Questions tagged [nist]

The National Institute of Standards and Technology (NIST) is a U.S. federal agency that works with industry to develop and apply technology, measurements, and standards.

Filter by
Sorted by
Tagged with
2
votes
1answer
16 views

Why was Rijndael the only cipher to have a variable number of rounds?

Rijndael was the only AES candidate which defined a different number of rounds for their 128, 192, and 256-bit versions (10, 12, and 14, respectively). The others had a fixed number of rounds (32 for ...
1
vote
1answer
35 views

Where to obtain a common/weak password list (black list)?

The NIST 800-63B publication specifies recommendations regarding memorized secrets (passwords) https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver specifically section "5.1.1 Memorized ...
0
votes
0answers
11 views

Sources about NTRUEncrypt implementations

I'm looking for any source that explains the final implementation of NTRUEncrypt for the NIST's third round as simple as possible. I have been trying to understand it directly from the submitted code ...
0
votes
2answers
105 views

NIST Statistical Test Segmentation Fault (Core dumped)

I am trying to use NIST Statistical Test When I have 1 line number which is includes 7467 character,(all of the are either 1 or 0) the test is working I am following these steps: ./assess 7467, then ...
0
votes
1answer
88 views

Submission to NIST

I have a paper on post quantum cryptography about Key-establishment Algorithms, that I wish to submit it to the National Institute of Standards and Technology (NIST) I found on their website that the ...
2
votes
0answers
40 views

Rounding function used in Saber Key Exchange

In Saber: Module-LWR based key exchange, the authors use a rounding function called $\textit{bits}$, defined (in page 3) as follows: $bits(x, i, j)$, with $j \leq i$, gives $j$ consecutive bits of a ...
0
votes
1answer
42 views

NIST test suite with biased PRNG

Is there a straightforward way to employ NIST Statistical Test Suite for testing a biased generator (e.g. with 0.6 probability of 1)? By straightforward way I mean one not requiring nontrivial code ...
7
votes
1answer
387 views

NewHope and NIST's Post-quantum standardization

Where can I find NIST's reasoning to eliminate NewHope from the 3rd round of the post-quantum competition? I see all the lattice KEMs finalists are based on modules. Is being a ring-based KEM ...
1
vote
0answers
30 views

NIST STS randomness testing inconsistent results

I have generated the nine datasets according to this document for AES-128 and testing these for randomness using NIST STS. However, the results are inconsistent. Sometimes there appear a * in the ...
1
vote
1answer
128 views

ECDSA signature with Brainpool curves in TLS possible?

Even the up to date RFC 8446 lists at the page 41 as the options for the ECDSA in e.g. TLS_ECDHE_ECDSA_WITH_... only NIST curves: ...
3
votes
0answers
51 views

Inconsistency Between NIST SP800-108 and KBKDFVS

I am attempting to implement a Key Based Key Derivation Function (KBKDF) in Counter Mode as part of a larger project. To test my implementation, I was directed towards the Verification System for this ...
1
vote
1answer
45 views

Ranking “amount of randomization” in a sequence

I'm facing the problem of implementing pseudo random bit generator (PRBG) on a very low power device. NIST.SP800-22 "Statistical test suite for Pseudo Random Generators" suggests a suite of ...
5
votes
3answers
189 views

What are the benefits of using AEAD algorithms as MAC

I've seen in 2 places where NIST acknowledge the possibility of using AEAD algorithm for MAC (e.g. page 7 section 5.2 of GCM spec, summary for LAEM on page 6 of LWC status report). And I see 2 ...
0
votes
1answer
95 views

Where can I find NIST SP800-38E's Test vectors?

I am implementing XTS-AES mode in NIST SP800-38E, But I didn't find test vectors about it. Who can help me?
0
votes
0answers
24 views

How to save an encryption key to a binary file to be used in NIST STS

I wrote a simple logistics function that i use for my pesudo random number generator.I want to test it's randomness so i downloaded a custom windows version of NIST STS. the program rqeuires you to ...
1
vote
0answers
55 views

Primal and dual attack against NTRU

I am looking at the primal attack against schemes in the second round of the NIST Post-Quantum Standardization Project. The cost of primal attack usually comes from an estimate described in NewHope ...
1
vote
1answer
93 views

Min Entropy Value for Health Test per NIST 800-90B for 32 bit Noise Source

NIST 800-90B recommends Section 4.4.1 Repetition Count Test & Adaptive Proportion Test for health test on Noise sources. In the equation to calculate the cut-off value C for Repetition Count Test,...
0
votes
2answers
148 views

PRNG next bit test

I would like to know whether a specific PRNG satisfy the next-bit test or not. will satisfying all of NIST statistical tests on PRNG guarantees passing the next-bit test? Or is there a specific ...
1
vote
1answer
160 views

What is the correct way to choose the start parameters for NIST tests? [duplicate]

I had an idea of creating a pseudo-random binary sequence with that code: ...
1
vote
1answer
87 views

Problem with Hash-DRBG's seedlen values (and others)

In NIST-SP-800-90Ar1, the Hash-DRBG is instantiated with hash functions using strange values for seed length (seedlen) such as 440, 888. How are these values derived? How to derive values for other ...
2
votes
1answer
71 views

NIST DRBG algorithms' optional parameter

As I'm going through NIST-SP-800-90Ar1 spec for DRBG, I found the mention of security_strength in all of the 3 specified construct in the document: Hash_DRBG, HMAC_DRBG, CTR_DRBG. However, they're all ...
3
votes
1answer
158 views

Why weak modes of operations are not banned?

If some modes of operations of AES are not secure (like ECB or CBC), which are prone to bit flipping / manipulation attacks, and why they haven't they been banned or advised against by NIST for other ...
2
votes
2answers
198 views

Statistical Analysis of Cryptographic Hashing Algorithms

I was wondering how can I use NIST Statistical Test Suite to check for the randomness of output generated by a cryptographic hashing algorithm, let say SHA-256? To be specific, how will I generate ...
49
votes
4answers
12k views

Why isn’t SHA-3 in wider use?

SHA-3 was released by NIST just over 4 years ago this week. In my experience it does not seem to be as widely used as I might have expected. I see SHA-2 and even SHA-1 more often. What are your ...
2
votes
1answer
116 views

Why does the NIST CTR DRBG apparently output the internal state when no additional input is given?

After reading through the specification of the FIPS CTR_DRBG in SP 800-90A (see Section 10.2.1), I got the impression that the output of the DRBG coincides with its internal state as long as no ...
1
vote
1answer
251 views

Interpretation of certain results of NIST Test Suite

I am using NIST Test suite on a PRNG and have a confusion regarding some specific results. Following is the part of the results: ...
1
vote
2answers
436 views

AIS31 Software and Documentation

I have learned that there are two main test suitcase for randomness (reference): AIS 31 - German Federal Office for Information Security (BSI) SP 800-90B - U.S. National Institute for Standards and ...
1
vote
1answer
307 views

NIST random excursion results

NIST specifies so-called random excursions test and random excursions variant test. From the description I can derive that the number of p-values should be 8 in the first case and 18 in the second. ...
1
vote
2answers
64 views

Help to understand the KDM in SP800-56A, and the usage of “FixedInfo”

Can somebody help me to understand the LOGIC behind Key-Derivation Methods (SP800 56A CH5.8)? This is my common understanding and please correct me if any wrong.. Alice and Bob can general individual ...
1
vote
2answers
135 views

Diffie-Hellman Primitives in SP800-56A

I wonder if someone can give an explain about the different between two Diffie-Hellman Primitives defined in SP800-56A, CH5.7.1 5.7.1.1 Finite Field Cryptography Diffie-Hellman (FFC DH) Primitive 5.7....
2
votes
1answer
181 views

NIST elliptic curves behaving anamolous in OPENSSL benchmark

I tried to collect some benchmarks on NIST elliptic curves using charm library. The charm library is just a wrapper over OPENSSL. I experimented with prime192v1 (P-192), secp224r1 (P-224), prime256v1 (...
2
votes
1answer
1k views

Naming convention for NIST elliptic curves in OPENSSL

NIST standardized 5 elliptic curves (P-192, P-224, P-256, P-384, P-521) for prime fields. When I looked into openssl, these curves are named as prime192v1, secp224r1, prime256v1, secp384r1, secp521r1. ...
5
votes
1answer
143 views

NTRUencrypt in NIST competition

Why did the NTRUencrypt team not maintain the NTRU1024 release in the NIST second-round competition? Is this because of the speed performance or security performance or other things?
2
votes
0answers
77 views

Is NIST testing all the round 2 submissions to quantum-resistant crypto?

Is NIST confirming the self-published quantum-resistant crypto round 2 data and do they make that available to the public when they do?
2
votes
1answer
102 views

Mapping between NIST test and TRNG features

Each of the NIST tests are generally explained in Random Bit Generation - Guide to the Statistical Tests. I was wondering if some one can help me understand them better. For example, which tests show ...
4
votes
1answer
1k views

What are the advantages of SM3 and SM4 compared to NIST-approved algorithms (SHA3 and AES)

Armv8.4-A will add extended support for more cryptographic primitives, to include SM3, which is a cryptographic hash function used in the Chinese National Standard; and SM4, a 128-bit block cipher; ...
2
votes
1answer
225 views

How does the Signature Scheme in Picnic Works

I am trying to understand how signature scheme proposed to NIST, Picnic, works. The propossal uses ZKboo and ZKboo++ as their basis. I can see how the ZKPoK works, where the witness x is some key ...
1
vote
1answer
143 views

Are there any NIST curves with pairings?

NIST FIPS.186-4 has standardized 5 ECC curves on field 𝔽𝑝 (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. None of them seem to have pairings. Are there any standard ...
4
votes
1answer
537 views

Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?

I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the ...
4
votes
2answers
433 views

What's the reason for Monte Carlo tests for block ciphers?

NIST specifies that implementations were required to create Monte Carlo test vectors for ECB and CBC mode for the AES competition. What's the reason for these tests? The only thing I can think of is ...
0
votes
0answers
317 views

Signature Generation with RSA PKCS#1 v.15

I am trying to validate my RSA implementation for digital signatures with the test vectors provided by NIST. For now, I am focusing on the tests for signature generation (SigGen15) with the PKCS#1 v....
2
votes
1answer
170 views

NIST STS incorrect results for sample files

So I wanted to check the outcome of a hardware TRNG and see if its entropy is good enough. I downloaded the source files for statistical test suit from nist.gov website, compiled them on my macOS ...
2
votes
1answer
182 views

NIST security categories (post quantum)

Here (https://www.safecrypto.eu/pqclounge/round-2-candidates/) are collected all the proposals which passed the first round of NIST Post-Quantum Cryptography Standardisation process. What does the ...
1
vote
2answers
228 views

What are known metrics for TRNG?

I was wondering what the known metrics are for studying the randomness of TRNG (besides NIST tests). For example, for PUFs, there are known metrics such as uniformity, uniqueness, BER, etc.
1
vote
0answers
69 views

Participant workflow in the Cryptography competitions [closed]

I learned about the NIST hash function competition which generated SHA3. It says it inspired a Password hashing competition too, which resulted in Argon2. What I'm wondering is what people generally ...
18
votes
2answers
1k views

Is there a contingency plan in the event of a catastrophic attack on AES?

NIST selected Rijndael in 2000 to be AES. In a paper from the Serpent authors, they mention that there was the possibility of choosing a second cipher as a backup in the case of any severe breaks: ...
4
votes
1answer
127 views

Magic Number to calculate number of rounds for M-R in FIPS 186-4

In Fips 186-4, there is an algorithm in Appendix F (at page 117 in my copy of the 2013 version) to calculate the number of rounds of the Miller-Rabin primality test to random bases. Does anybody ...
16
votes
2answers
1k views

How did || come to be used in crypto texts to represent concatenation?

In RFC5647, NIST SP 800-38D, etc., || is used to denote concatenation. How did that come to be? In most programming languages ||...
0
votes
1answer
979 views

Equivalent RSA modulus for NIST P-192 and P-521 elliptic curves [duplicate]

At www.keylength.com, I found the following table of ECC field size and the corresponding RSA modulus recommended by NIST. ECC Modulus RSA Prime Size 160 1024 224 2048 ...
2
votes
2answers
736 views

Interpretation of (NIST) Non Overlapping Template Matching Test

Regarding the Non-Overlapping Template test, this test normally gives us a bunch of p-values (148 values). I would like to ask that how do we interpret those values into a single p-value for ...