Search CSRC

Abstract: Due to the exhaustion of IPv4 address space, and the Office of Management and Budget (OMB) mandate that U.S. federal agencies begin to use the IPv6 protocol, NIST undertook the development of a guide to help educate federal agencies about the possible security risks during their initial IPv6 deploym...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-127, Guide to Securing WiMAX Wireless Communications: Recommendations of the National Institute of Standards and Technology. The publication, which was written by Karen Scarfone (formerly of NIST) and by Cyrus Ti...

Abstract: The Common Configuration Scoring System (CCSS) is a set of measures of the severity of software security configuration issues. CCSS is derived from the Common Vulnerability Scoring System (CVSS), which was developed to measure the severity of vulnerabilities due to software flaws. CCSS can assist or...

Abstract: Cryptographic keys are vital to the security of internet security applications and protocols. Many widely-used internet security protocols have their own application-specific Key Derivation Functions (KDFs) that are used to generate the cryptographic keys required for their cryptographic functions....

Abstract: This Recommendation specifies techniques for the derivation of master keys from passwords or passphrases to protect stored electronic data or data protection keys.

Abstract: This study--prepared for the NIST Program Office by RTI International--is a retrospective economic impact analysis of role-based access control (RBAC), one of the principal approaches for managing users' access to information technology resources. RBAC is arguably the most important innovation...

Journal: IT Professional Abstract: In this paper, free and open source software are discussed. Open source is an intellectual property destroyer. Nothing could be worse than this for the software business and the intellectual-property business. Microsoft has an official open source presence on the Web (www.microsoft.com/opensource),...

Journal: IT Professional Abstract: Using the analogy of an existing smart car, this paper explores Power to the Edge , where the edge is commercial mobile computing. The world is poised for a 5th Cycle of computer capability, this time focused on the burgeoning phenomena of mobile computing. This era may render the laptop obsolete. A...

Conference: 11th International Conference on Cryptology (INDOCRYPT 2010) Abstract: In this paper we propose a new sequential mode of operation – the Fast wide pipe or FWP for short – to hash messages of arbitrary length. The mode is shown to be (1) preimage-resistance preserving, (2) collision-resistance-preserving and, most importantly, (3) indifferentiable from a random oracle u...

Conference: 15th European Symposium on Research in Computer Security (ESORICS 2010) Abstract: The security risk of a network against unknown zero day attacks has been considered as something unmeasurable since software flaws are less predictable than hardware faults and the process of finding such flaws and developing exploits seems to be chaotic [10]. In this paper, we propose a novel secur...

Conference: 5th International Conference on Information Security and Cryptology (Inscrypt 2009) Abstract: ESSENCE is a family of cryptographic hash functions, accepted to the first round of NIST’s SHA-3 competition. This paper presents the first known attacks on ESSENCE. We present a semi-free-start collision attack on 31 out of 32 rounds of ESSENCE-512, invalidating the design claim that at least 24 ro...

Abstract: This bulletin summarizes the information presented in NISTIR 7497, Security Architecture Design Process for Health Information Exchanges (HIEs). The publication describes a systematic approach to designing a technical security architecture for the exchange of health information by building on common...

Abstract: This publication assists organizations in understanding the purpose, process, and format of information system contingency planning development through practical, real-world guidelines. This guidance document provides background information on interrelationships between information system contingenc...

Abstract: This report describes the use of combinatorial test methods to reduce the cost of testing for the Document Object Model Events standard while maintaining an equivalent level of assurance. More than 36,000 tests – all possible combinations of equivalence class values –were reduced by approximately a...

Abstract: This bulletin summarizes the information presented in NISTIR 7628, Guidelines for Smart Grid Cyber Security. The guidelines were developed as a consensus document by the Cyber Security Working Group (CSWG) of the Smart Grid Interoperability Panel (SGIP), a public-private partnership formed by NIST i...

In: Handbook of Information and Communication Security Abstract: Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents, which are violations or imminent threats of violation of computer security policies, acceptable use policies, or standard security practices. An i...

Abstract: A limitation to Cipher Block Chaining (CBC) mode, as specified in NIST Special Publication 800-38A, is that the plaintext input must consist of a sequence of blocks. Ciphertext stealing is a padding method in which the required padding bits are "stolen" from the penultimate ciphertext block. This ad...

Journal: Information Processing Letters Abstract: A Bloom filter is a space-efficient data structure used for probabilistic set membership testing. When testing an object for set membership, a Bloom filter may give a false positive. The analysis of the false positive rate is a key to understanding the Bloom filter and applications that use it. We s...

Journal: Computer (IEEE Computer) Abstract: The term trust has had a well understood definition for centuries. However after e-trust came along, and then cloud, where e-trust is not sufficient due to the non-touchability of a public cloud, the need to reconsider what trust means for a public cloud arises. This paper looks at the issues of thi...

Journal: IEEE Security & Privacy Abstract: This short piece is the guest editor intro for IEEE Security and Privacy Magazine for the September 2010 issue. This short piece introduces the topic and selected papers. Cyber-physical systems feature a tight combination of a system's computational and physical elements. Understanding how to assess...

Conference: 35th IEEE Conference on Local Computer Networks (LCN 2010) Abstract: In recent years, it has been a common practice to execute client authentications for network access inside a protective tunnel. Man-in-the-middle (MitM) attacks on such tunneled authentications have been discovered early on and cryptographic bindings are widely adopted to mitigate these attacks. In...

Abstract: Combinatorial testing can help detect problems like this early in the testing life cycle. The key insight underlying t-way combinatorial testing is that not every parameter contributes to every fault and most faults are caused by interactions between a relatively small number of parameters. This pub...

Journal: IT Professional Abstract: Cloud computing is an idea that's rapidly evolving. Still, the amount of money and attention devoted to this topic makes it seems sensible to discuss how ethicists view the kinds of changes in computing that are being called "the cloud." This department is part of a special issue on cloud computing.

Abstract: The purpose of this publication is to provide a systematic approach to designing a technical security architecture for the exchange of health information that leverages common government and commercial practices and that demonstrates how these practices can be applied to the development of HIEs. Thi...

Abstract: The purpose of this document is to provide information to organizations regarding the security capabilities of wireless communications using WiMAX networks and to provide recommendations on using these capabilities. WiMAX technology is a wireless metropolitan area network (WMAN) technology based upo...