Questions tagged [nist]
The National Institute of Standards and Technology (NIST) is a U.S. federal agency that works with industry to develop and apply technology, measurements, and standards.
209
questions
2
votes
1
answer
499
views
Input size recomendation of sequence for each test in NIST SP 800-22
I am using the NIST SP 800-22 to evaluate the performance of the Random Number Generator.
NIST SP 800-22 has a total of 15 tests. In each test, it has a recommendation for the size of the tested ...
CommunityBot
- 1
160
votes
4
answers
53k
views
Should we trust the NIST-recommended ECC parameters?
Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- ...
- 47.6k
0
votes
0
answers
33
views
Non-lattice NIST candidates affected by SVP problems
I would like to know if there are non-lattice based NIST submissions that are affected by a polynomial time algorithm to Shortest Vector Problem. Are there known reduction from (e.g.) code based ...
- 304
3
votes
2
answers
1k
views
How to interpret the article claiming NIST P-256 curve to be unsafe?
Here: http://safecurves.cr.yp.to/ , I read that the NIST P-256 elliptic-curve is not safe.
The article lists several aspects (off-curve point, side-channel, etc.) where implementing P256 can fail the ...
- 148
1
vote
1
answer
103
views
Interpretation of NIST suite test results with asterisks
I have a question on how to interpret test results of NIST test suite.
First, when the asterisk mark appear on the report, what does it mean? I thought it means the random sequence fails the test. ...
- 138k
2
votes
2
answers
119
views
NIST random number generators ASCII input file format problem
I have temporal data from experiment and by setting a threshold, I convert them to zeros and ones. I saved these binary bits to txt file (normal txt file from MATLAB) with each line has 32 bits (total ...
- 138k
2
votes
1
answer
56
views
NIST random number tests report
I am using the NIST test suite to test random binary numbers. when I tried it for data.pi, the generated report has some items that can not be interpreted.
for example, the coeffecients named C0~C10. ...
- 15.1k
5
votes
2
answers
5k
views
How to specify a NIST SP 800-108 KBKDF
Strange question maybe, but say I want to specify a protocol that complies with NIST SP 800-108. This lists a whole set of key based key derivation functions, with a very loose set of parameters.
How ...
- 301
1
vote
0
answers
93
views
Can someone give a comprehensive guide on how to run NIST SP 800 90B entropy assessment c code in windows? [closed]
I am trying to run the github code in windows 11. I don't know what all I need to install in my laptop to run the C++ code. It would be a great help if someone can point out the steps to run the code.
- 11
3
votes
2
answers
103
views
A HRNG that is NIST 800-90 compliant is not suitable for use for OTP generation right?
A HRNG that is NIST 800-90 compliant must use a DRBG in some way regardless of whether it adheres to a RBG1, RBG2 RBG3(XOR), or RBG3(RS) construction. This violates the requirement that the OTP is ...
- 15.1k
3
votes
2
answers
596
views
Why does NIST SP 800-90C RBG3 construction require XOR or reseeding a DRBG with a physical entropy source to produce full entropy?
NIST 800-90C defines 3 classes of random bit generation (RBG) constructions: RBG1, RBG2 and RBG3. All constructions must include a DRBG from NIST SP 800-90A. The particular construction in question is ...
- 15.1k
1
vote
1
answer
87
views
Use of PRNG's vulnerability for attacking a cryptographic system
I am investigating a PRNG which fails some of NIST tests (FFT, ApproximateEntropy and Serial). If such a generator is used in cryptography for any purpose, what consequences can it has? How this ...
- 138k
0
votes
0
answers
118
views
How to use NIST SP 800-22 to check randomness of 128 bits output in AES?
I am trying NIST SP 800-22 to test the randomness of 128 bit output in AES, but i always get igamc: UNDERFLOW or Segmentation fault (core dumped) error.
My data file has 128 bit output format, for ...
- 117
4
votes
3
answers
115
views
Question about confidence interval in NIST SP 800 22
I want to ask about the confidence interval in NIST SP 800 22 so I can make sure I got it right. When evaluating the randomness of many binary strings, for example 1000 binary strings. In the NIST SP ...
- 15.1k
1
vote
1
answer
63
views
getting wrong rsa private exponent (d) for this particular test vector from nist cavp
In 186-2rsatestvectors.zip/SigVerRSA.rsp
...
- 138k
4
votes
2
answers
148
views
Why NIST 800-56A rev3 does not use cross secret calculation in C(2e, 2s, ECC CDH) scheme?
In the NIST 800-56A rev3 "Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography" in section 6.1.1.2 "(Cofactor) Full Unified Model, C(2e, 2s, ECC ...
- 7,629
5
votes
1
answer
295
views
Why is an ephemeral key required to prove possession of a static private key in Key-Establishment Schemes
In the NIST 800-56A rev3 "Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography" in section 5.6.2.2.3.2 "Recipient Obtains Assurance [of the ...
- 7,629
2
votes
1
answer
453
views
What is the relationship between NIST and secp256k1?
While exploring secp256k1, I came across what seems like the official definition at https://www.secg.org/, specifically in https://www.secg.org/sec2-v2.pdf. In terms of authorship, the document only ...
- 21.9k
2
votes
1
answer
149
views
Provably secure cryptography in blockchains
Do you know a blockchain that does not use at all cryptographic primitives standardized by USA or other countries? It is strange to me that the security of many cryptocurrencies is based on ciphers, ...
- 395
0
votes
1
answer
103
views
Rainbow What happened to signatures in the NIST standardization process?
The rainbow signature was not seen in round 4 of the NIST PQC standardization process. Was Rainbow not shortlisted?
- 5,786
2
votes
1
answer
127
views
NIST algorithm testing results
I have an algorithm that encrypts large text. I want to test this algorithm on statistical tests. The ciphertext contains ~10,000,000 bits. I decided to test the ...
- 15.1k
2
votes
0
answers
53
views
NIST statistical tests [duplicate]
I'm having trouble testing a not-so-popular algorithm that I haven't found an implementation of, so I wrote it myself and now I'd like to test it with nist tests, but I have a suspicion that I'm doing ...
- 91.7k
5
votes
4
answers
303
views
What is the significance of the results of the NIST PQC competition?
I hope this is not offtopic.
Since NIST has rather recently announced the winners of its PQC competition I was wondering how significant this development is. Does that mean that CRYSTALS-Kyber will ...
- 1,798
7
votes
1
answer
209
views
What is the status of the NIST Lightweight Cryptography Standardisation Process?
The NIST Computer Security Resource Center called for nominations for a process to standardise lightweight symmetric primitives in August 2018.
In the update talk in the 2019 Lightweight Cryptography ...
- 21.2k
3
votes
1
answer
172
views
What advantages does FrodoKEM have over other PQCs?
What are the advantages of FrodoKEM over other NIST PQC candidates? Also, have any critical vulnerabilities been discovered so far?
- 11.6k
6
votes
0
answers
429
views
Is qTesla Secure?
qTesla is a signature scheme and a submission to the NIST post-quantum standardization process, which made it to the second round. It is based on the hardness of RLWE. The NIST round 2 status report ...
- 15.1k
1
vote
1
answer
207
views
Meaning of Dilithium-1024x768 or Dilithium2
Can someone explain me the meaning of 1024 and 768 in Dilithium-1024x768 in the algorithm? And the meaning of 2 in Dilithium2 in the algorithm?
- 15.1k
3
votes
2
answers
505
views
Break Lattice-Based Cryptography with Variational Quantum Algorithm (only 25 k. Qbits for Kyber1024)?
I am currently writing a seminar paper on Kyber and other lattice-based methods. I was so excited about the lattice-based methods that I also currently searched quantum algorithms to solve the methods....
- 15.1k
1
vote
1
answer
161
views
Error Correcting Codes Post Quantum Finalists
I have been looking into error-correcting codes in lattice, I am specifically hoping to find some information on hardware implementations for the NIST PQ PKE/KEM finalists (Saber, CRYSTALS-Kyber, NTRU)...
- 15.1k
2
votes
0
answers
30
views
Safe p-value for NIST randomness test with small sample size
In this journal paper related to physically unclonable function (PUF) [1], the authors used NIST 800-22 test to check if the bitstreams generated by their PUFs are random, which is described as ...
- 121
1
vote
1
answer
203
views
Where can I find a comprehensive guide to running the NIST SP800-90B_EntropyAssessment?
I am already using the 2 they suggest :
https://github.com/usnistgov/SP800-90B_EntropyAssessment https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf
but, here is where I run into ...
- 15.1k
3
votes
1
answer
109
views
NIST example shows extra hexadecimal characters in Block Contents of SHA512-256
I was recently trying to gain a better understanding of the SHA-512/256 algorithm and on this NIST example they use the word "abc" as the input. In the Block Contents, it shows the expected ...
- 47.6k
3
votes
0
answers
116
views
Does NIST SP800-56C r2 forbid using NIST-approved two-step KDFs for not-all-at-once key-derivations?
NIST SP800-56C r2 added Section 5.3 which specifically addresses using a single Extract step followed by ...
- 43
3
votes
1
answer
468
views
NIST expression for HMAC security strength
In NIST SP800-107, NIST claims that the security strength of HMAC is MIN(security of HMAC key, $2L$). $L$ is the length of the output of the underlying hash function. Let's take HMAC-SHA256 as an ...
- 21.9k
6
votes
1
answer
286
views
Is there a good rundown anywhere on the NIST vs CNRS patent disputes on lattice cryptography?
As I understand it from web conference hearsay, the Kyber and Saber entries to the NIST post quantum cryptography competition have been subject to a patent claim from the CNRS. The creators of the ...
- 47
0
votes
1
answer
94
views
Does the Saber.PKE algorithm submitted in PQC NIST Round3 support the additional homomorphism?
As for the PQC algorithm Saber.PKE based on M-LWR, I wonder whether it supports homomorphic addition operation. According to my related work, the error of this algorithm can be written as $e_S = ||s^{\...
- 1
1
vote
0
answers
237
views
Which quantum resistant digital signature algorithm would you use and why (If you had to pick one now)? [closed]
Context: Many widely used public-key cryptographic schemes have been designed based on the difficulty of factoring and similar problems. That includes RSA, the Diffie-Hellman Key Exchange, ECDH, ...
- 293
4
votes
1
answer
2k
views
Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?
I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the ...
- 91.7k
4
votes
4
answers
4k
views
Why did Google Cloud accept a lower FIPS 140-2 Level compared to IBM Cloud?
FIPS 140-2 is a standard which handles cryptographic modules and the ones that organizations use to encrypt data-at-rest and data-in-motion. FIPS 140-2 has 4 levels of security, with level 1 being the ...
- 1
1
vote
0
answers
111
views
What’s the relationship between P-256 and Dual EC DRBG?
It is said that Dual EC DRBG has a backdoor given the values of the curve. Hence some people do not trust it.
With that in mind, some people also distrust NIST P-256 Curve. Why? Is it purely because ...
0
votes
0
answers
31
views
How many number of sequences (sample size) should be selected for randomness testing of bock cipher with 256 bits key and block length?
I am working on randomness testing of block cipher. I have gone through the NIST two papers of randomness testing of AES candidate algorithm, links are given below
https://csrc.nist.gov/csrc/media/...
1
vote
1
answer
67
views
About two sequence conversion methods in NIST 800-90B
I am reading the 800-90B document.
In particular, I'm looking at Chapter 5, the chapter on checking that samples conform to IID.
There are 11 tests such as Excursion Test Statistic and Number of ...
- 21.2k
0
votes
1
answer
545
views
Alternative to CBC mode encryption?
Given that CBC mode encryption is vulnerable to padding oracle attacks, what is the next best alternative ?
a) Include a hash check in the API scheme, validate the hash and then proceed with CBC. If ...
- 11.7k
2
votes
3
answers
699
views
NIST vs ISO Encryption standardisation process
skinny cipher has been lately considered as ISO/IEC standard while is still competing as building block of Romulus AEAD in NIST LWC finalists.
what is the difference between the two ISO and NIST ...
- 15.1k
2
votes
1
answer
705
views
Comparison of Post Quantum Algorithms in Nist 3rd round
I'm interested in the Post Quantum Algorithms of the 3rd round of the NIST standardization competition. The algorithms for KEM are Classic McEliece, CRYSTALS-KYBER, NTRU, SABER and their 5 ...
- 46
1
vote
2
answers
380
views
How can we measure the security levels of post-quantum cryptographic algorithms? Is there a standard way of this measurement?
How do we measure the security levels of Post Quantum Cryptographic algorithms such as: NTRU Prime, Saber, Kyber,...that are submited to NIST PQC Standardization Process(Competition) in general?
I ...
- 46
2
votes
2
answers
844
views
ECDSA signature with Brainpool curves in TLS possible?
Even the up to date RFC 8446 lists at the page 41 as the options for the ECDSA in e.g. TLS_ECDHE_ECDSA_WITH_... only NIST curves:
...
- 101
25
votes
5
answers
5k
views
How useful is NIST's Randomness Beacon for cryptographic use?
NIST have just launched a new service called the NSANIST Randomness Beacon. It has been met with some initial skepticism. Perhaps the cryptography community would have used it before June 2013 when ...
CommunityBot
- 1
1
vote
0
answers
49
views
Verifiable Base Point generation via NIST SP 800-186 method
I'm looking at D.3.2 Verifiably Random Base Points of NIST SP 800-186. Looks like step 5 is there to ensure that $hashlen > bitLen(q)+1$ and (potentially) discard big $e$, so $t$ is distributed ...
- 548
5
votes
1
answer
209
views
NTRUencrypt in NIST competition
Why did the NTRUencrypt team not maintain the NTRU1024 release in the NIST second-round competition?
Is this because of the speed performance or security performance or other things?
- 15.1k