Questions tagged [nist]

The National Institute of Standards and Technology (NIST) is a U.S. federal agency that works with industry to develop and apply technology, measurements, and standards.

Filter by
Sorted by
Tagged with
3
votes
1answer
191 views

Why does the NIST Runs Test include a Frequency Test?

In the NIST suite of RNG tests (https://csrc.nist.gov/publications/detail/sp/800-22/rev-1a/final), one of the tests is the Runs Test, which tests counts of runs of 1's and 0's. According to the ...
0
votes
1answer
54 views

Do I need to implement multi precision arithmetic operations?

I want to implement Elliptic Curves arithmetics (for edu purpose and better understanding) for special NIST primes: point addition, exponentiation, etc.. all operations needed for EC encryption/...
0
votes
0answers
31 views

Where to get AES GCM NIST-like test cases

I'm implementing AES GCM 256 bit at the moment. Now I'm finished with copying the content of the standard as a program and now have to make it actually work. With the test cases in the official NIST ...
0
votes
0answers
47 views

Mismatch between NIST SP800-90A test vectors and CTR_DRBG output

I am testing my Python implementation of NIST SP800-90A CTR_DRBG https://csrc.nist.gov/publications/detail/sp/800-90a/rev-1/final (AES-256, no df) with the CAVP test vectors (https://csrc.nist.gov/...
0
votes
1answer
44 views

What is the difference between probabilistic and deterministic prime-factor recovery function in NIST 800-56B?

In the previous standard, the deterministic was not included. It is already in the current standard. What is the reason for this? Can I use both function?
2
votes
1answer
84 views

Why is it necessary a prime factor recovery for a RSA Key-Pair Validation (in case of fix public exponens)?

In NIST 800-56B publishing, this is done with the $(p, q) = RecoverPrimeFactors (n, e, d)$ function. I don't understand why is necessary if $p$ and $q$ are known during in generation. In my opinion, ...
3
votes
1answer
108 views

Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process? Both are mentioned in the final ...
1
vote
1answer
138 views

Which test suit is better to say if PRNG is CSPRNG:TestU01 or NIST?

Actually my concern is that I am planning to apply xoshiro256+ for implementation of stream cipher https://prng.di.unimi.it/ for my cryptographic application. It passes the BigCrush tests. Will it ...
0
votes
1answer
58 views

Authentication in Lattice PQC candidates

I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
0
votes
1answer
80 views

Error Correcting Codes Post Quantum Finalists

I have been looking into error-correcting codes in lattice, I am specifically hoping to find some information on hardware implementations for the NIST PQ PKE/KEM finalists (Saber, CRYSTALS-Kyber, NTRU)...
12
votes
2answers
2k views

Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?

I have seen in many papers and even in communications from NIST that the ongoing standardization is a "procedure" or a "process". They carefully refrain from using the term ...
4
votes
1answer
224 views

What is the NIST recommended maximum bias for random number generators?

What is the maximum bias recommended by NIST for random number generators? This answer says that it is $2^{-64}$. Is it same for all applications? Does NIST have a publication with more information? I ...
2
votes
2answers
117 views

How much data can we encrypt using AES 256 before changing the key?

Although this question has been answered in this link (After How Much Data Encryption (AES-256) we should change key?), I am not satisfied with the answers because the Recommendation for Block Cipher ...
1
vote
1answer
72 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
1
vote
1answer
48 views

What is the security strength of McEliece variants?

Please help me understand the security strength of McEliece variants prepared for Round 3. I looked at the specifications - https://classic.mceliece.org/nist/mceliece-20201010.pdf - it doesn't have ...
1
vote
1answer
79 views

Meaning of Dilithium-1024x768 or Dilithium2

Can someone explain me the meaning of 1024 and 768 in Dilithium-1024x768 in the algorithm? And the meaning of 2 in Dilithium2 in the algorithm?
1
vote
0answers
37 views

What technical flaw in the Secure Hash Standard was the NIST referring to?

On July 11, 1994, the NIST proposed an interesting revision to FIPS 180, about the Secure Hash Standard: A revision of Federal Information Processing Standard (FIPS) 180, Secure Hash Standard (SHS), ...
2
votes
0answers
41 views

NTRU HPS98 vs NTRU-HRSS-KEM vs new NTRU

What is a simple explanation for the difference in terms of key gen, encryption and decryption between the original NTRU (HPS98) and the NTRU candidates submitted in NIST PQ Standardisation? Round 1 - ...
7
votes
1answer
739 views

Why was Rijndael the only cipher to have a variable number of rounds?

Rijndael was the only AES candidate which defined a different number of rounds for their 128, 192, and 256-bit versions (10, 12, and 14, respectively). The others had a fixed number of rounds (32 for ...
1
vote
1answer
59 views

Where to obtain a common/weak password list (black list)?

The NIST 800-63B publication specifies recommendations regarding memorized secrets (passwords) https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver specifically section "5.1.1 Memorized ...
0
votes
0answers
15 views

Sources about NTRUEncrypt implementations

I'm looking for any source that explains the final implementation of NTRUEncrypt for the NIST's third round as simple as possible. I have been trying to understand it directly from the submitted code ...
-1
votes
2answers
194 views

NIST Statistical Test Segmentation Fault (Core dumped)

I am trying to use NIST Statistical Test When I have 1 line number which is includes 7467 character,(all of the are either 1 or 0) the test is working I am following these steps: ./assess 7467, then ...
0
votes
1answer
111 views

Submission to NIST

I have a paper on post quantum cryptography about Key-establishment Algorithms, that I wish to submit it to the National Institute of Standards and Technology (NIST) I found on their website that the ...
2
votes
1answer
80 views

Rounding function used in Saber Key Exchange

In Saber: Module-LWR based key exchange, the authors use a rounding function called $\textit{bits}$, defined (in page 3) as follows: $bits(x, i, j)$, with $j \leq i$, gives $j$ consecutive bits of a ...
0
votes
1answer
53 views

NIST test suite with biased PRNG

Is there a straightforward way to employ NIST Statistical Test Suite for testing a biased generator (e.g. with 0.6 probability of 1)? By straightforward way I mean one not requiring nontrivial code ...
8
votes
1answer
441 views

NewHope and NIST's Post-quantum standardization

Where can I find NIST's reasoning to eliminate NewHope from the 3rd round of the post-quantum competition? I see all the lattice KEMs finalists are based on modules. Is being a ring-based KEM ...
1
vote
0answers
32 views

NIST STS randomness testing inconsistent results

I have generated the nine datasets according to this document for AES-128 and testing these for randomness using NIST STS. However, the results are inconsistent. Sometimes there appear a * in the ...
1
vote
1answer
246 views

ECDSA signature with Brainpool curves in TLS possible?

Even the up to date RFC 8446 lists at the page 41 as the options for the ECDSA in e.g. TLS_ECDHE_ECDSA_WITH_... only NIST curves: ...
3
votes
0answers
71 views

Inconsistency Between NIST SP800-108 and KBKDFVS

I am attempting to implement a Key Based Key Derivation Function (KBKDF) in Counter Mode as part of a larger project. To test my implementation, I was directed towards the Verification System for this ...
1
vote
1answer
48 views

Ranking “amount of randomization” in a sequence

I'm facing the problem of implementing pseudo random bit generator (PRBG) on a very low power device. NIST.SP800-22 "Statistical test suite for Pseudo Random Generators" suggests a suite of ...
5
votes
3answers
278 views

What are the benefits of using AEAD algorithms as MAC

I've seen in 2 places where NIST acknowledge the possibility of using AEAD algorithm for MAC (e.g. page 7 section 5.2 of GCM spec, summary for LAEM on page 6 of LWC status report). And I see 2 ...
0
votes
1answer
176 views

Where can I find NIST SP800-38E's Test vectors?

I am implementing XTS-AES mode in NIST SP800-38E, But I didn't find test vectors about it. Who can help me?
1
vote
0answers
75 views

Primal and dual attack against NTRU

I am looking at the primal attack against schemes in the second round of the NIST Post-Quantum Standardization Project. The cost of primal attack usually comes from an estimate described in NewHope ...
1
vote
1answer
124 views

Min Entropy Value for Health Test per NIST 800-90B for 32 bit Noise Source

NIST 800-90B recommends Section 4.4.1 Repetition Count Test & Adaptive Proportion Test for health test on Noise sources. In the equation to calculate the cut-off value C for Repetition Count Test,...
0
votes
2answers
243 views

PRNG next bit test

I would like to know whether a specific PRNG satisfy the next-bit test or not. will satisfying all of NIST statistical tests on PRNG guarantees passing the next-bit test? Or is there a specific ...
1
vote
1answer
247 views

What is the correct way to choose the start parameters for NIST tests? [duplicate]

I had an idea of creating a pseudo-random binary sequence with that code: ...
1
vote
1answer
116 views

Problem with Hash-DRBG's seedlen values (and others)

In NIST-SP-800-90Ar1, the Hash-DRBG is instantiated with hash functions using strange values for seed length (seedlen) such as 440, 888. How are these values derived? How to derive values for other ...
2
votes
1answer
86 views

NIST DRBG algorithms' optional parameter

As I'm going through NIST-SP-800-90Ar1 spec for DRBG, I found the mention of security_strength in all of the 3 specified construct in the document: Hash_DRBG, HMAC_DRBG, CTR_DRBG. However, they're all ...
3
votes
1answer
199 views

Why weak modes of operations are not banned?

If some modes of operations of AES are not secure (like ECB or CBC), which are prone to bit flipping / manipulation attacks, and why they haven't they been banned or advised against by NIST for other ...
2
votes
2answers
259 views

Statistical Analysis of Cryptographic Hashing Algorithms

I was wondering how can I use NIST Statistical Test Suite to check for the randomness of output generated by a cryptographic hashing algorithm, let say SHA-256? To be specific, how will I generate ...
50
votes
4answers
13k views

Why isn’t SHA-3 in wider use?

SHA-3 was released by NIST just over 4 years ago this week. In my experience it does not seem to be as widely used as I might have expected. I see SHA-2 and even SHA-1 more often. What are your ...
2
votes
1answer
142 views

Why does the NIST CTR DRBG apparently output the internal state when no additional input is given?

After reading through the specification of the FIPS CTR_DRBG in SP 800-90A (see Section 10.2.1), I got the impression that the output of the DRBG coincides with its internal state as long as no ...
2
votes
1answer
306 views

Interpretation of certain results of NIST Test Suite

I am using NIST Test suite on a PRNG and have a confusion regarding some specific results. Following is the part of the results: ...
2
votes
3answers
731 views

AIS31 Software and Documentation

I have learned that there are two main test suitcase for randomness (reference): AIS 31 - German Federal Office for Information Security (BSI) SP 800-90B - U.S. National Institute for Standards and ...
1
vote
1answer
401 views

NIST random excursion results

NIST specifies so-called random excursions test and random excursions variant test. From the description I can derive that the number of p-values should be 8 in the first case and 18 in the second. ...
0
votes
2answers
67 views

Help to understand the KDM in SP800-56A, and the usage of “FixedInfo”

Can somebody help me to understand the LOGIC behind Key-Derivation Methods (SP800 56A CH5.8)? This is my common understanding and please correct me if any wrong.. Alice and Bob can general individual ...
1
vote
2answers
183 views

Diffie-Hellman Primitives in SP800-56A

I wonder if someone can give an explain about the different between two Diffie-Hellman Primitives defined in SP800-56A, CH5.7.1 5.7.1.1 Finite Field Cryptography Diffie-Hellman (FFC DH) Primitive 5.7....
1
vote
1answer
211 views

NIST elliptic curves behaving anamolous in OPENSSL benchmark

I tried to collect some benchmarks on NIST elliptic curves using charm library. The charm library is just a wrapper over OPENSSL. I experimented with prime192v1 (P-192), secp224r1 (P-224), prime256v1 (...
1
vote
1answer
2k views

Naming convention for NIST elliptic curves in OPENSSL

NIST standardized 5 elliptic curves (P-192, P-224, P-256, P-384, P-521) for prime fields. When I looked into openssl, these curves are named as prime192v1, secp224r1, prime256v1, secp384r1, secp521r1. ...
5
votes
1answer
153 views

NTRUencrypt in NIST competition

Why did the NTRUencrypt team not maintain the NTRU1024 release in the NIST second-round competition? Is this because of the speed performance or security performance or other things?