Questions tagged [nist]
The National Institute of Standards and Technology (NIST) is a U.S. federal agency that works with industry to develop and apply technology, measurements, and standards.
200
questions
1
vote
1
answer
148
views
Error Correcting Codes Post Quantum Finalists
I have been looking into error-correcting codes in lattice, I am specifically hoping to find some information on hardware implementations for the NIST PQ PKE/KEM finalists (Saber, CRYSTALS-Kyber, NTRU)...
- 51
12
votes
2
answers
2k
views
Why NIST insists on post-quantum standardization procedure rather than post-quantum competition?
I have seen in many papers and even in communications from NIST that the ongoing standardization is a "procedure" or a "process". They carefully refrain from using the term ...
- 1,235
4
votes
1
answer
263
views
What is the NIST recommended maximum bias for random number generators?
What is the maximum bias recommended by NIST for random number generators?
This answer says that it is $2^{-64}$.
Is it same for all applications? Does NIST have a publication with more information?
I ...
- 319
2
votes
2
answers
410
views
How much data can we encrypt using AES 256 before changing the key?
Although this question has been answered in this link (After How Much Data Encryption (AES-256) we should change key?), I am not satisfied with the answers because the Recommendation for Block Cipher ...
- 21
1
vote
1
answer
195
views
How does TLS 1.3 work with PQC signatures?
I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512.
Do PQC signatures work the same as modern algorithms in TLS 1.3?
- 95
1
vote
1
answer
214
views
What is the security strength of McEliece variants?
Please help me understand the security strength of McEliece variants prepared for Round 3.
I looked at the specifications - https://classic.mceliece.org/nist/mceliece-20201010.pdf - it doesn't have ...
- 123
1
vote
1
answer
177
views
Meaning of Dilithium-1024x768 or Dilithium2
Can someone explain me the meaning of 1024 and 768 in Dilithium-1024x768 in the algorithm? And the meaning of 2 in Dilithium2 in the algorithm?
- 95
2
votes
0
answers
82
views
What technical flaw in the Secure Hash Standard was the NIST referring to?
On July 11, 1994, the NIST proposed an interesting revision to FIPS 180, about the Secure Hash Standard:
A revision of Federal Information Processing Standard (FIPS) 180,
Secure Hash Standard (SHS), ...
- 3,092
2
votes
0
answers
137
views
NTRU HPS98 vs NTRU-HRSS-KEM vs new NTRU
What is a simple explanation for the difference in terms of key gen, encryption and decryption between the original NTRU (HPS98) and the NTRU candidates submitted in NIST PQ Standardisation?
Round 1 - ...
- 237
6
votes
1
answer
787
views
Why was Rijndael the only cipher to have a variable number of rounds?
Rijndael was the only AES candidate which defined a different number of rounds for their 128, 192, and 256-bit versions (10, 12, and 14, respectively). The others had a fixed number of rounds (32 for ...
- 14.9k
1
vote
1
answer
124
views
Where to obtain a common/weak password list (black list)?
The NIST 800-63B publication specifies recommendations regarding memorized secrets (passwords)
https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver
specifically section "5.1.1 Memorized ...
- 171
-1
votes
2
answers
1k
views
NIST Statistical Test Segmentation Fault (Core dumped)
I am trying to use NIST Statistical Test
When I have 1 line number which is includes 7467 character,(all of the are either 1 or 0) the test is working
I am following these steps: ./assess 7467, then ...
- 141
0
votes
1
answer
150
views
Submission to NIST
I have a paper on post quantum cryptography about Key-establishment Algorithms, that I wish to submit it to the National Institute of Standards and Technology (NIST)
I found on their website that the ...
- 415
2
votes
1
answer
186
views
Rounding function used in Saber Key Exchange
In Saber: Module-LWR based key exchange, the authors use a rounding function called $\textit{bits}$, defined (in page 3) as follows:
$bits(x, i, j)$, with $j \leq i$, gives $j$ consecutive bits of a ...
- 381
0
votes
1
answer
137
views
NIST test suite with biased PRNG
Is there a straightforward way to employ NIST Statistical Test Suite for testing a biased generator (e.g. with 0.6 probability of 1)? By straightforward way I mean one not requiring nontrivial code ...
8
votes
1
answer
598
views
NewHope and NIST's Post-quantum standardization
Where can I find NIST's reasoning to eliminate NewHope from the 3rd round of the post-quantum competition? I see all the lattice KEMs finalists are based on modules.
Is being a ring-based KEM ...
- 1,235
1
vote
0
answers
46
views
NIST STS randomness testing inconsistent results
I have generated the nine datasets according to this document for AES-128 and testing these for randomness using NIST STS. However, the results are inconsistent. Sometimes there appear a * in the ...
- 2,377
2
votes
2
answers
700
views
ECDSA signature with Brainpool curves in TLS possible?
Even the up to date RFC 8446 lists at the page 41 as the options for the ECDSA in e.g. TLS_ECDHE_ECDSA_WITH_... only NIST curves:
...
- 31
3
votes
0
answers
181
views
Inconsistency Between NIST SP800-108 and KBKDFVS
I am attempting to implement a Key Based Key Derivation Function (KBKDF) in Counter Mode as part of a larger project. To test my implementation, I was directed towards the Verification System for this ...
- 31
1
vote
1
answer
59
views
Ranking "amount of randomization" in a sequence
I'm facing the problem of implementing pseudo random bit generator (PRBG) on a very low power device. NIST.SP800-22 "Statistical test suite for Pseudo Random Generators" suggests a suite of ...
- 1,068
5
votes
3
answers
848
views
What are the benefits of using AEAD algorithms as MAC
I've seen in 2 places where NIST acknowledge the possibility of using AEAD algorithm for MAC (e.g. page 7 section 5.2 of GCM spec, summary for LAEM on page 6 of LWC status report).
And I see 2 ...
- 8,291
0
votes
1
answer
616
views
Where can I find NIST SP800-38E's Test vectors?
I am implementing XTS-AES mode in NIST SP800-38E, But I didn't find test vectors about it.
Who can help me?
- 57
1
vote
0
answers
157
views
Primal and dual attack against NTRU
I am looking at the primal attack against schemes in the second round of the NIST Post-Quantum Standardization Project. The cost of primal attack usually comes from an estimate described in NewHope ...
- 167
1
vote
1
answer
218
views
Min Entropy Value for Health Test per NIST 800-90B for 32 bit Noise Source
NIST 800-90B recommends Section 4.4.1 Repetition Count Test & Adaptive Proportion Test for health test on Noise sources.
In the equation to calculate the cut-off value C for Repetition Count Test,...
0
votes
2
answers
385
views
PRNG next bit test
I would like to know whether a specific PRNG satisfy the next-bit test or not.
will satisfying all of NIST statistical tests on PRNG guarantees passing the next-bit test? Or is there a specific ...
- 15
1
vote
1
answer
516
views
What is the correct way to choose the start parameters for NIST tests? [duplicate]
I had an idea of creating a pseudo-random binary sequence with that code:
...
- 15
1
vote
1
answer
231
views
Problem with Hash-DRBG's seedlen values (and others)
In NIST-SP-800-90Ar1, the Hash-DRBG is instantiated with hash functions using strange values for seed length (seedlen) such as 440, 888.
How are these values derived? How to derive values for other ...
- 8,291
2
votes
1
answer
132
views
NIST DRBG algorithms' optional parameter
As I'm going through NIST-SP-800-90Ar1 spec for DRBG, I found the mention of security_strength in all of the 3 specified construct in the document: Hash_DRBG, HMAC_DRBG, CTR_DRBG. However, they're all ...
- 8,291
3
votes
1
answer
304
views
Why weak modes of operations are not banned?
If some modes of operations of AES are not secure (like ECB or CBC), which are prone to bit flipping / manipulation attacks, and why they haven't they been banned or advised against by NIST for other ...
- 125
2
votes
2
answers
398
views
Statistical Analysis of Cryptographic Hashing Algorithms
I was wondering how can I use NIST Statistical Test Suite to check for the randomness of output generated by a cryptographic hashing algorithm, let say SHA-256?
To be specific, how will I generate ...
- 39
56
votes
4
answers
17k
views
Why isn’t SHA-3 in wider use?
SHA-3 was released by NIST just over 4 years ago this week. In my experience it does not seem to be as widely used as I might have expected. I see SHA-2 and even SHA-1 more often. What are your ...
- 752
2
votes
1
answer
284
views
Why does the NIST CTR DRBG apparently output the internal state when no additional input is given?
After reading through the specification of the FIPS CTR_DRBG in SP 800-90A (see Section 10.2.1), I got the impression that the output of the DRBG coincides with its internal state as long as no ...
- 21
2
votes
1
answer
586
views
Interpretation of certain results of NIST Test Suite
I am using NIST Test suite on a PRNG and have a confusion regarding some specific results. Following is the part of the results:
...
- 123
2
votes
3
answers
2k
views
AIS31 Software and Documentation
I have learned that there are two main test suitcase for randomness (reference):
AIS 31 - German Federal Office for Information Security (BSI)
SP 800-90B - U.S. National Institute for Standards and ...
- 263
2
votes
1
answer
938
views
NIST random excursion results
NIST specifies so-called random excursions test and random excursions variant test. From the description I can derive that the number of p-values should be 8 in the first case and 18 in the second. ...
- 589
0
votes
2
answers
88
views
Help to understand the KDM in SP800-56A, and the usage of "FixedInfo"
Can somebody help me to understand the LOGIC behind Key-Derivation Methods (SP800 56A CH5.8)?
This is my common understanding and please correct me if any wrong..
Alice and Bob can general individual ...
- 111
1
vote
2
answers
290
views
Diffie-Hellman Primitives in SP800-56A
I wonder if someone can give an explain about the different between two Diffie-Hellman Primitives defined in SP800-56A, CH5.7.1
5.7.1.1 Finite Field Cryptography Diffie-Hellman (FFC DH) Primitive
5.7....
- 111
1
vote
1
answer
340
views
NIST elliptic curves behaving anamolous in OPENSSL benchmark
I tried to collect some benchmarks on NIST elliptic curves using charm library. The charm library is just a wrapper over OPENSSL. I experimented with prime192v1 (P-192), secp224r1 (P-224), prime256v1 (...
- 1,354
3
votes
1
answer
4k
views
Naming convention for NIST elliptic curves in OPENSSL
NIST standardized 5 elliptic curves (P-192, P-224, P-256, P-384, P-521) for prime fields. When I looked into openssl, these curves are named as prime192v1, secp224r1, prime256v1, secp384r1, secp521r1. ...
- 1,354
5
votes
1
answer
206
views
NTRUencrypt in NIST competition
Why did the NTRUencrypt team not maintain the NTRU1024 release in the NIST second-round competition?
Is this because of the speed performance or security performance or other things?
- 87
2
votes
0
answers
81
views
Is NIST testing all the round 2 submissions to quantum-resistant crypto?
Is NIST confirming the self-published quantum-resistant crypto round 2 data and do they make that available to the public when they do?
- 41
2
votes
1
answer
148
views
Mapping between NIST test and TRNG features
Each of the NIST tests are generally explained in Random Bit Generation - Guide to the Statistical Tests. I was wondering if some one can help me understand them better. For example, which tests show ...
- 263
5
votes
1
answer
3k
views
What are the advantages of SM3 and SM4 compared to NIST-approved algorithms (SHA3 and AES)
Armv8.4-A will add extended support for more cryptographic primitives, to include SM3, which is a cryptographic hash function used in the Chinese National Standard; and SM4, a 128-bit block cipher; ...
- 1,990
3
votes
1
answer
391
views
How does the Signature Scheme in Picnic Works
I am trying to understand how signature scheme proposed to NIST, Picnic, works.
The proposal uses $\textsf{ZKboo}$ and $\textsf{ZKboo++}$ as their basis. I can see how the ZKPoK works, where the ...
- 852
1
vote
1
answer
199
views
Are there any NIST curves with pairings?
NIST FIPS.186-4 has standardized 5 ECC curves on field 𝔽𝑝 (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. None of them seem to have pairings. Are there any standard ...
- 1,354
4
votes
1
answer
1k
views
Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?
I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the ...
- 163
5
votes
2
answers
907
views
What's the reason for Monte Carlo tests for block ciphers?
NIST specifies that implementations were required to create Monte Carlo test vectors for ECB and CBC mode for the AES competition.
What's the reason for these tests? The only thing I can think of is ...
- 90.2k
0
votes
0
answers
585
views
Signature Generation with RSA PKCS#1 v.15
I am trying to validate my RSA implementation for digital signatures with the test vectors provided by NIST. For now, I am focusing on the tests for signature generation (SigGen15) with the PKCS#1 v....
- 1
2
votes
1
answer
239
views
NIST STS incorrect results for sample files
So I wanted to check the outcome of a hardware TRNG and see if its entropy is good enough. I downloaded the source files for statistical test suit from nist.gov website, compiled them on my macOS ...
- 23
2
votes
1
answer
249
views
NIST security categories (post quantum)
Here (https://www.safecrypto.eu/pqclounge/round-2-candidates/) are collected all the proposals which passed the first round of NIST Post-Quantum Cryptography Standardisation process. What does the ...
- 123