Questions tagged [nist]
The National Institute of Standards and Technology (NIST) is a U.S. federal agency that works with industry to develop and apply technology, measurements, and standards.
195
questions
0
votes
1
answer
47
views
Rainbow What happened to signatures in the NIST standardization process?
The rainbow signature was not seen in round 4 of the NIST PQC standardization process. Was Rainbow not shortlisted?
- 117
2
votes
1
answer
94
views
NIST algorithm testing results
I have an algorithm that encrypts large text. I want to test this algorithm on statistical tests. The ciphertext contains ~10,000,000 bits. I decided to test the ...
- 43
2
votes
0
answers
48
views
NIST statistical tests [duplicate]
I'm having trouble testing a not-so-popular algorithm that I haven't found an implementation of, so I wrote it myself and now I'd like to test it with nist tests, but I have a suspicion that I'm doing ...
- 43
5
votes
4
answers
231
views
What is the significance of the results of the NIST PQC competition?
I hope this is not offtopic.
Since NIST has rather recently announced the winners of its PQC competition I was wondering how significant this development is. Does that mean that CRYSTALS-Kyber will ...
- 617
2
votes
1
answer
76
views
What advantages does FrodoKEM have over other PQCs?
What are the advantages of FrodoKEM over other NIST PQC candidates? Also, have any critical vulnerabilities been discovered so far?
- 117
7
votes
1
answer
186
views
What is the status of the NIST Lightweight Cryptography Standardisation Process?
The NIST Computer Security Resource Center called for nominations for a process to standardise lightweight symmetric primitives in August 2018.
In the update talk in the 2019 Lightweight Cryptography ...
- 18.3k
3
votes
2
answers
322
views
Break Lattice-Based Cryptography with Variational Quantum Algorithm (only 25 k. Qbits for Kyber1024)?
I am currently writing a seminar paper on Kyber and other lattice-based methods. I was so excited about the lattice-based methods that I also currently searched quantum algorithms to solve the methods....
- 65
2
votes
0
answers
24
views
Safe p-value for NIST randomness test with small sample size
In this journal paper related to physically unclonable function (PUF) [1], the authors used NIST 800-22 test to check if the bitstreams generated by their PUFs are random, which is described as ...
- 121
1
vote
1
answer
93
views
Where can I find a comprehensive guide to running the NIST SP800-90B_EntropyAssessment?
I am already using the 2 they suggest :
https://github.com/usnistgov/SP800-90B_EntropyAssessment https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf
but, here is where I run into ...
3
votes
1
answer
101
views
NIST example shows extra hexadecimal characters in Block Contents of SHA512-256
I was recently trying to gain a better understanding of the SHA-512/256 algorithm and on this NIST example they use the word "abc" as the input. In the Block Contents, it shows the expected ...
- 133
3
votes
0
answers
81
views
Does NIST SP800-56C r2 forbid using NIST-approved two-step KDFs for not-all-at-once key-derivations?
NIST SP800-56C r2 added Section 5.3 which specifically addresses using a single Extract step followed by ...
- 43
3
votes
1
answer
224
views
NIST expression for HMAC security strength
In NIST SP800-107, NIST claims that the security strength of HMAC is MIN(security of HMAC key, $2L$). $L$ is the length of the output of the underlying hash function. Let's take HMAC-SHA256 as an ...
- 1,048
0
votes
1
answer
77
views
Does the Saber.PKE algorithm submitted in PQC NIST Round3 support the additional homomorphism?
As for the PQC algorithm Saber.PKE based on M-LWR, I wonder whether it supports homomorphic addition operation. According to my related work, the error of this algorithm can be written as $e_S = ||s^{\...
- 1
1
vote
0
answers
161
views
Which quantum resistant digital signature algorithm would you use and why (If you had to pick one now)? [closed]
Context: Many widely used public-key cryptographic schemes have been designed based on the difficulty of factoring and similar problems. That includes RSA, the Diffie-Hellman Key Exchange, ECDH, ...
- 293
1
vote
0
answers
58
views
What’s the relationship between P-256 and Dual EC DRBG?
It is said that Dual EC DRBG has a backdoor given the values of the curve. Hence some people do not trust it.
With that in mind, some people also distrust NIST P-256 Curve. Why? Is it purely because ...
0
votes
0
answers
29
views
How many number of sequences (sample size) should be selected for randomness testing of bock cipher with 256 bits key and block length?
I am working on randomness testing of block cipher. I have gone through the NIST two papers of randomness testing of AES candidate algorithm, links are given below
https://csrc.nist.gov/csrc/media/...
1
vote
1
answer
63
views
About two sequence conversion methods in NIST 800-90B
I am reading the 800-90B document.
In particular, I'm looking at Chapter 5, the chapter on checking that samples conform to IID.
There are 11 tests such as Excursion Test Statistic and Number of ...
- 183
0
votes
1
answer
307
views
Alternative to CBC mode encryption?
Given that CBC mode encryption is vulnerable to padding oracle attacks, what is the next best alternative ?
a) Include a hash check in the API scheme, validate the hash and then proceed with CBC. If ...
- 204
2
votes
3
answers
636
views
NIST vs ISO Encryption standardisation process
skinny cipher has been lately considered as ISO/IEC standard while is still competing as building block of Romulus AEAD in NIST LWC finalists.
what is the difference between the two ISO and NIST ...
- 1,990
2
votes
1
answer
404
views
Comparison of Post Quantum Algorithms in Nist 3rd round
I'm interested in the Post Quantum Algorithms of the 3rd round of the NIST standardization competition. The algorithms for KEM are Classic McEliece, CRYSTALS-KYBER, NTRU, SABER and their 5 ...
- 1,900
2
votes
1
answer
206
views
Input size recomendation of sequence for each test in NIST SP 800-22
I am using the NIST SP 800-22 to evaluate the performance of the Random Numer Generator.
NIST SP 800-22 has a total of 15 tests. In each test, it has a recommendation for the size of the tested ...
- 83
1
vote
0
answers
45
views
Verifiable Base Point generation via NIST SP 800-186 method
I'm looking at D.3.2 Verifiably Random Base Points of NIST SP 800-186. Looks like step 5 is there to ensure that $hashlen > bitLen(q)+1$ and (potentially) discard big $e$, so $t$ is distributed ...
- 474
1
vote
1
answer
83
views
Why the DRBG can mask the small deviations in the behavior of the entropy source?
In NIST SP 800-90C, it said:"Small deviations in the behavior of the entropy source in an NRBG will be masked by the DRBG output"
Why the DRBG can mask the small deviations in the behavior ...
- 83
4
votes
4
answers
3k
views
Why did Google Cloud accept a lower FIPS 140-2 Level compared to IBM Cloud?
FIPS 140-2 is a standard which handles cryptographic modules and the ones that organizations use to encrypt data-at-rest and data-in-motion. FIPS 140-2 has 4 levels of security, with level 1 being the ...
- 227
6
votes
1
answer
268
views
Is there a good rundown anywhere on the NIST vs CNRS patent disputes on lattice cryptography?
As I understand it from web conference hearsay, the Kyber and Saber entries to the NIST post quantum cryptography competition have been subject to a patent claim from the CNRS. The creators of the ...
- 191
1
vote
2
answers
248
views
How can we measure the security levels of post-quantum cryptographic algorithms? Is there a standard way of this measurement?
How do we measure the security levels of Post Quantum Cryptographic algorithms such as: NTRU Prime, Saber, Kyber,...that are submited to NIST PQC Standardization Process(Competition) in general?
I ...
- 879
1
vote
1
answer
289
views
How to use ECDSA test vectors?
I would like to verify my system by running ECDSA NIST test vectors, but I am not getting expected output. I am able to calculate signature, but it is not right or at least "r" and "s&...
- 13
4
votes
2
answers
256
views
Testing of PQC NIST round3 submissions
I am new to this field and have some concerns regarding PQC;
How does NIST do a comparison that a particular algorithm is efficient and its security can not be broken by future quantum attacks? I am ...
- 41
6
votes
0
answers
257
views
Is qTesla Secure?
qTesla is a signature scheme and a submission to the NIST post-quantum standardization process, which made it to the second round. It is based on the hardness of RLWE. The NIST round 2 status report ...
- 381
8
votes
1
answer
1k
views
NSA removed EC-256 and SHA-256 from CNSA recently--should we be alarmed by this?
Recently, the NSA (re-published?) their CNSA guidelines and some information on post-quantum computers (per the title of the document).
Here's the link for convenience (document is titled, 'Quantum ...
- 135
1
vote
1
answer
64
views
Evaluation criteria for NIST finalist candidates
I have seen several recent papers mention that side-channel resistance and countermeasure will be a major evaluation criterion for the NIST finalist candidates. However, I don't find any reference to ...
- 1,235
2
votes
0
answers
57
views
Why FF2 Format Preserving Encryption Fails
I have just seen that there are 3 feistel based FPE schemes which were proposed FF1,FF2 and FF3( There might be many more). Although there have been different attacks on FF1 and FF3 standard that ...
7
votes
1
answer
4k
views
Why are NIST curves still used?
I'm relatively new to the world of crypto (But as far as the math goes, I am familiar with the inner workings. I used to rarely use it for privacy, but now I use it for many things).
Anyway, I was ...
- 243
0
votes
1
answer
53
views
Why has ID-based PKC not been included in the NIST PQC competition?
Although there are several proposals of ID-based PKC based on lattices, multivariate cryptography, I want to know why identity (ID) based PKC is not included in the NIST post-quantum competition.
Is ...
- 149
3
votes
1
answer
188
views
Why is an ephemeral key required to prove possession of a static private key in Key-Establishment Schemes
In the NIST 800-56A rev3 "Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography" in section 5.6.2.2.3.2 "Recipient Obtains Assurance [of the ...
- 107
12
votes
1
answer
679
views
Number of bit-operations required for information set decoding attacks on code-based cryptosystems?
This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC.
This paper estimates the concrete number of bit ...
- 341
12
votes
0
answers
499
views
Requirements for security against multi-target attacks, for McEliece and other code-based cryptosystems?
This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC.
For these cryptosystems, it seems that an attacker ...
- 341
3
votes
1
answer
409
views
Why does the NIST Runs Test include a Frequency Test?
In the NIST suite of RNG tests (https://csrc.nist.gov/publications/detail/sp/800-22/rev-1a/final), one of the tests is the Runs Test, which tests counts of runs of 1's and 0's. According to the ...
- 31
0
votes
1
answer
82
views
Do I need to implement multi precision arithmetic operations?
I want to implement Elliptic Curves arithmetics (for edu purpose and better understanding) for special NIST primes: point addition, exponentiation, etc.. all operations needed for EC encryption/...
- 103
0
votes
0
answers
378
views
Where to get AES GCM NIST-like test cases
I'm implementing AES GCM 256 bit at the moment. Now I'm finished with copying the content of the standard as a program and now have to make it actually work. With the test cases in the official NIST ...
- 101
0
votes
1
answer
57
views
What is the difference between probabilistic and deterministic prime-factor recovery function in NIST 800-56B?
In the previous standard, the deterministic was not included. It is already in the current standard.
What is the reason for this?
Can I use both function?
- 125
2
votes
1
answer
116
views
Why is it necessary a prime factor recovery for a RSA Key-Pair Validation (in case of fix public exponens)?
In NIST 800-56B publishing, this is done with the $(p, q) = RecoverPrimeFactors (n, e, d)$ function. I don't understand why is necessary if $p$ and $q$ are known during in generation. In my opinion, ...
- 125
4
votes
1
answer
793
views
Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?
Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process?
Both are mentioned in the final ...
- 143
1
vote
1
answer
224
views
Which test suit is better to say if PRNG is CSPRNG:TestU01 or NIST?
Actually my concern is that I am planning to apply xoshiro256+ for implementation of stream cipher https://prng.di.unimi.it/
for my cryptographic application. It passes the BigCrush tests. Will it ...
- 39
0
votes
1
answer
64
views
Authentication in Lattice PQC candidates
I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
- 51
1
vote
1
answer
146
views
Error Correcting Codes Post Quantum Finalists
I have been looking into error-correcting codes in lattice, I am specifically hoping to find some information on hardware implementations for the NIST PQ PKE/KEM finalists (Saber, CRYSTALS-Kyber, NTRU)...
- 51
12
votes
2
answers
2k
views
Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?
I have seen in many papers and even in communications from NIST that the ongoing standardization is a "procedure" or a "process". They carefully refrain from using the term ...
- 1,235
4
votes
1
answer
262
views
What is the NIST recommended maximum bias for random number generators?
What is the maximum bias recommended by NIST for random number generators?
This answer says that it is $2^{-64}$.
Is it same for all applications? Does NIST have a publication with more information?
I ...
- 319
2
votes
2
answers
368
views
How much data can we encrypt using AES 256 before changing the key?
Although this question has been answered in this link (After How Much Data Encryption (AES-256) we should change key?), I am not satisfied with the answers because the Recommendation for Block Cipher ...
- 21
1
vote
1
answer
180
views
How does TLS 1.3 work with PQC signatures?
I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512.
Do PQC signatures work the same as modern algorithms in TLS 1.3?
- 85