Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [nist]

The National Institute of Standards and Technology (NIST) is a U.S. federal agency that works with industry to develop and apply technology, measurements, and standards.

Filter by
Sorted by
Tagged with
1 vote
0 answers
10 views

What’s the relationship between P-256 and Dual EC DRBG?

It is said that Dual EC DRBG has a backdoor given the values of the curve. Hence some people do not trust it. With that in mind, some people also distrust NIST P-256 Curve. Why? Is it purely because ...
user avatar
0 votes
0 answers
11 views

How many number of sequences (sample size) should be selected for randomness testing of bock cipher with 256 bits key and block length?

I am working on randomness testing of block cipher. I have gone through the NIST two papers of randomness testing of AES candidate algorithm, links are given below https://csrc.nist.gov/csrc/media/...
user avatar
1 vote
1 answer
46 views

About two sequence conversion methods in NIST 800-90B

I am reading the 800-90B document. In particular, I'm looking at Chapter 5, the chapter on checking that samples conform to IID. There are 11 tests such as Excursion Test Statistic and Number of ...
user avatar
  • 99
0 votes
1 answer
46 views

Alternative to CBC mode encryption?

Given that CBC mode encryption is vulnerable to padding oracle attacks, what is the next best alternative ? a) Include a hash check in the API scheme, validate the hash and then proceed with CBC. If ...
user avatar
2 votes
3 answers
558 views

NIST vs ISO Encryption standardisation process

skinny cipher has been lately considered as ISO/IEC standard while is still competing as building block of Romulus AEAD in NIST LWC finalists. what is the difference between the two ISO and NIST ...
user avatar
  • 1,980
1 vote
1 answer
115 views

Comparison of Post Quantum Algorithms in Nist 3rd round

I'm interested in the Post Quantum Algorithms of the 3rd round of the NIST standardization competition. The algorithms for KEM are Classic McEliece, CRYSTALS-KYBER, NTRU, SABER and their 5 ...
user avatar
  • 1,482
1 vote
1 answer
56 views

Input size recomendation of sequence for each test in NIST SP 800-22

I am using the NIST SP 800-22 to evaluate the performance of the Random Numer Generator. NIST SP 800-22 has a total of 15 tests. In each test, it has a recommendation for the size of the tested ...
user avatar
1 vote
0 answers
30 views

Verifiable Base Point generation via NIST SP 800-186 method

I'm looking at D.3.2 Verifiably Random Base Points of NIST SP 800-186. Looks like step 5 is there to ensure that $hashlen > bitLen(q)+1$ and (potentially) discard big $e$, so $t$ is distributed ...
user avatar
  • 390
1 vote
1 answer
67 views

Why the DRBG can mask the small deviations in the behavior of the entropy source?

In NIST SP 800-90C, it said:"Small deviations in the behavior of the entropy source in an NRBG will be masked by the DRBG output" Why the DRBG can mask the small deviations in the behavior ...
user avatar
4 votes
3 answers
3k views

Why did Google Cloud accept a lower FIPS 140-2 Level compared to IBM Cloud?

FIPS 140-2 is a standard which handles cryptographic modules and the ones that organizations use to encrypt data-at-rest and data-in-motion. FIPS 140-2 has 4 levels of security, with level 1 being the ...
user avatar
4 votes
0 answers
158 views

Is there a good rundown anywhere on the NIST vs CNRS patent disputes on lattice cryptography?

As I understand it from web conference hearsay, the Kyber and Saber entries to the NIST post quantum cryptography competition have been subject to a patent claim from the CNRS. The creators of the ...
user avatar
  • 161
0 votes
2 answers
131 views

How can we measure the security levels of post-quantum cryptographic algorithms? Is there a standard way of this measurement?

How do we measure the security levels of Post Quantum Cryptographic algorithms such as: NTRU Prime, Saber, Kyber,...that are submited to NIST PQC Standardization Process(Competition) in general? I ...
user avatar
  • 859
1 vote
1 answer
64 views

How to use ECDSA test vectors?

I would like to verify my system by running ECDSA NIST test vectors, but I am not getting expected output. I am able to calculate signature, but it is not right or at least "r" and "s&...
user avatar
0 votes
0 answers
19 views

Number of samples in FrodoKEM

Why does the number of samples in FrodoKEM is $m \approx n$? The paper is here.
user avatar
  • 365
4 votes
2 answers
223 views

Testing of PQC NIST round3 submissions

I am new to this field and have some concerns regarding PQC; How does NIST do a comparison that a particular algorithm is efficient and its security can not be broken by future quantum attacks? I am ...
user avatar
5 votes
0 answers
135 views

Is qTesla Secure?

qTesla is a signature scheme and a submission to the NIST post-quantum standardization process, which made it to the second round. It is based on the hardness of RLWE. The NIST round 2 status report ...
user avatar
  • 349
8 votes
1 answer
594 views

NSA removed EC-256 and SHA-256 from CNSA recently--should we be alarmed by this?

Recently, the NSA (re-published?) their CNSA guidelines and some information on post-quantum computers (per the title of the document). Here's the link for convenience (document is titled, 'Quantum ...
user avatar
  • 115
1 vote
1 answer
62 views

Evaluation criteria for NIST finalist candidates

I have seen several recent papers mention that side-channel resistance and countermeasure will be a major evaluation criterion for the NIST finalist candidates. However, I don't find any reference to ...
user avatar
  • 1,215
2 votes
0 answers
44 views

Why FF2 Format Preserving Encryption Fails

I have just seen that there are 3 feistel based FPE schemes which were proposed FF1,FF2 and FF3( There might be many more). Although there have been different attacks on FF1 and FF3 standard that ...
user avatar
7 votes
1 answer
3k views

Why are NIST curves still used?

I'm relatively new to the world of crypto (But as far as the math goes, I am familiar with the inner workings. I used to rarely use it for privacy, but now I use it for many things). Anyway, I was ...
user avatar
0 votes
1 answer
48 views

Why has ID-based PKC not been included in the NIST PQC competition?

Although there are several proposals of ID-based PKC based on lattices, multivariate cryptography, I want to know why identity (ID) based PKC is not included in the NIST post-quantum competition. Is ...
user avatar
  • 149
3 votes
1 answer
115 views

Why is an ephemeral key required to prove possession of a static private key in Key-Establishment Schemes

In the NIST 800-56A rev3 "Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography" in section 5.6.2.2.3.2 "Recipient Obtains Assurance [of the ...
user avatar
  • 107
12 votes
1 answer
641 views

Number of bit-operations required for information set decoding attacks on code-based cryptosystems?

This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC. This paper estimates the concrete number of bit ...
user avatar
11 votes
0 answers
474 views

Requirements for security against multi-target attacks, for McEliece and other code-based cryptosystems?

This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC. For these cryptosystems, it seems that an attacker ...
user avatar
3 votes
1 answer
284 views

Why does the NIST Runs Test include a Frequency Test?

In the NIST suite of RNG tests (https://csrc.nist.gov/publications/detail/sp/800-22/rev-1a/final), one of the tests is the Runs Test, which tests counts of runs of 1's and 0's. According to the ...
user avatar
0 votes
1 answer
62 views

Do I need to implement multi precision arithmetic operations?

I want to implement Elliptic Curves arithmetics (for edu purpose and better understanding) for special NIST primes: point addition, exponentiation, etc.. all operations needed for EC encryption/...
user avatar
  • 103
0 votes
0 answers
143 views

Where to get AES GCM NIST-like test cases

I'm implementing AES GCM 256 bit at the moment. Now I'm finished with copying the content of the standard as a program and now have to make it actually work. With the test cases in the official NIST ...
user avatar
0 votes
1 answer
51 views

What is the difference between probabilistic and deterministic prime-factor recovery function in NIST 800-56B?

In the previous standard, the deterministic was not included. It is already in the current standard. What is the reason for this? Can I use both function?
user avatar
  • 125
2 votes
1 answer
102 views

Why is it necessary a prime factor recovery for a RSA Key-Pair Validation (in case of fix public exponens)?

In NIST 800-56B publishing, this is done with the $(p, q) = RecoverPrimeFactors (n, e, d)$ function. I don't understand why is necessary if $p$ and $q$ are known during in generation. In my opinion, ...
user avatar
  • 125
4 votes
1 answer
328 views

Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process? Both are mentioned in the final ...
user avatar
  • 143
1 vote
1 answer
186 views

Which test suit is better to say if PRNG is CSPRNG:TestU01 or NIST?

Actually my concern is that I am planning to apply xoshiro256+ for implementation of stream cipher https://prng.di.unimi.it/ for my cryptographic application. It passes the BigCrush tests. Will it ...
user avatar
0 votes
1 answer
62 views

Authentication in Lattice PQC candidates

I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
user avatar
0 votes
1 answer
118 views

Error Correcting Codes Post Quantum Finalists

I have been looking into error-correcting codes in lattice, I am specifically hoping to find some information on hardware implementations for the NIST PQ PKE/KEM finalists (Saber, CRYSTALS-Kyber, NTRU)...
user avatar
12 votes
2 answers
2k views

Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?

I have seen in many papers and even in communications from NIST that the ongoing standardization is a "procedure" or a "process". They carefully refrain from using the term ...
user avatar
  • 1,215
4 votes
1 answer
241 views

What is the NIST recommended maximum bias for random number generators?

What is the maximum bias recommended by NIST for random number generators? This answer says that it is $2^{-64}$. Is it same for all applications? Does NIST have a publication with more information? I ...
user avatar
2 votes
2 answers
182 views

How much data can we encrypt using AES 256 before changing the key?

Although this question has been answered in this link (After How Much Data Encryption (AES-256) we should change key?), I am not satisfied with the answers because the Recommendation for Block Cipher ...
user avatar
1 vote
1 answer
96 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
user avatar
  • 75
1 vote
1 answer
127 views

What is the security strength of McEliece variants?

Please help me understand the security strength of McEliece variants prepared for Round 3. I looked at the specifications - https://classic.mceliece.org/nist/mceliece-20201010.pdf - it doesn't have ...
user avatar
  • 123
1 vote
1 answer
117 views

Meaning of Dilithium-1024x768 or Dilithium2

Can someone explain me the meaning of 1024 and 768 in Dilithium-1024x768 in the algorithm? And the meaning of 2 in Dilithium2 in the algorithm?
user avatar
  • 75
2 votes
0 answers
70 views

What technical flaw in the Secure Hash Standard was the NIST referring to?

On July 11, 1994, the NIST proposed an interesting revision to FIPS 180, about the Secure Hash Standard: A revision of Federal Information Processing Standard (FIPS) 180, Secure Hash Standard (SHS), ...
user avatar
  • 3,057
2 votes
0 answers
73 views

NTRU HPS98 vs NTRU-HRSS-KEM vs new NTRU

What is a simple explanation for the difference in terms of key gen, encryption and decryption between the original NTRU (HPS98) and the NTRU candidates submitted in NIST PQ Standardisation? Round 1 - ...
user avatar
  • 227
6 votes
1 answer
757 views

Why was Rijndael the only cipher to have a variable number of rounds?

Rijndael was the only AES candidate which defined a different number of rounds for their 128, 192, and 256-bit versions (10, 12, and 14, respectively). The others had a fixed number of rounds (32 for ...
user avatar
  • 12.9k
1 vote
1 answer
76 views

Where to obtain a common/weak password list (black list)?

The NIST 800-63B publication specifies recommendations regarding memorized secrets (passwords) https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver specifically section "5.1.1 Memorized ...
user avatar
  • 171
-1 votes
2 answers
581 views

NIST Statistical Test Segmentation Fault (Core dumped)

I am trying to use NIST Statistical Test When I have 1 line number which is includes 7467 character,(all of the are either 1 or 0) the test is working I am following these steps: ./assess 7467, then ...
user avatar
  • 141
0 votes
1 answer
132 views

Submission to NIST

I have a paper on post quantum cryptography about Key-establishment Algorithms, that I wish to submit it to the National Institute of Standards and Technology (NIST) I found on their website that the ...
user avatar
  • 365
2 votes
1 answer
160 views

Rounding function used in Saber Key Exchange

In Saber: Module-LWR based key exchange, the authors use a rounding function called $\textit{bits}$, defined (in page 3) as follows: $bits(x, i, j)$, with $j \leq i$, gives $j$ consecutive bits of a ...
user avatar
  • 349
0 votes
1 answer
80 views

NIST test suite with biased PRNG

Is there a straightforward way to employ NIST Statistical Test Suite for testing a biased generator (e.g. with 0.6 probability of 1)? By straightforward way I mean one not requiring nontrivial code ...
user avatar
8 votes
1 answer
527 views

NewHope and NIST's Post-quantum standardization

Where can I find NIST's reasoning to eliminate NewHope from the 3rd round of the post-quantum competition? I see all the lattice KEMs finalists are based on modules. Is being a ring-based KEM ...
user avatar
  • 1,215
1 vote
0 answers
39 views

NIST STS randomness testing inconsistent results

I have generated the nine datasets according to this document for AES-128 and testing these for randomness using NIST STS. However, the results are inconsistent. Sometimes there appear a * in the ...
user avatar
  • 1,998
2 votes
2 answers
430 views

ECDSA signature with Brainpool curves in TLS possible?

Even the up to date RFC 8446 lists at the page 41 as the options for the ECDSA in e.g. TLS_ECDHE_ECDSA_WITH_... only NIST curves: ...
user avatar
  • 31