Skip to main content

Questions tagged [nist]

The National Institute of Standards and Technology (NIST) is a U.S. federal agency that works with industry to develop and apply technology, measurements, and standards.

30 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
12 votes
0 answers
536 views

Requirements for security against multi-target attacks, for McEliece and other code-based cryptosystems?

This question is potentially relevant to NIST post-quantum cryptography standards, involving code-based cryptosystems such as McEliece, BIKE and HQC. For these cryptosystems, it seems that an attacker ...
Ray Perlner's user avatar
6 votes
0 answers
539 views

Is qTesla Secure?

qTesla is a signature scheme and a submission to the NIST post-quantum standardization process, which made it to the second round. It is based on the hardness of RLWE. The NIST round 2 status report ...
a196884's user avatar
  • 381
4 votes
0 answers
84 views

Why Dilithium has options starting from security level 2 and not 1?

I am a newbie to PQC, so forgive my gaps in understanding. Most of the NIST PQC standardization selections have 3 levels of security 1, 3 and 5. It is not the case for Dilithium. IS there any specific ...
Aegon0612's user avatar
3 votes
0 answers
142 views

Does NIST SP800-56C r2 forbid using NIST-approved two-step KDFs for not-all-at-once key-derivations?

NIST SP800-56C r2 added Section 5.3 which specifically addresses using a single Extract step followed by ...
Stan Drapkin's user avatar
3 votes
0 answers
227 views

Inconsistency Between NIST SP800-108 and KBKDFVS

I am attempting to implement a Key Based Key Derivation Function (KBKDF) in Counter Mode as part of a larger project. To test my implementation, I was directed towards the Verification System for this ...
Luke Kennedy's user avatar
2 votes
0 answers
52 views

What's the lattice dimension of the uSVP for attacking CRYSTALS-Dilithium-128?

I am trying to understand the process of transitioning from a NIST standard to the attacks based on of the Unique Shortest Vector Problem (Unique-SVP). Specifically, I am working with Crystals ...
asdf's user avatar
  • 324
2 votes
0 answers
36 views

Safe p-value for NIST randomness test with small sample size

In this journal paper related to physically unclonable function (PUF) [1], the authors used NIST 800-22 test to check if the bitstreams generated by their PUFs are random, which is described as ...
8cold8hot's user avatar
  • 121
2 votes
0 answers
76 views

Why FF2 Format Preserving Encryption Fails

I have just seen that there are 3 feistel based FPE schemes which were proposed FF1,FF2 and FF3( There might be many more). Although there have been different attacks on FF1 and FF3 standard that ...
Crypto_researcher's user avatar
2 votes
0 answers
88 views

What technical flaw in the Secure Hash Standard was the NIST referring to?

On July 11, 1994, the NIST proposed an interesting revision to FIPS 180, about the Secure Hash Standard: A revision of Federal Information Processing Standard (FIPS) 180, Secure Hash Standard (SHS), ...
Patriot's user avatar
  • 3,142
2 votes
0 answers
211 views

NTRU HPS98 vs NTRU-HRSS-KEM vs new NTRU

What is a simple explanation for the difference in terms of key gen, encryption and decryption between the original NTRU (HPS98) and the NTRU candidates submitted in NIST PQ Standardisation? Round 1 - ...
evernal's user avatar
  • 237
2 votes
0 answers
82 views

Is NIST testing all the round 2 submissions to quantum-resistant crypto?

Is NIST confirming the self-published quantum-resistant crypto round 2 data and do they make that available to the public when they do?
elsa's user avatar
  • 41
2 votes
0 answers
400 views

How to compute projective coordinate Z in elliptic curve cryptography?

I was working on affine coordinates and struggling with the computation time taken for operations and then I was advised to use projective coordinates so that mul-inverse operation can be avoided Can ...
abejoe's user avatar
  • 605
2 votes
1 answer
167 views

Provably secure cryptography in blockchains

Do you know a blockchain that does not use at all cryptographic primitives standardized by USA or other countries? It is strange to me that the security of many cryptocurrencies is based on ciphers, ...
Dimitri Koshelev's user avatar
2 votes
1 answer
163 views

Mapping between NIST test and TRNG features

Each of the NIST tests are generally explained in Random Bit Generation - Guide to the Statistical Tests. I was wondering if some one can help me understand them better. For example, which tests show ...
Shannon's user avatar
  • 263
1 vote
0 answers
27 views

Is the random number analiser software reliable for performing Nist 800_22 test

I am working on generating pseudo random numbers from a chaotic oscillator's signal. In literature I have read about the Nist 800-22 test used for checking randomness. I friend gave me a software &...
B Dilany's user avatar
1 vote
0 answers
142 views

What’s the relationship between P-256 and Dual EC DRBG?

It is said that Dual EC DRBG has a backdoor given the values of the curve. Hence some people do not trust it. With that in mind, some people also distrust NIST P-256 Curve. Why? Is it purely because ...
Eduardo Andrés Castillo Perera's user avatar
1 vote
1 answer
791 views

Input size recomendation of sequence for each test in NIST SP 800-22

I am using the NIST SP 800-22 to evaluate the performance of the Random Number Generator. NIST SP 800-22 has a total of 15 tests. In each test, it has a recommendation for the size of the tested ...
Trần An's user avatar
1 vote
0 answers
50 views

Verifiable Base Point generation via NIST SP 800-186 method

I'm looking at D.3.2 Verifiably Random Base Points of NIST SP 800-186. Looks like step 5 is there to ensure that $hashlen > bitLen(q)+1$ and (potentially) discard big $e$, so $t$ is distributed ...
pintor's user avatar
  • 558
1 vote
0 answers
74 views

NIST STS randomness testing inconsistent results

I have generated the nine datasets according to this document for AES-128 and testing these for randomness using NIST STS. However, the results are inconsistent. Sometimes there appear a * in the ...
crypt's user avatar
  • 2,449
1 vote
0 answers
197 views

Primal and dual attack against NTRU

I am looking at the primal attack against schemes in the second round of the NIST Post-Quantum Standardization Project. The cost of primal attack usually comes from an estimate described in NewHope ...
gorte's user avatar
  • 167
1 vote
1 answer
70 views

About two sequence conversion methods in NIST 800-90B

I am reading the 800-90B document. In particular, I'm looking at Chapter 5, the chapter on checking that samples conform to IID. There are 11 tests such as Excursion Test Statistic and Number of ...
pioneer's user avatar
  • 325
1 vote
1 answer
142 views

Why the DRBG can mask the small deviations in the behavior of the entropy source?

In NIST SP 800-90C, it said:"Small deviations in the behavior of the entropy source in an NRBG will be masked by the DRBG output" Why the DRBG can mask the small deviations in the behavior ...
Trần An's user avatar
0 votes
0 answers
37 views

Non-lattice NIST candidates affected by SVP problems

I would like to know if there are non-lattice based NIST submissions that are affected by a polynomial time algorithm to Shortest Vector Problem. Are there known reduction from (e.g.) code based ...
asdf's user avatar
  • 324
0 votes
0 answers
183 views

How to use NIST SP 800-22 to check randomness of 128 bits output in AES?

I am trying NIST SP 800-22 to test the randomness of 128 bit output in AES, but i always get igamc: UNDERFLOW or Segmentation fault (core dumped) error. My data file has 128 bit output format, for ...
Cat Dragon's user avatar
0 votes
0 answers
32 views

How many number of sequences (sample size) should be selected for randomness testing of bock cipher with 256 bits key and block length?

I am working on randomness testing of block cipher. I have gone through the NIST two papers of randomness testing of AES candidate algorithm, links are given below https://csrc.nist.gov/csrc/media/...
Maria Ejaz's user avatar
0 votes
0 answers
803 views

Where to get AES GCM NIST-like test cases

I'm implementing AES GCM 256 bit at the moment. Now I'm finished with copying the content of the standard as a program and now have to make it actually work. With the test cases in the official NIST ...
zvavybir's user avatar
  • 101
0 votes
0 answers
673 views

Signature Generation with RSA PKCS#1 v.15

I am trying to validate my RSA implementation for digital signatures with the test vectors provided by NIST. For now, I am focusing on the tests for signature generation (SigGen15) with the PKCS#1 v....
lucas's user avatar
  • 1
0 votes
0 answers
165 views

NIST ECC Curves without pairings

NIST FIPS.186-4 has standardized 5 ECC curves on field $\mathbb{F}_p$ (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. I need to use ECC curves without pairings for my ...
satya's user avatar
  • 1,414
0 votes
0 answers
599 views

Size of group for Elliptic curves vs RSA for equal security

For my research, I would like to compare the efficiency of a scheme when instantiated with Elliptic curves and RSA. So, I would like to know a "latest" comparison (as of 2018) on what group sizes of ...
satya's user avatar
  • 1,414
0 votes
0 answers
54 views

Availability of C(2e,1s) KE protocol

For a specific need with embedded system (key establishment with unilateral authentication and pfs) i am looking for a standard c (2e, 1s) key agreement protocol. Unfortunatly it doesn't exist in nist ...
william_fr's user avatar