Search CSRC

The following sections detail the Schematron rules for SCAP 1.4. SCAP Schematron Rules The SCAP Schematron Rules are ISO Schematron rules written to check many of the requirements documented in NIST SP 800-126 Rev 4. They are for informational purposes only; they do not supercede the requirements in the specification. The rules are subject to change at anytime. Instructions on how to use the resource are provided in the included scap-rules-readme.txt. Version: 1.4.0 Released: 12/11/2025 Download: SCAP 1.4 Schematron File

Redirect to https://csrc.nist.gov/news/2024/postquantum-cryptography-fips-approved

Link to https://csrc/media/Projects/post-quantum-cryptography/documents/selected-algos-2022/nist-pqc-license-summary-and-excerpts.pdf

This page organizes documentation related to the NIST First Call for Multi-Party Threshold Schemes [NIST IR 8214C] (2026). Previews Phase #3: On Sep-30 and Oct-{6,7,13}, 2026, TCPT3 (Threshold Call Preview Talks #3) hosts 24 preview talks. The technical scope is organized across two classes — Class N (NIST-specified primitives) and Class S (Special primitives not specified by NIST) — each with various categories of crypto-systems, as follows:   Sign PKE Symm KeyGen FHE ZKPoK Gadgets Class N N1 N2 N3 N4       Class S...

Date Received From 13 November 2025 WIZ 25 November 2025 U.S. Navy 6 January 2026 ISSA Special Interest Group on Cyber Resilience 15 January 2026 ESI / Carnegie Mellon University 16 January 2026 OpenPolicy 16 January 2026 NDIA 16 January 2026 MSP / Aethon Security   

Private Set Intersection (PSI) enables two (or more) parties, each with a private set, to identify which are the common elements across the sets, while not revealing information about the non-common elements. For example, two persons with privates lists of contacts can use PSI to determine which contacts they have in common. This is a very special case of Multiparty Computation (MPC), with well-known feasible solutions. More generally, a Private Set Operation (PSO) can relate to an arbitrary set operation, where the input sets remain private (i.e., beyond what each party [or coalition of...

Learn OSCAL Through an Immersive Online Escape Room Experience The NIST OSCAL Team is excited to share an immersive online escape room experience designed to help community members learn OSCAL in a hands-on, engaging way. Rather than traditional presentations or documentation walkthroughs, this escape room invites participants to actively apply OSCAL concepts in realistic scenarios. By solving challenges and progressing through the experience, users will gain a deeper, more practical understanding of how OSCAL supports modern security assessment and authorization workflows. The escape...

Official comments on the Third Round Candidates should be submitted using the "Submit Comment" link for the appropriate algorithm. Comments from the pqc-forum Google group subscribers will also be forwarded to the pqc-forum Google group list. We will periodically post and update the comments received to the appropriate algorithm.   All relevant comments will be posted in their entirety and should not include PII information in the body of the email message. Please refrain from using OFFICIAL COMMENT to ask administrative questions, which should be sent to [email protected]. The...

Combinatorial methods have the potential for enormous savings in chip verification and testing.  Additionally, quantitative measures of test completeness can be provided, going beyond current capabilities of conventional chip verification test methods. 

Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise's computing assets. CPE does not identify unique instantiations of products on systems, such as the installation of XYZ Visualizer Enterprise Suite 4.2.3 with serial number Q472B987P113. Rather, CPE identifies abstract classes of products, such as XYZ Visualizer Enterprise Suite 4.2.3, XYZ Visualizer Enterprise Suite (all versions), or XYZ Visualizer (all variations). IT management tools can collect information...

CPE 3.0 is the next major revision of Common Platform Enumeration (CPE), now in early development at NIST. This page tracks the effort and how to take part. For the current published version, see Common Platform Enumeration (CPE). About the CPE 3.0 effort CPE 2.3 has been in wide use for more than a decade. Implementation experience over that period, together with current security automation needs, has surfaced a set of issues worth addressing in a future version. The CPE 3.0 effort will evaluate how platforms and products are identified for current security automation use cases, including...

Cybersecurity works best when it works with people, not against them — and that's exactly what human-centered cybersecurity (HCC) is all about. The Human-Centered Technologies team at NIST is releasing a concept paper on HCC, and we want your input. Our goal is to build a shared understanding of what HCC really means, then chart a path toward practical guidelines and resources that organizations can actually use to make meaningful change by: Clarifying whether HCC is primarily an approach—measured by indicators of adoption and maturity—or an outcome—requiring other measures of success such...

Note 2026-07-31: This is an experimental table, subject to changes. It does not yet contains information about the 3rd phase of preview (to be added in October) Grid of Systems "Previewed" for Submission to the Threshold Call Updated on 2026-07-30 (including preview phases 1 and 2)   Amber PW...

OSCAL is organized in a series of layers that each provides a set of models.  A model represents an information structure supporting a specific operational purpose or concept. Each model is comprised of information structures that form an information model for each OSCAL model. This information model is then bound to multiple serialization formats (i.e., XML, JSON, YAML), which represent a concrete data model. Thus, a data model defines how to represent an OSCAL information model in a serialized format. While the syntax of each format differs, all formats for a given model represent the same...

Access the tools and libraries that support developing, converting, validating, and working with OSCAL content. This page includes developer utilities, APIs, command-line tools. OSCAL Tools and Libraries:  Converter utilities into JSON from XML and into XML from JSON Command line data conversion tool: OSCAL Java CLI A Java API for OSCAL CSX and XSLT OSCAL Tools 

This page provides resources for the OSCAL metaschema framework, which provides the modeling language and Java components used to generate and process OSCAL schemas and content across XML, Java, and YAML formats. For more information, please visit the official NIST OSCAL page. OSCAL Metaschema:  An OSCAL metaschema is a format-agnostic modeling language and framework to define the data structures and models utilize metaschemas for the definition fields. Metaschema modeling language - a language developed by NIST, used to generate a schema for a corresponding information model in a...

Discover official and community-maintained resources that support OSCAL. Here you will find the OSCAL GitHub repositories, the OSCAL Gitter Lobby, documentation, documentation, and other community websites to help you collaborate and stay connected with the OSCAL community. NIST OSCAL GitHub (public): https://www.github.com/usnistgov/OSCAL  and  https://www.github.com/usnistgov/oscal-content The OSCAL Github repository is the primary source for the NIST OSCAL project, containing the OSCAL models, schemas, documentation, examples, and development resources. It is the central collaboration...

Federal agencies and departments are required to comply with FIPS 140-1, Security Requirements for Cryptographic Modules. This involves the acquisition of validated cryptographic modules (which may be incorporated in a product/application) for protecting sensitive but unclassified data. Cryptographic modules are used to provide security services such as confidentiality, integrity, and authentication. FIPS 140-1 provides users with 1) a specification of security features that are required at each security level, 2) flexibility in choosing security requirements and environments, and 3) a guide...

Here are all the Agendas and Minutes for the 3 CSSPAB Meetings that were held in 1999.   March 1999 Agenda Minutes June 1999 Agenda Minutes September 1999 Agenda  Minutes If you have any questions or need information please e-mail Matt Scholl .    

NIST held a public workshop for the presentation and discussion of block cipher modes of operation. The papers, presentations, and discussions from that workshop are summarized in a workshop report. NIST received a number of public comments in response to its announcement of the "Modes of Operation" effort. Paper of Interest: IBM Patent Letter

(All files in .pdf format.)   March 2000 Agenda Meeting Minutes June 2000 Meeting Minutes June 2000 Workshop "Approaches to Measuring Security" Agenda  Summary from Day 1 September 2000 Agenda December 2000 Meeting Minutes   If you have any questions or need information, please e-mail Matt Scholl .  

This workshop focused on the security and interoperability requirements of the Federal government, the key establishment options available, and the planned development of a FIPS that will address those needs.  Federal Register Notice Background and Objectives Workshop Report Presentations Government User Perspective (Richard Guida, Treasury) Wireless Applications (Doug Rahikka, NSA) ANSI X9.42 (Sharon Keller, NIST) ANSI X9.44 (Burt Kaliski, RSA Security) ANSI X9.63 (Simon Blake-Wilson, Certicom) Internet Key Exchange (Sheila Frankel, NIST) TLS Protocol (Chris Hawk, Certicom)...

NIST held the Second Modes of Operation Workshop to continue to facilitate the analysis and development of new modes. The workshop was held to Present and discuss modes proposals Discuss technical comments on the NIST "Recommendation for Block Cipher Modes of Operation" Discuss of the next steps in the process and related issues The presentations, and discussions from the workshop are summarized in a workshop report. Legacy Presentations Selected Comments and Issues on the July, 2001 draft “Recommendation for Block Cipher Modes of Operation” Modes of Operation: Where do we go from...

March 2001 Agenda Meeting Minutes June 2001 Agenda Meeting Minutes December 2001 Agenda  Meeting Minutes   If you have any questions or need information please e-mail Matt Scholl .  

A key establishment scheme definition document and a key management guidance document are currently under development as discussed in the white paper.The workshop versions of the key establishment schemes document and the key management guideline were discussed. A report of the workshop will be available soon. The agenda and presentation slides are provided below. Comments have been received. A list of issues discussed at the workshop is also available. Welcome, History, etc. (notes) - Elaine Barker Key Establishment Schemes Document Overview - Miles Smid Key Establishment Schemes...