# Tag Info

12

The security level of an elliptic curve group is approximately $\log_2{0.886\sqrt{2^n}}$. You can use this to approximate the security level of a $n$-bit key, eg: $\log_2{0.886\sqrt{2^{571}}} = 285.32537860389294$ The real computation (at least for curves over a finite field defined by a prime $p$) is $\log_2{\sqrt{\pi/4}\sqrt{ℓ}}$, where $ℓ$ is the ...

6

The previous answer has the correct formula for estimating the security level of prime field elliptic curves. However, the table seems to just list the closest Koblitz curve sizes used, as Richie Frame points out. If you computed the actual security strength of the curves in question, you would not end up with exactly the values in the left column. For ...

4

By using the definition of $n$ bits of full entropy, NIST is abstracting away from the definition of a NRBG (or TRNG). They are basically trying to establish a minimum requirement for the quality of the random number generator, without going into the specifics on how this can be achieved. Basically this is NIST's way of saying: if we specify $n$ bits of full ...

4

"Entropy" is more accurately defined, in cryptography, as "that which the attacker does not know". For instance, suppose that every day you take all rates at the closure of the New York stock exchange, and hash them with SHA-256. The resulting value is very unpredictable (otherwise you could become very rich), so, from a "physics" point of view, there is a ...

4

It you need a deterministically derived key for AES, the DRBG algorithms of NIST SP 800-90A are suitable, and their output is directly usable as an AES key. An example use case is when computing an AES session key from a longer-term master key, and the nonce corresponding to that session. AES will expand its key (128, 192 or 256-bit) to 128-bit subkeys (one ...

4

The NIST source you link to is SP 800-90B. If you look at the other two publications in the series: 90A and 90C, you can find explanations of how you can use a TRNG to instantiate a DRBG or requirements on how to condition the entropy. Here is what section 7.1 of 90A says about entropy input to a DRBG: Ideally, the entropy input will have full entropy; ...

3

The reason NIST chose one algorithm out of the five AES finalists, even though all of them were pretty well-respected (and some were, at the time, considered likely to be more secure then Rijndael) is because NIST is a standards body, and the whole point of the AES project was to find a standard algorithm. The issue with approving lots of algorithms is that ...

2

The answer is simple. AES is in itself a pseudorandom function, so an output from a single block encryption will produce 128-bits of pseudorandom numbers. Now to use AES to generate longer sequences, you will have to use a block-cipher mode that lets you do the same. Here is a small list of a few very popular modes ment for PRNGs: Counter(CTR): Counter ...

2

My question is how many more rounds would they have to use to keep this security margin on AES (other then adding a hash to AES 256 key schedule)? When AES was standardized, the best known attack (pdf, page 19) in terms of rounds broken was a related key attack that broke 9/14 rounds of AES-256. The best attack on AES-128 broke 7/10 rounds. Currently, ...

2

To my knowledge, NIST has not really decided or announced anything about successors to ECC. However, they do run workshops and such on post-quantum cryptography, so when the time is right something will probably move towards standardization. NSA, on the other hand, recently announced that they will soon push for a post-quantum system, going so far as to say ...

2

What is its signature length ? Depends on what algorithms you use, but with ECDSA the signature length is twice the length of the order of the base point. For P-521 that's 1042 bits, or 132 bytes when using whole bytes for each part. For E-521 it's 1038 bits or 130 bytes. How is it better ? The design criteria for E-521 are stated in A note on ...

2

http://csrc.nist.gov/groups/STM/cavp/documents/aes/AESAVS.pdf "... specifies the procedures involved in validating implementations of the Advanced Encryption Standard (AES) algorithm in FIPS 197 : Advanced Encryption Standard. The AESAVS is designed to perform automated testing on Implementations Under Test (IUTs). This publication provides the basic design ...

2

I'm not sure I got your question right, but it seems to me you are asking about modular reductions modulo $p=2^{192}-2^{64}-1$. If so, this answer from poncho, that I should have searched before writing this answer, might interests you. Note that in the following the choice of the base doesn't matter. If we have to reduce $2^{192} \mod{p}$ you can just ...

1

Twofish and Serpent do not have any published non theoretical successful attacks (resulting in a complete break) so at this point in time they are considered secure. AES was chosen because the people making the decisions at NIST felt it made the best decisions (as far as the Rijndael spec goes) of making trade offs between security, speed, computing ...

1

Except if you are picky with updates of references, there is such standard. DSA, RSA, ECDSA-$F_p$, ECDSA-$F_{2^n}$, are approved by ETSI TS 102 176-1 V2.1.1 (2011-07) (Electronic Signatures and Infrastructures (ESI); Algorithms and Parameters for Secure Electronic Signatures; Part 1: Hash functions and asymmetric algorithms), which essentially ...

1

Please refer the document at NIST site pointing to the document (800-22-rev 1a ) updated on April 2010 (http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/SP800-22rev1a.pdf). The list of special published (SP) documents are available at (http://csrc.nist.gov/publications/PubsSPs.html) It involves some reading, but should get your answers. Since it ...

1

I would prefer to use standardized (like FIPS 140-2) secure random generator, since the whole point is to secure the encryption key. Of course, you might want to check this website for reference: http://www.cryptosys.net/rng_algorithms.html

1

@gammatester gave most of the answer, but he didn't address the last question: would this make HMAC the only NIST approved MAC? No, as of right now, the block cipher-based Message Authentication Codes CMAC and GMAC are also approved. In addition, if you use the approved mode CCM with a empty message, that's effectively a MAC over the Additional ...

1

You will find a list of Approved security functions (message authentication among them) here on the NIST website (FIPS 140-2 Annex A: Approved Security Functions): http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf Interestingly in this document #1 (Triple-DES) references FIPS 113, which leads me to believe the method in FIPS 113 is valid ...

1

The NIST site http://csrc.nist.gov/publications/PubsFIPSArch.html lists FIPS 113 as Withdrawn: Sep 2008. The Federal Register https://www.federalregister.gov/articles/2005/07/15/05-13992/proposed-withdrawal-of-ten-10-federal-information-processing-standards-fips gives a reason: FIPS 113, Computer Data Authentication, specifies an algorithm for ...

1

When NIST put together the table A.1, they accidentally used a 96 character alphabet for that last column, not a 94 character one. One way to see this is looking at the bottom most entry; they list that $log_2(b^{40}) \approx 263.4$, where $b$ is the alphabet size they used. If we solve for $b$, we get $b \approx 96.002...$.

Only top voted, non community-wiki answers of a minimum length are eligible