Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nist]

The National Institute of Standards and Technology (NIST) is a U.S. federal agency that works with industry to develop and apply technology, measurements, and standards.

4
votes
2answers
85 views

What's the reason for Monte Carlo tests for block ciphers?

NIST specifies that implementations were required to create Monte Carlo test vectors for ECB and CBC mode for the AES competition. What's the reason for these tests? The only thing I can think of is ...
0
votes
0answers
27 views

Signature Generation with RSA PKCS#1 v.15

I am trying to validate my RSA implementation for digital signatures with the test vectors provided by NIST. For now, I am focusing on the tests for signature generation (SigGen15) with the PKCS#1 v....
2
votes
1answer
55 views

NIST STS incorrect results for sample files

So I wanted to check the outcome of a hardware TRNG and see if its entropy is good enough. I downloaded the source files for statistical test suit from nist.gov website, compiled them on my macOS ...
2
votes
1answer
94 views

NIST security categories (post quantum)

Here (https://www.safecrypto.eu/pqclounge/round-2-candidates/) are collected all the proposals which passed the first round of NIST Post-Quantum Cryptography Standardisation process. What does the ...
1
vote
2answers
92 views

What are known metrics for TRNG?

I was wondering what the known metrics are for studying the randomness of TRNG (besides NIST tests). For example, for PUFs, there are known metrics such as uniformity, uniqueness, BER, etc.
1
vote
0answers
59 views

Participant workflow in the Cryptography competitions [closed]

I learned about the NIST hash function competition which generated SHA3. It says it inspired a Password hashing competition too, which resulted in Argon2. What I'm wondering is what people generally ...
19
votes
2answers
1k views

Is there a contingency plan in the event of a catastrophic attack on AES?

NIST selected Rijndael in 2000 to be AES. In a paper from the Serpent authors, they mention that there was the possibility of choosing a second cipher as a backup in the case of any severe breaks: ...
4
votes
1answer
88 views

Magic Number to calculate number of rounds for M-R in FIPS 186-4

In Fips 186-4, there is an algorithm in Appendix F (at page 117 in my copy of the 2013 version) to calculate the number of rounds of the Miller-Rabin primality test to random bases. Does anybody ...
16
votes
2answers
837 views

How did || come to be used in crypto texts to represent concatenation?

In RFC5647, NIST SP 800-38D, etc., || is used to denote concatenation. How did that come to be? In most programming languages ||...
0
votes
1answer
185 views

Equivalent RSA modulus for NIST P-192 and P-521 elliptic curves [duplicate]

At www.keylength.com, I found the following table of ECC field size and the corresponding RSA modulus recommended by NIST. ECC Modulus RSA Prime Size 160 1024 224 2048 ...
2
votes
2answers
164 views

Interpretation of (NIST) Non Overlapping Template Matching Test

Regarding the Non-Overlapping Template test, this test normally gives us a bunch of p-values (148 values). I would like to ask that how do we interpret those values into a single p-value for ...
0
votes
0answers
65 views

NIST ECC Curves without pairings

NIST FIPS.186-4 has standardized 5 ECC curves on field $\mathbb{F}_p$ (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. I need to use ECC curves without pairings for my ...
2
votes
1answer
219 views

KDF based on X9.63 vs. NIST SP800-108

What is the difference between KDF based on NIST SP800-108 vs. the older one in ANSI X9.63? When should one be selected over the other? Thanks.
0
votes
0answers
130 views

Size of group for Elliptic curves vs RSA for equal security

For my research, I would like to compare the efficiency of a scheme when instantiated with Elliptic curves and RSA. So, I would like to know a "latest" comparison (as of 2018) on what group sizes of ...
3
votes
3answers
134 views

Is it correct to concatenate (pseudo-)random byte values before testing them with the NIST suite or tools like dieharder?

Let's assume I have thousands of (pseudo-)random 4-byte values. The values are 4 byte random values which a blackbox device gave me. I got these values by requesting them. In between others might have ...
2
votes
1answer
78 views

adaptation of NIST sp800-22 for short sequences

I would like to ask about the NIST test suite for randomness evaluation. The test suite consists of 15 subtests which evaluate the particular property of the sequence. In fact, each test has an ...
0
votes
1answer
143 views

C# equivalent of openssl ecparam -name prime256v1 -genkey -noout -out [closed]

I am having some issues generating a proper private key,I need it to be an Elliptic Curve private key suitable for use with NIST P-256 which i than need to convert to Base64-encoded private key in ...
0
votes
1answer
59 views

What does approved one-way function mean?

In one of their documents, NIST recommends using an approved one-way function, followed by a list of such functions, such as HMAC, KMAC, etc.. However, the wikipedia page says: Unsolved problem in ...
3
votes
2answers
130 views

Is the IEEE 1363.1 standard of NTRU post-quantum secure?

I have a question regarding the IEEE 1363.1 standard for NTRU with padding, which offers CCA security. Does the IEEE standardized implementation offer post-quantum security as well? Also, what are ...
2
votes
1answer
192 views

Is XTS-AES a NIST-approved nonce-misuse-resistant AES mode?

If I use XTS-AES and treat the tweak as a nonce/IV would the result be considered nonce-misuse-resistant? I'm thinking of something like the following AEAD-like scheme: ...
8
votes
2answers
612 views

Why is pqRSA in the NIST PQC submissions?

In the NIST post-quantum cryptography workshop, the round one submissions included pqRSA. If memory serves, this is an implementation of RSA using the product of a very large number of 4096-bit primes ...
4
votes
1answer
257 views

TLS: Risks of using a NULL cipher with encryption implemented in application?

We have a browser-launched JNLP/WebStart application that is no longer able to establish client-server CORBA/IIOP communications across TLS 1.0/1.1 due to relying on a cipher suite that uses an ...
1
vote
1answer
335 views

Does secp256r1 or secp256k1 use a=-3?

I saw a post here which I think states that for P256, a is equal to -3. Why is elliptic curve parameter $a=-3$ somehow special I am not sure if this is correct, or maybe I am misunderstanding ...
4
votes
2answers
211 views

NIST 800-90B /Non-IID track - min-entropy result > 8 for 8-bit symbol

I'm conducting an analyisis of noise sources based on the NIST 800-90B Non-IID track. Accordingly, I applied the non-iidmain.py script on a datarecord, which delivered the following output: ...
-3
votes
3answers
483 views

How to interpret the entropy results for a NIST test file?

There is test data derived from pi that is supplied by NIST for validating their entropy measurement formulae listed in NIST's Recommendation for the Entropy Sources Used for Random Bit Generation. ...
-4
votes
1answer
420 views

Do the NIST tools on GitHub measure entropy reliably? [closed]

There is a supposed NIST tool called SP800-90B_EntropyAssessment on that Git thing. It's designed to be used in accordance with NIST's Recommendation for the Entropy Sources Used for Random Bit ...
6
votes
2answers
240 views

Are my random numbers really “bad” or is that a statistical effect which “must” happen from time to time?

My software uses a TRNG (entropy source) which is part of an MCU. A check of random numbers generated by my software, carried out by a testing authority revealed a problem, which I have to examine ...
14
votes
1answer
2k views

What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?

When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n. Since both point to similar constructions (read: hashing algorithms with the same ...
4
votes
1answer
302 views

Why is counter mode encryption with a 16-byte cipher block not broken?

We determine a system IND-CPA secure when an adversary has a negligible advantage after any feasible amount of queries. AES256-GCM uses a 128bit block cipher. We know that the distinguishability ...
2
votes
1answer
271 views

NIST vectors for RSA 4K Key

Please suggest the link where I can find out the NIST vectors for 4K Key to test my RSA API.
1
vote
0answers
146 views
0
votes
1answer
128 views

Question regarding NIST's Public-Key Post-Quantum cryptographic public calling

Is NIST's public calling: https://csrc.nist.gov/news/2016/public-key-post-quantum-cryptographic-algorithms ...for a post-Quantum Cryptographic Algorithm a public calling for a public key ...
2
votes
1answer
247 views

Is my block cipher ready for the real world if it passes all AESAVS tests?

If I validate my implementation(s) of Rijndael against the Advanced Encryption Standard Algorithm Validation System (AESAVS) specified validation testing requirements is it fit for purpose and real ...
4
votes
2answers
343 views

RNG failing Restart Tests by NIST SP800-22?

I have data sample of 1,000,000 bytes generated by a hardware RNG. The device is certified by ENT test suite, NIST SP800-22, DIE HARDER and TestU01. I have tested my sample by SP800-...
1
vote
1answer
318 views

How to interpret the article claiming NIST P-256 curve to be unsafe?

Here: http://safecurves.cr.yp.to/ , I read that the NIST P-256 elliptic-curve is not safe. The article lists several aspects (off-curve point, side-channel, etc.) where implementing P256 can fail the ...
0
votes
1answer
242 views

Using NIST SP 800 - 90Ar1 Test Vectors for HMAC_DRBG with Reseeding and AdditionalInput

I'm trying to test my HMAC-DRBG implementation, but I do not understand how the AdditionalInput paramter should be used. From one test case (pr-false): ...
2
votes
1answer
110 views

Is the Keccak family of sponge constructions the same as SHA-3?

I can't seem to come across a clear and to the point answer. Is SHA-3 in the same situation as ElGamal and DSA, where it is modified slightly, or is the original Keccak submission the exact same as ...
2
votes
1answer
158 views

Enumerating the bias of NIST and Pearson randomness extractors

The following is an extract from a paper about using your mobile phone as a true random number generator (TRNG). The mobile phone bit is incidental to this question though. I'm interested in the ...
1
vote
3answers
138 views

Conditioning Component in Entropy Source

Given a sample of random bytes, how to determine if Entropy Source (source of random bytes) includes a Conditioning Component or not, with respect to NIST SP 800-90 B)? Thanks
1
vote
2answers
304 views

Open-source usb TRNG and US standards - Help choosing [closed]

I came across the ChaosKey and I remember the time I came accros the entrypy key that was always out of stock. I would really want one to play with, I would like the best open source I can get for ...
3
votes
1answer
171 views

Does key-length recommendation provided by NIST consider quantum computer?

Here we can see the suggested key-length by NIST in a few decades: https://www.keylength.com/en/4/#Biblio10 Does this consider quantum-computer?
1
vote
2answers
201 views

How to select “good” bits which pass NIST statistical tests x% of the time?

I am trying to implement an algorithm where the first step is to select "good" bits using the NIST test suite. In particular, I have $k$ streams with $n$ bits each. The original paper Toward Sensor-...
2
votes
1answer
556 views

Could someone please explain test vectors of NIST for RSASSA-PSS 1024 bit?

I am new to RSASSA-PSS Signature verification algorithm. Below are the test vectors from NIST but i am not able to understand each parameter. I could understand that SHA1 is used for Hashing and e ...
4
votes
1answer
2k views

NIST Test Vectors for SHA2 and SHA3

I want to run the SHA2 and SHA3 NIST algorithm test vectors provided in the zip files at the bottom of this page: http://csrc.nist.gov/groups/STM/cavp/secure-hashing.html#sha-2 I don't quite ...
0
votes
1answer
562 views

NIST's Methods for Key Wrapping?

NIST has specified a full Mode of Operation for Key wrapping. What are the pros and cons of key wrapping mode of operation as compared to CBC, CTR or authenticated encryption mode?
0
votes
0answers
32 views

Availability of C(2e,1s) KE protocol

For a specific need with embedded system (key establishment with unilateral authentication and pfs) i am looking for a standard c (2e, 1s) key agreement protocol. Unfortunatly it doesn't exist in nist ...
1
vote
1answer
534 views

openssl sha1 message digest not matching with NIST vector input?

When I call openssl sha1 from the command line echo "00" | xxd -r -p | openssl dgst -sha1 the output I am receive is ...
0
votes
1answer
567 views

Cryptographic algorithms compromised and alternatives?

After Edward Snowden's release of top secret information we have seen clues that the NIST certified crypto-algorithms like AES might be compromised. Although not as fast as AES, we prefer Twofish ...
3
votes
1answer
268 views

Is there parameter recommendation of DSA or RSA?

I know there are recommendations of elliptic curve parameters (such as NIST P-xxx). Are there recommendations of DSA (or DLP such as Schnorr signature) or RSA parameters? If not, why?
4
votes
1answer
352 views

Why is a nonce used to initialize Hash_DRBG, HMAC_DRBG, and CTR_DRBG?

In NIST 800-90A, Hash_DRBG, HMAC_DRBG and CTR_DRBG (with derivation function) all require a nonce for instantiation. I understand the usual application for a nonce to prevent replay attacks. However,...