Search CSRC

The following table summarizes publication reviews completed by the Crypto Publication Review Board, including links to announcements, received comments, the Board's initial decision proposal, and the final decision approved by NIST management. Also, see a list of publications currently under review and descriptions of the publication decision options—Reaffirm, Update, Revise, Convert, Withdraw. Latest updates: •1/6/26: Decision to update SP 800-56Ar3, reaffirm SP 800-56Br2, and revise SP 800-56Cr2. Completed Publication Reviews and Decisions (sorted by Final Decision, newest to...

Table 2 identifies and describes the decision options available for handling publications. The Crypto Publication Review Board will make its decision proposals and final recommendations to NIST management based on these options. Table 2. Publication Decision Options Publication Decision Option Description Standards (FIPS) NIST Special Publications Reaffirm The publication content is confirmed as current and remains unchanged. NIST determines the publication is current and needs no changes.  NIST adds "Publication is current as of ."...

The following table lists the ten Finalists of the lightweight crypto standardization process. Official comments on the Finalists should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the lwc-forum Google group subscribers will also be forwarded to the lwc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm. All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask...

NIST Testing Process DOs and DON'Ts of Testing

A multidisciplinary NIST initiative seeks to address the Covid-19 pandemic by analyzing the availability, effectiveness, accuracy, and privacy of automated contact tracing efforts. PEC team members have been participating, by studying privacy tradeoffs of widespread contact tracing applications and considering how privacy can be improved within these systems. 2021-January-26-28: NIST workshop Challenges for Digital Proximity Detection in Pandemics: Privacy, Accuracy, and Impact. The workshop was held to engage with the broader community. PEC team members helped organize the breakout session...

[Redirect to https://doi.org/10.6028/NIST.SP.1299] 

MagicMirror is a white-box fuzzing tool written mainly in Python 3 for Solidity Smart Contracts. It supports the detection of 9 popular security vulnerabilities. It is easy to use and provides various informative reports as output. MagicMirror is fast and can generally achieve high code coverage on many contracts. MagicMirror utilizes techniques that include constraint solving, random test generation, random state exploration, coverage and data dependency guided fuzzing, and combinatorial testing.  DOWNLOADS:  https://magic-mirror.gitbook.io/magicmi/ MagicMirror works on both Linux and...

Many security research efforts have focused on adults' perceptions and practices, leaving gaps in our understanding of youth perceptions and practices. To help fill this gap, our team explores the online security and privacy perceptions and practices of youth and influencing social factors from three perspectives: youth themselves, parents/guardians, and teachers/educators.   Publications Influences on Youth Online Privacy and Security Papers Youth understandings of online privacy and security: A dyadic study of children and their parents  - Olivia Williams, Yee-Yin Choong, &...

Validation Number: 145 Vendor: McAfee Product Name: McAfee Policy Auditor Product Major Version: 6 Product Version Tested: 6.5.0.263 Tested Platforms: Microsoft Windows 10 SP0 32-bit Microsoft Windows 10 SP0 64-bit Microsoft Windows Server 2012 R2 SP0 64-bit Red Hat Enterprise Linux 7 64-bit SCAP 1.3 Capabilities: Authenticated Configuration Scanner Common Vulnerabilities and Exposures (CVE) Option Validated Product   Vendor Provided SCAP Information...

As of November 7, 2020, the CMVP requires that all FIPS 140-2 and FIPS 140-3 module validation submissions include documentation justifying conformance to SP 800-90B if applicable. SP 800-90B, along with FIPS 140-3 Implementation Guidance documents (IGs) D.J, D.K, and D.O, outline the requirements for an entropy source to be included in a FIPS-approved cryptographic module. With the publication of SP 800-90C, the CMVP is also accepting submissions for Random Bit Generators. The associated IG is IG D.T.  The list of validated entropy sources can be found in the Entropy Source Validation...

The Entropy Validation Server Test System is the process by which a lab may submit all information around an entropy source to receive a validation. This is done by interacting with the Web API offered by the Entropy Validation Server. For information on the protocol, reporting issues, and requesting access, view the GitHub page: https://github.com/usnistgov/esv-server. The same server also accepts submissions for Random Bit Generators demonstrating conformance to SP 800-90C.  The protocol is based on ACVP. Information on that can be found here: Automated Cryptographic Validation Testing....

June 26, 2026 ESV Document Updates An update to the Random Bit Generator (RBG) Report Template v1.2 has been published. May 7, 2026 ESV Updates The CMVP is now accepting submissions justifying conformance of a random bit generator to SP 800-90C. There are updates to the documents on the Entropy Validation Documents page, adding the RBG Report Template v1.0.  March 12, 2025 ESV Document Updates New Public Use Document v1.2 and Entropy Assessment Report v1.2 templates are available. June 25, 2024 ESV Document Updates There are updates to the documents on...

A workshop was held on April 27-29th, 2021 to discuss entropy validations. The slides and recording from the workshop are available on the NIST Events page: https://www.nist.gov/news-events/events/2021/04/sp-800-90b-entropy-source-validation-workshop.

ESV Guidelines and Templates Entropy Assessment Report Template v1.2 is a document to aid in writing entropy assessment reports for all entropy sources. The template is not required, but is recommended to ensure that all requirements from SP 800-90B and associated IGs are covered in the report. The template is available for edits, so labs may customize the colors, branding, or content if desired. Entropy Validation Submission Guidelines outlines the steps required to submit an entropy source to the CMVP through the Entropy Source Validation Test Server. Credentials must be requested...

ATTENTION: The Project Lead is no longer at NIST. Inquiry responses may be delayed.   NIST SP 800-216, Recommendations for Federal Vulnerability Disclosure Guidelines, is based on the policies and processes shown in the figure below. Minimal changes have been made to support vulnerability management at the local and federal levels.

The [email protected] mailing list is used for announcements and questions about the "Masked Circuits" project (formerly known as the single-device track of the threshold cryptography project). To subscribe: send an mail to [email protected]. Upon receiving an automatic response message, click the "Join" link inside that email to confirm your subscription request. If having difficulty, send a request instead to "masked-circuits (at) nist (dot) gov". We will then manually add your email address. To unsubscribe: send an email to: [email protected]. The...

Subscribing to the PEC-Forum The [email protected] mailing list was created to share announcements and questions about the "Privacy-Enhancing Cryptography" (PEC) project. Only subscribed members can send email to the mailing list. Please note that this mailing list should not be used for direct promotion of commercial products. To subscribe, please send an mail to [email protected]. You will receive a response message. Click the "Join" link inside that email to confirm your subscription request. To unsubscribe, please send an email to:...

MPTC-forum for publicly accessible messages: The [email protected] mailing list was created for public announcements and public conversation about the NIST Multi-Party Threshold Cryptography project. Messages: The MPTC-forum is an unmoderated mailing list; messages sent to this list are immediately distributed to all the addresses on the list, and are by default made publicly available via the email archive. Only members are allowed to post messages to the list, by sending an email to [email protected], but anyone can subscribe to become a member of the list. Email archive:...

/CSRC/media/Projects/olir/documents/submissions/WIP_Framework_v_1_1_to_800_53_Rev5.xlsx /CSRC/media/Projects/olir/documents/submissions/WIP_Framework_v_1_1_to_800_53_Rev5.xlsx /CSRC/media/Projects/olir/documents/submissions/SP800-82-Rev-2-to-SP800-53-Rev-4.xlsx /CSRC/media/Projects/olir/documents/submissions/WIP_Framework_v_1_1_to_800_53_Rev5.xlsx /CSRC/media/Projects/olir/documents/submissions/SP800-177-Rev-1-to-SP800-53-Rev-4.xlsx...

This page uses Google Forms; if the speaker request form does not load, please complete the RMF Team Speaker Request (pdf) and submit to [email protected]. Loading…  

Fireside Chat: Complexity is the new Cyber Adversary The cascading risk that made Lehman Brothers infamous for accelerating the global financial crisis or the Northeast Power Outage that disabled parts of US and Canada in 2003 exemplify how counterparty risk could turn a single breach into a disastrous systemic failure. Cyber risks face similar consequences. They are not enabled simply by individual cyber vulnerabilities, but by the Complex Systems-of-Systems they inhabit. Composed of legacy and new HW, SW and IoT elements connected by myriad channels, haphazardly integrated over many years,...

Fundamental background papers These papers established much of the basis for today's interest in combinatorial methods for testing and assurance.  The first one provided empirical evidence, across a range of domains, that most failures are triggered by one or two factors interacting, with progressively fewer by three or more factors.  Failures involving more than six factors were not seen, and have not been found since.  Consequently, covering all 5-way or 6-way combinations can be thought of as "pseudo exhaustive" or "effectively exhaustive" since they cover all, or nearly all, inputs...

Our conference and journal papers on assured autonomy and explainable AI.  We try to include links to the full papers, but for those not yet linked, please contact us for a copy:  [email protected].  Papers 2025 Lanus, E., Lee, B., Chandrasekaran, J., Freeman, L. J., Raunak, M. S., Kacker, R. N., & Kuhn, D. R. (2025, March). Data frequency coverage impact on ai performance. In 2025 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) (pp. 258-267). IEEE. Wei, Q., Sikder, F., Feng, H., Lei, Y., Kacker, R., & Kuhn, R. (2025). SmartExecutor:...

Blockmatrix functions have been integrated with Hyperledger Fabric, making it possible to use Hyperledger in a broader range of applications.  Applications that currently use Hyperledger Fabric will be able to function without change, with blockmatrix components providing distributed ledger functions in a transparent manner.  To support privacy requirements for deleting private user information, data blocks containing PII can be deleted offline, or functions can be added to the application with appropriate access control for administrators or users as determined by the organization.  -...