x Cisco IOS Routers version 12+   Contents 1. Introduction 2. Tailoring Values 2.1. IOS - line exec timeout value 2.2. Logging level for buffered logging 3. Rules 3.1. Management Plane Rules 3.1.1. IOS 11 - no IP finger service 3.1.2. IOS 12 - no IP finger service 3.1.3. Require exec session timeout on admin sessions 3.2. Control Plane Rules 3.2.1. Disable tcp-small-servers 3.2.2. Disable udp-small-servers...

- OCIL Schema - Element Dictionary Schema: OCIL Version: 1.0 Release Date: December 29, 2008 VERSION 1.0 The Open Checklist Interactive Language (OCIL) is a language to express a set of questions to be presented to a user and procedures to interpret responses to these questions for the purpose of developing security checklists. Although its intended domain of use is IT security, its generic nature allows for other applications. For instance, it could be used for authoring research surveys, academic course exams, and instructional walkthroughs. This document was originally developed by...

OCIL - The Open Checklist Interactive Language - Schema Element Dictionary - OCIL Schema - Element Dictionary Schema: OCIL Version: 1.1 Release Date: May 20, 2009 VERSION 1.1 The Open Checklist Interactive Language (OCIL) is a language to express a set of questions to be presented to a user and procedures to interpret responses to these questions for the purpose of developing security checklists. Although its intended domain of use is IT security, its generic nature allows for other applications. For instance, it could be used for authoring research surveys,...

The Applicability Language specification defines a standardized structure for forming complex logical expressions out of Well-formed Names (WFNs). These expressions, also known as applicability statements, are used to tag checklists, policies, guidance, and other documents with information about the product(s) to which the documents apply. For example, a security checklist for Mozilla Firefox 3.6 running on Microsoft Windows Vista could be tagged with a single applicability statement that ensures only systems with both Mozilla Firefox 3.6 and Microsoft Windows Vista will have the security...

The Dictionary specification defines the concept of a CPE dictionary, which is a repository of CPE names and metadata, with each name identifying a single class of IT product. The Dictionary specification defines processes for using the dictionary, such as how to search for a particular CPE name or look for dictionary entries that belong to a broader product class. Also, the Dictionary specification outlines all the rules that dictionary maintainers must follow when creating new dictionary entries and updating existing entries. CPE Dictionary Resources Release 2.3 CPE 2.3 Dictionary...

The Name Matching specification defines the procedures for comparing Well-formed Names (WFNs) to each other so as to determine whether they refer to some or all of the same products. CPE Name Matching Resources Name Matching CPE 2.3 Name Matching Resources (August 2011) Documentation: NISTIR 7696

The Naming specification defines the logical structure of Well-formed Names (WFNs), URI bindings, and formatted string bindings, and the procedures for converting WFNs to and from the bindings. CPE Naming Resources Release 2.3 CPE 2.3 Naming Resources (August 2011) XML Schema Files: [what is a schema?] CPE 2.3 Naming (XSD 1.0) Documentation: NISTIR 7695

The following products have been placed on the Removed Products List because they do not conform to the requirements of FIPS 201-2 effective since 9/05/14.   Note:  Validation of SP 800-73-1, SP 800-73-2 and SP 800-73-3 based PIV Middleware has been superseded by SP 800-73-4 (or higher) based PIV Middleware validation. All questions regarding the implementation and/or use of any PIV Middleware included in the validation list should first be directed to the vendor.    SP 800-73-3 PIV Middleware Validation List Certificate # Product Name Vendor Validation Date...

Windows Vista Content

CCE entries are currently assigned to configuration issues by members of the CCE Content Team and posted on the public CCE Web site. Operating system vendors are encouraged to coordinate with the CCE Content Team to have CCEs assigned to their configuration controls and/or new platforms. Please contact [email protected] for more information. Typically, a CCE Content Team Analyst first encounters a configuration issue in one of two ways: (1) The most common way an analyst encounters a configuration issue is a configuration guidance statement is in a resource document or audit tool. For example,...