# Tag Info

7

Plenty of ciphers come out of the USA from government research or selection competitions. AES and DES are examples. Indeed, the US is known from some crypto-related competitions that were/are ope to anyone and they surely will do ample of government research related to cyptology, but you need to be sure that you differ between “they selected it” and ...

4

By using the definition of $n$ bits of full entropy, NIST is abstracting away from the definition of a NRBG (or TRNG). They are basically trying to establish a minimum requirement for the quality of the random number generator, without going into the specifics on how this can be achieved. Basically this is NIST's way of saying: if we specify $n$ bits of full ...

4

"Entropy" is more accurately defined, in cryptography, as "that which the attacker does not know". For instance, suppose that every day you take all rates at the closure of the New York stock exchange, and hash them with SHA-256. The resulting value is very unpredictable (otherwise you could become very rich), so, from a "physics" point of view, there is a ...

3

It you need a deterministically derived key for AES, the DRBG algorithms of NIST SP 800-90A are suitable, and their output is directly usable as an AES key. An example use case is when computing an AES session key from a longer-term master key, and the nonce corresponding to that session. AES will expand its key (128, 192 or 256-bit) to 128-bit subkeys (one ...

3

The reason NIST chose one algorithm out of the five AES finalists, even though all of them were pretty well-respected (and some were, at the time, considered likely to be more secure then Rijndael) is because NIST is a standards body, and the whole point of the AES project was to find a standard algorithm. The issue with approving lots of algorithms is that ...

3

NIST SP800-131A (Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths, 2011) §4 specifies that the RNGs from ANSI X9.31 are disallowed after 2015, but as fgrieu notes this is a 3DES-based algorithm; the NIST specification does not explicitly mention the commonly-used AES variant. NIST does however recommend (but not mandate) ...

3

X9.31-based PRNGs as used in current practice (including in the Botan library) tend to be extensions of the generator of ANSI X9.31-1998 appendix A.2.4 (which designated purpose is as a submodule of a prime generator for RSA keys). This really is the PRNG of ANSI X9.17-1985 Appendix C (which designated purpose is generating DES keys), also described in ...

3

Actually, s is in CFB mode to handle transmission channels for the encrypted data that can add or drop individual bytes. In the olden times (say, the 70's), it was common to transmit data over serial channels, for example, RS-232. These channels were not perfect, and one common error we see is that if the transmitter sent 7 bytes, the receiver might get ...

2

I don't consider the following a complete answer, but it is a start, and best I can do with my very limited knowledge. I hope someone could fix it or improve it. These type of attacks are only possible against specific implementation of higher level protocols. I will start by describing an invalid-curve attack against a specific ECDH based protocol. ...

2

Your output already includes the relevant interpretation guidelines: The minimum pass rate for each statistical test with the exception of the random excursion (variant) test is approximately = 96 for a sample size = 100 binary sequences. The minimum pass rate for the random excursion (variant) test is approximately = 67 for a sample size = 71 binary ...

2

The sect curves are curves over a binary field. From SEC 2: Recommended Elliptic Curve Domain Parameters (chapter 3): The example elliptic curve domain parameters over $\mathbb{F}_{2^m}$ have been given nicknames to enable them to be easily identified. The nicknames were chosen as follows. Each name begins with sec to denote ‘Standards for Efficient ...

1

Twofish and Serpent do not have any published non theoretical successful attacks (resulting in a complete break) so at this point in time they are considered secure. AES was chosen because the people making the decisions at NIST felt it made the best decisions (as far as the Rijndael spec goes) of making trade offs between security, speed, computing ...

1

It is for the 1st version of 3DES which is only using the same key three times (3DES-EDE1) Which is equivalent to DES (I think they did that so you could use 3DES to exchange with someone using DES). There are 3 different versions (or ways of using DES). EDE3 is the strongest with 3 different keys being used.

1

I would prefer to use standardized (like FIPS 140-2) secure random generator, since the whole point is to secure the encryption key. Of course, you might want to check this website for reference: http://www.cryptosys.net/rng_algorithms.html

1

@gammatester gave most of the answer, but he didn't address the last question: would this make HMAC the only NIST approved MAC? No, as of right now, the block cipher-based Message Authentication Codes CMAC and GMAC are also approved. In addition, if you use the approved mode CCM with a empty message, that's effectively a MAC over the Additional ...

1

You will find a list of Approved security functions (message authentication among them) here on the NIST website (FIPS 140-2 Annex A: Approved Security Functions): http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf Interestingly in this document #1 (Triple-DES) references FIPS 113, which leads me to believe the method in FIPS 113 is valid ...

1

The NIST site http://csrc.nist.gov/publications/PubsFIPSArch.html lists FIPS 113 as Withdrawn: Sep 2008. The Federal Register https://www.federalregister.gov/articles/2005/07/15/05-13992/proposed-withdrawal-of-ten-10-federal-information-processing-standards-fips gives a reason: FIPS 113, Computer Data Authentication, specifies an algorithm for ...

1

When NIST put together the table A.1, they accidentally used a 96 character alphabet for that last column, not a 94 character one. One way to see this is looking at the bottom most entry; they list that $log_2(b^{40}) \approx 263.4$, where $b$ is the alphabet size they used. If we solve for $b$, we get $b \approx 96.002...$.

Only top voted, non community-wiki answers of a minimum length are eligible