Questions tagged [nist]
The National Institute of Standards and Technology (NIST) is a U.S. federal agency that works with industry to develop and apply technology, measurements, and standards.
209
questions
160
votes
4
answers
53k
views
Should we trust the NIST-recommended ECC parameters?
Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- ...
- 36.2k
57
votes
4
answers
18k
views
Why isn’t SHA-3 in wider use?
SHA-3 was released by NIST just over 4 years ago this week. In my experience it does not seem to be as widely used as I might have expected. I see SHA-2 and even SHA-1 more often. What are your ...
- 762
25
votes
5
answers
5k
views
How useful is NIST's Randomness Beacon for cryptographic use?
NIST have just launched a new service called the NSANIST Randomness Beacon. It has been met with some initial skepticism. Perhaps the cryptography community would have used it before June 2013 when ...
- 361
24
votes
3
answers
3k
views
Are NIST's changes to Keccak/SHA-3 problematic?
NIST is working on standardizing SHA-3. They have selected Keccak as the basis for SHA-3, and they plan to make some small changes to it; the result (with NIST's changes) will be standardized as SHA-...
- 36.2k
24
votes
1
answer
6k
views
How exactly was the finalist chosen in the NIST AES competition?
I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen:
Unfortunately the NIST site is down so I can't gain further information ...
- 341
22
votes
2
answers
7k
views
Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?
The NIST elliptic curves P-192, P-224, P-256, P-384, and P-521, prescribed in FIPS 186-4 appendix D.1.2, are generated according to a well defined process, but using an arbitrary random-looking seed ...
- 138k
22
votes
1
answer
10k
views
What is the history of recommended RSA key sizes?
One can find up to date recommended key sizes for RSA at NIST sp800-131A for example. In short, it suggests a key size of at least 2048 bits.
Is it possible to find a history of recommended key sizes ...
- 289
18
votes
1
answer
25k
views
Is there any difference between NIST and SECP curves in-terms of their algorithms and implementation?
I'm implementing ECDSA for NIST P-256 curve. I just want to know if the same implementation will also work for SECP curves? If it doesn't, can you point me to one or more references of algorithms for ...
- 605
18
votes
1
answer
6k
views
What are the key differences between the draft SHA-3 standard and the Keccak submission?
I just noticed that on the NIST website there is a PDF with a draft of the SHA-3 standard (i.e. FIPS 202) (marked as "new", and seemingly the page was last changed on April 7, 2014).
Previously it ...
- 22.5k
17
votes
1
answer
2k
views
Did NIST verify “post-quantum” claims in the SHA3 proposal papers?
I have been reading Bernstein’s “Quantum attacks against Blue Midnight Wish, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Shabal, SHAvite-3, SIMD, and Skein” paper from 2010…
This document disproves the ...
- 17.8k
17
votes
2
answers
2k
views
Is there a contingency plan in the event of a catastrophic attack on AES?
NIST selected Rijndael in 2000 to be AES. In a paper from the Serpent authors, they mention that there was the possibility of choosing a second cipher as a backup in the case of any severe breaks:
...
- 15.1k
17
votes
1
answer
1k
views
What NIST protocol was allegedly backdoored by NSA in 2006?
From a recent NY Times article:
Cryptographers have long suspected that the agency planted
vulnerabilities in a standard adopted in 2006 by the National
Institute of Standards and Technology ...
- 4,128
16
votes
2
answers
3k
views
NIST Diffie-Hellman prime: how was it picked? Where did it come from?
According to this Matasano Crypto challenge, the NIST "likes" the following prime modulus, which appears to be expressed in hexadecimal:
...
- 279
16
votes
2
answers
3k
views
How did || come to be used in crypto texts to represent concatenation?
In RFC5647, NIST SP 800-38D, etc., || is used to denote concatenation. How did that come to be?
In most programming languages || ...
- 2,895
16
votes
2
answers
5k
views
How do I get the equivalent strength of an ECC key?
I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
- 497
14
votes
1
answer
2k
views
What was NIST’s reason to switch naming from MD… (Message Digest) to SHA… (Secure Hashing Algorithm)?
When NIST introduced SHA-0 in 1993, they – for the first time – switched their naming convention from MD-n to SHA-n. Since both point to similar constructions (read: hashing algorithms with the same ...
- 17.8k
13
votes
2
answers
2k
views
Why is pqRSA in the NIST PQC submissions?
In the NIST post-quantum cryptography workshop, the round one submissions included pqRSA. If memory serves, this is an implementation of RSA using the product of a very large number of 4096-bit primes ...
- 15.1k
12
votes
4
answers
3k
views
Do any non-US ciphers exist?
Plenty of ciphers come out of the USA from government research or selection competitions. AES and DES are examples.
Are there any public ciphers produced by other states, China or Iran for example? ...
user9070
12
votes
2
answers
2k
views
Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?
I have seen in many papers and even in communications from NIST that the ongoing standardization is a "procedure" or a "process". They carefully refrain from using the term ...
- 1,265
12
votes
2
answers
10k
views
Using a Hash as a secure PRNG
I was just looking at some NIST PRNG recommendations, specifically at Hash_DRBG. I read briefly through the algorithm, and even though it is not overly complex, it still seems unnecessary to me. I ...
- 345
12
votes
1
answer
2k
views
Windows 8/Server 2012: Passes FIPS-140-2 despite failing AES-GCM for IV != 96 bits long?
Background
Microsoft certifies Windows 7/8 as well as Server 2008 R2 and 2012 to be FIPS-140-2 compliant. Actually they certify just a small crypto core, bcrypt.dll (the library, which is unrelated ...
- 1,697
12
votes
1
answer
698
views
Number of bit-operations required for information set decoding attacks on code-based cryptosystems?
This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC.
This paper estimates the concrete number of bit ...
- 341
12
votes
0
answers
524
views
Requirements for security against multi-target attacks, for McEliece and other code-based cryptosystems?
This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC.
For these cryptosystems, it seems that an attacker ...
- 341
10
votes
3
answers
2k
views
Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?
I am actually looking for available crypto libraries including a deterministic random generator for the purpose of a dedicated crypto key generator unit.
I have a simple question about the X9.31 based ...
- 653
10
votes
1
answer
2k
views
Are stream ciphers no longer considered by NIST?
While reading NIST SP 800-90A, "Recommendation for Random Number
Generation Using Deterministic
Random Bit Generators", I noted that no stream cipher was included among the various specified solutions....
- 653
8
votes
1
answer
643
views
NewHope and NIST's Post-quantum standardization
Where can I find NIST's reasoning to eliminate NewHope from the 3rd round of the post-quantum competition? I see all the lattice KEMs finalists are based on modules.
Is being a ring-based KEM ...
- 1,265
8
votes
1
answer
2k
views
NSA removed EC-256 and SHA-256 from CNSA recently--should we be alarmed by this?
Recently, the NSA (re-published?) their CNSA guidelines and some information on post-quantum computers (per the title of the document).
Here's the link for convenience (document is titled, 'Quantum ...
- 135
7
votes
1
answer
5k
views
Why are NIST curves still used?
I'm relatively new to the world of crypto (But as far as the math goes, I am familiar with the inner workings. I used to rarely use it for privacy, but now I use it for many things).
Anyway, I was ...
- 243
7
votes
1
answer
4k
views
What are the advantages of SM3 and SM4 compared to NIST-approved algorithms (SHA3 and AES)
Armv8.4-A will add extended support for more cryptographic primitives, to include SM3, which is a cryptographic hash function used in the Chinese National Standard; and SM4, a 128-bit block cipher; ...
- 2,074
7
votes
2
answers
2k
views
Difference between RFC-5869 (HKDF) and SP800-108 (Nist's HMAC-based KDF spec)?
I'm trying to find the difference between the two aforementioned algorithms. It seems that one is either a subset of the other. Could someone explain the similarities/differences?
- 173
7
votes
1
answer
210
views
What is the status of the NIST Lightweight Cryptography Standardisation Process?
The NIST Computer Security Resource Center called for nominations for a process to standardise lightweight symmetric primitives in August 2018.
In the update talk in the 2019 Lightweight Cryptography ...
- 21.9k
7
votes
1
answer
4k
views
What is the difference between “secp…” and “sect…”?
The National Institute of Standards and Technology (NIST) recommended elliptic curve domain parameters to have names such as “secp…” and “sect…”.
For example: “secp224k1” and “sect571k1”.
What is ...
- 189
6
votes
2
answers
450
views
Are my random numbers really "bad" or is that a statistical effect which "must" happen from time to time?
My software uses a TRNG (entropy source) which is part of an MCU.
A check of random numbers generated by my software, carried out by a testing authority revealed a problem, which I have to examine ...
- 1,477
6
votes
1
answer
814
views
Why was Rijndael the only cipher to have a variable number of rounds?
Rijndael was the only AES candidate which defined a different number of rounds for their 128, 192, and 256-bit versions (10, 12, and 14, respectively). The others had a fixed number of rounds (32 for ...
- 15.1k
6
votes
1
answer
778
views
More rounds after AES related key attack?
In his blog Schneier discusses that there is a new related key attack on 10 rounds of AES-256 "Another attack can break a 10 round version of AES-256 in 245 time, but it uses a stronger type of ...
- 83
6
votes
1
answer
1k
views
How often to reseed the NIST CTR_DRBG with AES256_CTR
Even at a high consumption rate of 100,000 generations per second, it would take decades to exhaust the NIST recommended reseed interval of 2**48 invocations of DRBG _generate(). Should one even care ...
- 75
6
votes
1
answer
1k
views
How many blocks can securely be encrypted with XTS
I could not find in the NIST recommendations on XTS how many blocks can securely be encrypted with XTS-AES.
Through the recommendations, I've found:
The length of the data unit for any instance of ...
6
votes
1
answer
287
views
Is there a good rundown anywhere on the NIST vs CNRS patent disputes on lattice cryptography?
As I understand it from web conference hearsay, the Kyber and Saber entries to the NIST post quantum cryptography competition have been subject to a patent claim from the CNRS. The creators of the ...
- 201
6
votes
2
answers
726
views
NIST 800-90B /Non-IID track - min-entropy result > 8 for 8-bit symbol
I'm conducting an analyisis of noise sources based on the NIST 800-90B Non-IID track.
Accordingly, I applied the non-iidmain.py script on a datarecord, which delivered the following output:
...
- 61
6
votes
0
answers
432
views
Is qTesla Secure?
qTesla is a signature scheme and a submission to the NIST post-quantum standardization process, which made it to the second round. It is based on the hardness of RLWE. The NIST round 2 status report ...
- 381
5
votes
3
answers
2k
views
NIST temporarily closed — will that have a negative impact on the future of cryptography?
For those who didn't notice yet, in the USA, the National Institute of Standards and Technology(NIST) has been shut down temporarily because of the poor fiscal situation of the USA.
The text at their ...
- 17.8k
5
votes
3
answers
985
views
What are the benefits of using AEAD algorithms as MAC
I've seen in 2 places where NIST acknowledge the possibility of using AEAD algorithm for MAC (e.g. page 7 section 5.2 of GCM spec, summary for LAEM on page 6 of LWC status report).
And I see 2 ...
- 9,001
5
votes
2
answers
2k
views
Safe elliptic curve point addition using projective coordinates: How do I tell if the points are the same?
I am trying to implement elliptic curve point addition in hardware for NIST p256 and p384 curves. I have noticed the following issue with the suggested NIST routines:
Consider routine 2.2.7 of http://...
- 51
5
votes
2
answers
1k
views
What's the reason for Monte Carlo tests for block ciphers?
NIST specifies that implementations were required to create Monte Carlo test vectors for ECB and CBC mode for the AES competition.
What's the reason for these tests? The only thing I can think of is ...
- 91.8k
5
votes
4
answers
305
views
What is the significance of the results of the NIST PQC competition?
I hope this is not offtopic.
Since NIST has rather recently announced the winners of its PQC competition I was wondering how significant this development is. Does that mean that CRYSTALS-Kyber will ...
- 617
5
votes
1
answer
1k
views
Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?
Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process?
Both are mentioned in the final ...
- 153
5
votes
2
answers
4k
views
How to convert AES to a PRNG in order to run NIST Statistical Test Suite?
I want to run statistical tests on my implementation of AES. How should I convert it into a PRNG? Is there a standard way to go about doing this? I could not find much information about this although ...
- 73
5
votes
2
answers
4k
views
Interpretation of the results of NIST (p)NRG suite
I have problems interpreting the NIST (sts-2.1.2) suite results. After running the statistics with 100 samples (each sample of 1000000 byte length) a new prng i got this result:
...
- 209
5
votes
1
answer
296
views
Why is an ephemeral key required to prove possession of a static private key in Key-Establishment Schemes
In the NIST 800-56A rev3 "Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography" in section 5.6.2.2.3.2 "Recipient Obtains Assurance [of the ...
- 117
5
votes
2
answers
4k
views
Explanation of CAVP format for NIST Test Vectors for SHA-2 and 3
I want to run the SHA2 and SHA3 NIST algorithm test vectors provided in the zip files at the bottom of this page:
http://csrc.nist.gov/groups/STM/cavp/secure-hashing.html#sha-2
I don't quite ...
- 151