Questions tagged [nist]
The National Institute of Standards and Technology (NIST) is a U.S. federal agency that works with industry to develop and apply technology, measurements, and standards.
34
questions
160
votes
4
answers
53k
views
Should we trust the NIST-recommended ECC parameters?
Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- ...
- 36.2k
-2
votes
3
answers
2k
views
How to interpret the entropy results for a NIST test file?
There is test data derived from pi that is supplied by NIST for validating their entropy measurement formulae listed in NIST's Recommendation for the Entropy Sources Used for Random Bit Generation. ...
- 15.1k
24
votes
1
answer
6k
views
How exactly was the finalist chosen in the NIST AES competition?
I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen:
Unfortunately the NIST site is down so I can't gain further information ...
- 341
22
votes
2
answers
7k
views
Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?
The NIST elliptic curves P-192, P-224, P-256, P-384, and P-521, prescribed in FIPS 186-4 appendix D.1.2, are generated according to a well defined process, but using an arbitrary random-looking seed ...
- 138k
12
votes
2
answers
10k
views
Using a Hash as a secure PRNG
I was just looking at some NIST PRNG recommendations, specifically at Hash_DRBG. I read briefly through the algorithm, and even though it is not overly complex, it still seems unnecessary to me. I ...
- 345
2
votes
3
answers
571
views
Conditioning Component in Entropy Source
Given a sample of random bytes, how to determine if Entropy Source (source of random bytes) includes a Conditioning Component or not, with respect to NIST SP 800-90 B)?
Thanks
- 389
18
votes
1
answer
6k
views
What are the key differences between the draft SHA-3 standard and the Keccak submission?
I just noticed that on the NIST website there is a PDF with a draft of the SHA-3 standard (i.e. FIPS 202) (marked as "new", and seemingly the page was last changed on April 7, 2014).
Previously it ...
- 22.5k
16
votes
2
answers
5k
views
How do I get the equivalent strength of an ECC key?
I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
- 497
4
votes
1
answer
270
views
What is the NIST recommended maximum bias for random number generators?
What is the maximum bias recommended by NIST for random number generators?
This answer says that it is $2^{-64}$.
Is it same for all applications? Does NIST have a publication with more information?
I ...
- 319
3
votes
1
answer
1k
views
What is the use of segments in Cipher Feedback Mode (CFB)
In NIST SP800-38A: Recommendation for Block Cipher Modes of Operation
CFB can be used with a parameter s - the size of a data segment in bits - which determines the ...
- 91.7k
24
votes
3
answers
3k
views
Are NIST's changes to Keccak/SHA-3 problematic?
NIST is working on standardizing SHA-3. They have selected Keccak as the basis for SHA-3, and they plan to make some small changes to it; the result (with NIST's changes) will be standardized as SHA-...
- 36.2k
13
votes
2
answers
2k
views
Why is pqRSA in the NIST PQC submissions?
In the NIST post-quantum cryptography workshop, the round one submissions included pqRSA. If memory serves, this is an implementation of RSA using the product of a very large number of 4096-bit primes ...
- 15.1k
6
votes
2
answers
725
views
NIST 800-90B /Non-IID track - min-entropy result > 8 for 8-bit symbol
I'm conducting an analyisis of noise sources based on the NIST 800-90B Non-IID track.
Accordingly, I applied the non-iidmain.py script on a datarecord, which delivered the following output:
...
- 61
6
votes
1
answer
776
views
More rounds after AES related key attack?
In his blog Schneier discusses that there is a new related key attack on 10 rounds of AES-256 "Another attack can break a 10 round version of AES-256 in 245 time, but it uses a stronger type of ...
- 83
3
votes
1
answer
498
views
Enumerating the bias of NIST and Pearson randomness extractors
The following is an extract from a paper about using your mobile phone as a true random number generator (TRNG). The mobile phone bit is incidental to this question though. I'm interested in the ...
- 15.1k
2
votes
1
answer
127
views
NIST algorithm testing results
I have an algorithm that encrypts large text. I want to test this algorithm on statistical tests. The ciphertext contains ~10,000,000 bits. I decided to test the ...
- 143
2
votes
1
answer
883
views
Hide a weakness in ECC by choosing the prime or one of the curve coefficients
Suppose you are given a value $c$. Can you find a prime $p$ and an integer $b$ such that the elliptic curve
$$E: y^2 \equiv x^3 -3x + b \pmod p$$
is cryptographically weak? You need to choose $p,b$...
- 36.2k
1
vote
1
answer
281
views
Problem with Hash-DRBG's seedlen values (and others)
In NIST-SP-800-90Ar1, the Hash-DRBG is instantiated with hash functions using strange values for seed length (seedlen) such as 440, 888.
How are these values derived? How to derive values for other ...
- 9,001
57
votes
4
answers
18k
views
Why isn’t SHA-3 in wider use?
SHA-3 was released by NIST just over 4 years ago this week. In my experience it does not seem to be as widely used as I might have expected. I see SHA-2 and even SHA-1 more often. What are your ...
- 762
25
votes
5
answers
5k
views
How useful is NIST's Randomness Beacon for cryptographic use?
NIST have just launched a new service called the NSANIST Randomness Beacon. It has been met with some initial skepticism. Perhaps the cryptography community would have used it before June 2013 when ...
- 361
14
votes
1
answer
2k
views
What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?
When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n. Since both point to similar constructions (read: hashing algorithms with the same ...
- 17.8k
12
votes
4
answers
3k
views
Do any non-US ciphers exist?
Plenty of ciphers come out of the USA from government research or selection competitions. AES and DES are examples.
Are there any public ciphers produced by other states, China or Iran for example? ...
user9070
6
votes
1
answer
814
views
Why was Rijndael the only cipher to have a variable number of rounds?
Rijndael was the only AES candidate which defined a different number of rounds for their 128, 192, and 256-bit versions (10, 12, and 14, respectively). The others had a fixed number of rounds (32 for ...
- 15.1k
5
votes
1
answer
295
views
Why is an ephemeral key required to prove possession of a static private key in Key-Establishment Schemes
In the NIST 800-56A rev3 "Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography" in section 5.6.2.2.3.2 "Recipient Obtains Assurance [of the ...
- 117
5
votes
2
answers
4k
views
Interpretation of the results of NIST (p)NRG suite
I have problems interpreting the NIST (sts-2.1.2) suite results. After running the statistics with 100 samples (each sample of 1000000 byte length) a new prng i got this result:
...
- 209
5
votes
2
answers
5k
views
How to specify a NIST SP 800-108 KBKDF
Strange question maybe, but say I want to specify a protocol that complies with NIST SP 800-108. This lists a whole set of key based key derivation functions, with a very loose set of parameters.
How ...
- 91.7k
4
votes
3
answers
115
views
Question about confidence interval in NIST SP 800 22
I want to ask about the confidence interval in NIST SP 800 22 so I can make sure I got it right. When evaluating the randomness of many binary strings, for example 1000 binary strings. In the NIST SP ...
- 117
3
votes
1
answer
2k
views
NIST random test suite choosing bitstream length and count [closed]
I am trying to use the statistical test suite software from NIST SP800-2.
First it asks for bitstream length.
...
- 143
3
votes
2
answers
596
views
Why does NIST SP 800-90C RBG3 construction require XOR or reseeding a DRBG with a physical entropy source to produce full entropy?
NIST 800-90C defines 3 classes of random bit generation (RBG) constructions: RBG1, RBG2 and RBG3. All constructions must include a DRBG from NIST SP 800-90A. The particular construction in question is ...
- 65
2
votes
1
answer
551
views
Verifying multiplicative inverse on a prime field in NIST's ECDSA_Prime.pdf
I am trying to learn about the Elliptic Curve Digital Signature Algorithm (ECDSA) by verifying the results in some example calculations. I found a PDF of example ECDSA calculations from NIST here:
...
- 123
2
votes
1
answer
1k
views
NIST random excursion results
NIST specifies so-called random excursions test and random excursions variant test. From the description I can derive that the number of p-values should be 8 in the first case and 18 in the second. ...
- 589
2
votes
2
answers
1k
views
Can I use the output from a DRBG directly as K for AES, or do I need to use a key generator algorithm?
NIST has 3 validated "Recommendation for Random Number Generation Using Deterministic Random Bit Generators" (DRBG's) that are based on NIST SP 800-90A:
Hash_DRBG (based on hash functions)
...
- 123
1
vote
1
answer
2k
views
Equivalent RSA modulus for NIST P-192 and P-521 elliptic curves [duplicate]
At www.keylength.com, I found the following table of ECC field size and the corresponding RSA modulus recommended by NIST.
ECC Modulus RSA Prime Size
160 1024
224 2048
...
- 1,384
-3
votes
1
answer
882
views
Do the NIST tools on GitHub measure entropy reliably? [closed]
There is a supposed NIST tool called SP800-90B_EntropyAssessment on that Git thing. It's designed to be used in accordance with NIST's Recommendation for the Entropy Sources Used for Random Bit ...
- 15.1k