Search Publications

Displaying 1001 - 1025 of 1510

Status Report on the First Round of the SHA-3 Cryptographic Hash Algorithm Competition

September 23, 2009

Author(s)

Andrew R. Regenscheid, Ray A. Perlner, Shu-jen H. Chang, John M. Kelsey, Mridul Nandi, Souradyuti Paul

The National Institute of Standards and Technology is in the process of selecting a new cryptographic hash algorithm through a public competition. The new hash algorithm will be referred to as SHA-3 and will complement the SHA-2 hash algorithms currently

Recommendation for EAP Methods Used in Wireless Network Access Authentication

September 17, 2009

Author(s)

Lidong Chen, Katrin Hoeper

This Recommendation specifies security requirements for authentication methods with key establishment supported by the Extensible Authentication Protocol (EAP) defined in IETF RFC 3748 for wireless access authentications to federal networks.

Recommended Security Controls for Federal Information Systems and Organizations [includes updates through 9/14/2009]

September 14, 2009

Author(s)

Ronald S. Ross

[Superseded by NIST SP 800-53 Rev. 3 (August 2009 w/updates through 5/1/2010): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=903280] The objective of NIST SP 800-53 is to provide a set of security controls that can satisfy the breadth and

Recommendation for Pair-Wise Key Establishment Schemes Using Integer Factorization Cryptography

August 28, 2009

Author(s)

Elaine B. Barker, Lidong Chen, Andrew R. Regenscheid, Miles E. Smid

[Superseded by SP 800-56B Rev. 1 (September 2014): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=916341] This recommendation specifies key establishment schemes using integer factorization cryptography, based on ANS X9 44, Key Establishment

Use of ISO/IEC 24727

August 14, 2009

Author(s)

Hildegard Ferraiolo, Teresa T. Schwarzhoff, William I. MacGregor, Hung Dang, Ketan Mehta

This document describes the use of ISO/IEC 24727 in enabling client-applications to access identity credentials issued by different credential issuers.

Recommended Security Controls for Federal Information Systems and Organizations [includes updates through 8/12/2009]

August 12, 2009

Author(s)

Ronald S. Ross

[Superseded by NIST SP 800-53 Rev. 3 (August 2009 w/updates through 9/14/2009): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=918661] The objective of NIST SP 800-53 is to provide a set of security controls that can satisfy the breadth and

Security and Privacy Issues in Agent-Based Location-Aware Mobile Commerce

August 12, 2009

Author(s)

Tom T. Karygiannis, Emmanouil Antonakakis

Mobile commerce and location-aware services promise to combine the conveniences of both online and offline bricks-and-mortar services. Just as agent-enabled desktop computers can be used to improve a users e-commerce experience, so can agent-enabled mobile

Recommended Security Controls for Federal Information Systems and Organizations

August 3, 2009

Author(s)

Ronald S. Ross

[Superseded by NIST SP 800-53 Rev. 3 (August 2009 w/updates through 8/12/2009): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=918662] The objective of NIST SP 800-53 is to provide a set of security controls that can satisfy the breadth and

Fast and Secure CBC Type MAC Algorithms

July 21, 2009

Author(s)

Mridul Nandi

The CBC-MAC, or cipher block chaining message authentication code, is a well-known method to generate message authentication codes. Unfortunately, it is not forgery-secure over an arbitrary domain. There are several secure variants of CBC-MAC, among which

Access Specification and Validation Framework for Secure Smart ID Cards Deployment

July 10, 2009

Author(s)

Ramaswamy Chandramouli, Stephen Quirolgico

Deployment of smart cards as identity tokens (Smart ID Cards) requires the support of an enterprise system called Identity Management System (IDMS) for collection, storage, processing and distribution of personal identity credentials. Secure configuration

Characterizing Padding Rules of MD Hash Functions Preserving Collision Security

June 29, 2009

Author(s)

Mridul Nandi

This paper characterizes collision preserving padding rules and provides variants of Merkle-Damgaard (MD) which are having less or no overhead costs due to length. We first show that suffix-free property of padding rule is necessary as well as sufficient

Digital Signature Standard (DSS)

June 25, 2009

Author(s)

National Institute of Standards and Technology (NIST), Elaine Barker

[Superseded by FIPS 186-4(July 2013): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=914162] The Standard specifies a suite of algorithms that can be used to generate a digital signature. Digital signatures are used to detect unauthorized

Static Analysis Tool Exposition (SATE) 2008

June 22, 2009

Author(s)

Vadim Okun, Romain Gaucher, Paul E. Black

The NIST SAMATE project conducted the first Static Analysis Tool Exposition (SATE) in 2008 to advance research in static analysis tools that find security defects in source code. The main goals of SATE were to enable empirical research based on large test

Guide to Enterprise Telework and Remote Access Security

June 16, 2009

Author(s)

Karen A. Scarfone, Paul Hoffman, Murugiah P. Souppaya

[Superseded by NIST SP 800-46 Rev. 2 (July 2016): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=921406] Many organizations employees and contractors use enterprise telework technologies to perform work from external locations. Most

Cyber Security Standards

June 15, 2009

Author(s)

Karen A. Scarfone, Daniel R. Benigni, Timothy Grance

The goal of cyber security standards is to improve the security of information technology (IT) systems, networks, and critical infrastructures. A cyber security standard defines both functional and assurance requirements within a product, system, process

Directions in Security Metrics Research

April 30, 2009

Author(s)

Wayne Jansen

More than 100 years ago, Lord Kelvin insightfully observed that measurement is vital to deep knowledge and understanding in physical science. During the last few decades, researchers have made various attempts to develop measures and systems of measurement

A Location-Based Mechanism for Mobile Device Security

March 31, 2009

Author(s)

Wayne Jansen, Vlad Korolev

While mobile handheld devices, such as cell phones and PDAs, provide productivity benefits, they also pose new risks. A vital safeguard against unauthorized access to a device s contents is authentication. This paper describes a location-based

Making the Case for EAP Channel Bindings

March 30, 2009

Author(s)

T. C. Clancy, Katrin Hoeper

In current networks that use EAP and AAA for authenticated admission control, such as WiFi, WiMAX, and various 3G internetworking protocols, a malicious base station can advertise false information to prospective users in an effort to manipulate network

The Cryptographic Hash Algorithm Family: Revision of the Secure Hash Standard and Ongoing Competition for New Hash Algorithms

March 25, 2009

Author(s)

Shirley M. Radack

This bulletin summarizes information disseminated in Federal Information Processing Standard (FIPS) 180-3, Secure Hash Standard; NIST Special Publication (SP) 800-107, Recommendation for Applications Using Approved Hash Algorithms, by Quynh Dang; SP 800

Surviving Insecure IT: Effective Patch Management

March 21, 2009

Author(s)

Simon Liu, D. Richard Kuhn, Hart Rossman

The amount of time to protect enterprise systems against potential vulnerability continues to shrink. Enterprises need an effective patch management mechanism to survive the insecure IT environment. Effective patch management is a systematic and repeatable

Performance Comparisons of BGP Anomaly Detection and Robustness Algorithms

March 17, 2009

Author(s)

Kotikalapudi Sriram, Douglas C. Montgomery, Oliver Borchert, Patrick Gleichmann, Okhee Kim

Computer Security Division 2008 Annual Report

March 16, 2009

Author(s)

Patrick D. O'Reilly

This annual report covers the work conducted within the National Institute of Standards and Technology's Computer Security Division during Fiscal Year 2008. It discusses all projects and programs within the Division, staff highlights, and publications.

Information Security Training Requirements: A Role- and performance-Based Model (Draft)

March 2, 2009

Author(s)

Mark Wilson, Kevin M. Stine, Pauline Bowen

This document and NIST Special Publication 800-50, Building an Information Technology Security Awareness and Training Program describe the following key approaches of an information security awareness and training program that federal departments and

Randomized Hashing for Digital Signatures

February 25, 2009

Author(s)

Quynh H. Dang

NIST-approved digital signature algorithms require the use of an approved cryptographic hash function in the generation and verification of signatures. Approved cryptographic hash functions and digital signature algorithms can be found in FIPS 180-3

Recommendation for Applications Using Approved Hash Algorithms

February 25, 2009

Author(s)

Quynh H. Dang

[Superseded by SP 800-107 Rev. 1 (August 2012): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=911479] Cryptographic hash functions that compute a fixed- length message digest from arbitrary length messages are widely used for many purposes