Questions tagged [nist]

The National Institute of Standards and Technology (NIST) is a U.S. federal agency that works with industry to develop and apply technology, measurements, and standards.

Filter by
Sorted by
Tagged with
2
votes
1answer
176 views

Is the Keccak family of sponge constructions the same as SHA-3?

I can't seem to come across a clear and to the point answer. Is SHA-3 in the same situation as ElGamal and DSA, where it is modified slightly, or is the original Keccak submission the exact same as ...
2
votes
1answer
359 views

Enumerating the bias of NIST and Pearson randomness extractors

The following is an extract from a paper about using your mobile phone as a true random number generator (TRNG). The mobile phone bit is incidental to this question though. I'm interested in the ...
2
votes
3answers
402 views

Conditioning Component in Entropy Source

Given a sample of random bytes, how to determine if Entropy Source (source of random bytes) includes a Conditioning Component or not, with respect to NIST SP 800-90 B)? Thanks
1
vote
2answers
461 views

Open-source usb TRNG and US standards - Help choosing [closed]

I came across the ChaosKey and I remember the time I came accros the entrypy key that was always out of stock. I would really want one to play with, I would like the best open source I can get for ...
2
votes
1answer
183 views

Does key-length recommendation provided by NIST consider quantum computer?

Here we can see the suggested key-length by NIST in a few decades: https://www.keylength.com/en/4/#Biblio10 Does this consider quantum-computer?
1
vote
2answers
436 views

How to select "good" bits which pass NIST statistical tests x% of the time?

I am trying to implement an algorithm where the first step is to select "good" bits using the NIST test suite. In particular, I have $k$ streams with $n$ bits each. The original paper Toward Sensor-...
2
votes
1answer
1k views

Could someone please explain test vectors of NIST for RSASSA-PSS 1024 bit?

I am new to RSASSA-PSS Signature verification algorithm. Below are the test vectors from NIST but i am not able to understand each parameter. I could understand that SHA1 is used for Hashing and e ...
5
votes
2answers
3k views

Explanation of CAVP format for NIST Test Vectors for SHA-2 and 3

I want to run the SHA2 and SHA3 NIST algorithm test vectors provided in the zip files at the bottom of this page: http://csrc.nist.gov/groups/STM/cavp/secure-hashing.html#sha-2 I don't quite ...
1
vote
1answer
984 views

NIST's Methods for Key Wrapping?

NIST has specified a full Mode of Operation for Key wrapping. What are the pros and cons of key wrapping mode of operation as compared to CBC, CTR or authenticated encryption mode?
0
votes
0answers
41 views

Availability of C(2e,1s) KE protocol

For a specific need with embedded system (key establishment with unilateral authentication and pfs) i am looking for a standard c (2e, 1s) key agreement protocol. Unfortunatly it doesn't exist in nist ...
1
vote
1answer
667 views

openssl sha1 message digest not matching with NIST vector input?

When I call openssl sha1 from the command line echo "00" | xxd -r -p | openssl dgst -sha1 the output I am receive is ...
0
votes
1answer
843 views

Cryptographic algorithms compromised and alternatives?

After Edward Snowden's release of top secret information we have seen clues that the NIST certified crypto-algorithms like AES might be compromised. Although not as fast as AES, we prefer Twofish ...
2
votes
1answer
490 views

Is there parameter recommendation of DSA or RSA?

I know there are recommendations of elliptic curve parameters (such as NIST P-xxx). Are there recommendations of DSA (or DLP such as Schnorr signature) or RSA parameters? If not, why?
3
votes
1answer
498 views

Why is a nonce used to initialize Hash_DRBG, HMAC_DRBG, and CTR_DRBG?

In NIST 800-90A, Hash_DRBG, HMAC_DRBG and CTR_DRBG (with derivation function) all require a nonce for instantiation. I understand the usual application for a nonce to prevent replay attacks. However,...
6
votes
1answer
901 views

How often to reseed the NIST CTR_DRBG with AES256_CTR

Even at a high consumption rate of 100,000 generations per second, it would take decades to exhaust the NIST recommended reseed interval of 2**48 invocations of DRBG _generate(). Should one even care ...
7
votes
2answers
2k views

Difference between RFC-5869 (HKDF) and SP800-108 (Nist's HMAC-based KDF spec)?

I'm trying to find the difference between the two aforementioned algorithms. It seems that one is either a subset of the other. Could someone explain the similarities/differences?
3
votes
1answer
2k views

NIST random test suite choosing bitstream length and count [closed]

I am trying to use the statistical test suite software from NIST SP800-2. First it asks for bitstream length. ...
5
votes
1answer
678 views

How many blocks can securely be encrypted with XTS

I could not find in the NIST recommendations on XTS how many blocks can securely be encrypted with XTS-AES. Through the recommendations, I've found: The length of the data unit for any instance of ...
15
votes
2answers
3k views

NIST Diffie-Hellman prime: how was it picked? Where did it come from?

According to this Matasano Crypto challenge, the NIST "likes" the following prime modulus, which appears to be expressed in hexadecimal: ...
2
votes
1answer
526 views

Is RSA encryption without padding secure with NIST Key Establishment schemes?

NIST SP800-56B standard (addressing IFC-based Key Establishment schemes) defines some key establishment (KE) schemes using the RSASVE primitive in which the common secret $Z$ is encrypted with RSA-EP ...
10
votes
1answer
14k views

Is there any difference between NIST and SECP curves in-terms of their algorithms and implementation?

I'm implementing ECDSA for NIST P-256 curve. I just want to know if the same implementation will also work for SECP curves? If it doesn't, can you point me to one or more references of algorithms for ...
2
votes
1answer
777 views

NIST SP800-108 KDF modes comparison

According to NIST SP800-108, there are three modes that can build KDF from PRF: counter mode, feedback mode and double-pipeline iteration mode. Assume that the same PRF and input distribution are used,...
0
votes
1answer
252 views

Scalar multiplication with projective coordinates

I'm implementing point addition, doubling and scalar multiplication using projective coordinates. I took reference from this link https://www.nsa.gov/ia/_files/nist-routines.pdf I have implemented ...
5
votes
2answers
3k views

How to convert AES to a PRNG in order to run NIST Statistical Test Suite?

I want to run statistical tests on my implementation of AES. How should I convert it into a PRNG? Is there a standard way to go about doing this? I could not find much information about this although ...
3
votes
1answer
361 views

What is an impure NIST true random number generator?

I'm working on a true random number generator, and I came across this phrase in the American NIST guide, in section 6.4.1 Non-Approved Conditioning Components: The entropy rate provided shall be no ...
0
votes
2answers
3k views

NIST tests for AES [closed]

How to do the benchmarking of a self implementation of AES algorithm using NIST test suites? I am unable to find enough material on the internet regarding this.
-1
votes
1answer
513 views

NIST PRIMES - cryptography

I have a problem, If I have $p = \text{P-192} = 2^{192} - 2^{64} - 1$ with the base $2^{64}$ so, $2^{192} \equiv 2^{64} + 1 \pmod p$ the same that $(p=\text{P-192})$ or $2^{256} \equiv 2^{128} + 2^{...
15
votes
2answers
4k views

How do I get the equivalent strength of an ECC key?

I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
2
votes
0answers
336 views

How to compute projective coordinate Z in elliptic curve cryptography?

I was working on affine coordinates and struggling with the computation time taken for operations and then I was advised to use projective coordinates so that mul-inverse operation can be avoided Can ...
4
votes
1answer
650 views

More rounds after AES related key attack?

In his blog Schneier discusses that there is a new related key attack on 10 rounds of AES-256 "Another attack can break a 10 round version of AES-256 in 245 time, but it uses a stronger type of ...
5
votes
1answer
287 views

A (current or soon-to-be) NIST-recommended alternative to ECC?

So this comes from the professional rumor-mill, and I'm wondering if anyone might either debunk or shed light on this. My understanding is ECC is generally now preferred over RSA simply due to how ...
3
votes
1answer
5k views

What are the differences between curve NIST P-521 and Edwards E-521 for signature?

I implemented and used the P-521 curve for ECDSA. Signatures are 132 bytes long. It seems that Edwards E-521 is safer but I did not investigated very deeper. What is its signature length ? How is it ...
1
vote
1answer
1k views

Modular reduction for NIST prime P256-- understanding the data

I am working on a project where I need to implement elliptic curve cryptography, I am struggling from a long time in order to understand the working and the process. Modular finite field arithmetic, ...
2
votes
3answers
272 views

Digital signature algorithms within the European Union

I've just noticed that US NIST has accepted DSA as a digital signature standard. Does the European Union have a similar standard, specifying an algorithm to use when digitally signing messages? I ...
3
votes
2answers
504 views

Meaning of entropy of a bitstring in NIST SP 800 - 90A

From NIST SP 800 - 90A from January 2012 (see http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf), page 6: For the purposes of this Recommendation, an n-bit string is said to have ...
0
votes
3answers
446 views

FIPS 113 Computer Data Authentication

on the NIST website for Message authentication There is a mention of 2 approved algorithms, i am curious about the first one. the link to FIPS 113, Computer Data Authentication appears to be dead ...
2
votes
2answers
917 views

Can I use the output from a DRBG directly as K for AES, or do I need to use a key generator algorithm?

NIST has 3 validated "Recommendation for Random Number Generation Using Deterministic Random Bit Generators" (DRBG's) that are based on NIST SP 800-90A: Hash_DRBG (based on hash functions) ...
1
vote
1answer
90 views

Errata for NIST SP 800-63

I'm looking through the latest version of NIST SP 800-63, and there is a table (Table A.1) in the Appendix that supposed give the "entropy" of a password for a 94 character alphabet for various ...
1
vote
1answer
776 views

Where I can find a list of certified software / hardware RNGs compliant to NIST SP 800-22?

I need to use NIST SP 800-22 approved software / hardware to generate RSA key pair. Where I can find a list of certified software / hardware RNGs compliant to NIST SP 800-22? And how is the SP 800-...
3
votes
2answers
2k views

Why are twofish or other algorithms not NIST approved, are they still safe?

NIST has a total of 3 approved block ciphers on their website: AES, TDES and skipjack. I get why those are on there (though personally I find TDES a bit iffy) but from my understanding Twofish and ...
2
votes
1answer
948 views

test vectors for 3DES seem to in fact be testing DES - not 3DES

NIST SP 800-20 Appendix A has what presumably are supposed to be test vectors for 3DES except almost all of the test vectors utilize 8-byte keys and not the 24-byte keys that 3DES is supposed to have. ...
8
votes
3answers
1k views

Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?

I am actually looking for available crypto libraries including a deterministic random generator for the purpose of a dedicated crypto key generator unit. I have a simple question about the X9.31 based ...
3
votes
1answer
1k views

What is the use of segments in Cipher Feedback Mode (CFB)

In NIST SP800-38A: Recommendation for Block Cipher Modes of Operation CFB can be used with a parameter s - the size of a data segment in bits - which determines the ...
2
votes
1answer
989 views

What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?

This page on Twist security mentions a combined attack and a twist rho attack, applicable in particular to NIST P-224 curve with cost $2^{58.4}$ something, with no mention precise definition of ...
5
votes
2answers
3k views

Interpretation of the results of NIST (p)NRG suite

I have problems interpreting the NIST (sts-2.1.2) suite results. After running the statistics with 100 samples (each sample of 1000000 byte length) a new prng i got this result: ...
21
votes
1answer
9k views

What is the history of recommended RSA key sizes?

One can find up to date recommended key sizes for RSA at NIST sp800-131A for example. In short, it suggests a key size of at least 2048 bits. Is it possible to find a history of recommended key sizes ...
5
votes
1answer
4k views

What is the difference between “secp…” and “sect…”?

The National Institute of Standards and Technology (NIST) recommended elliptic curve domain parameters to have names such as “secp…” and “sect…”. For example: “secp224k1” and “sect571k1”. What is ...
3
votes
1answer
183 views

Is my implementation of a PRG at least intuitively secure?

I've devised a PRG using Bezier curves , constructed with Bernstein polynomials, and I was wondering if you guys could help me with some suggestions or constructive criticism. Basicly I take a random ...
5
votes
1answer
4k views

How to specify a NIST SP 800-108 KBKDF

Strange question maybe, but say I want to specify a protocol that complies with NIST SP 800-108. This lists a whole set of key based key derivation functions, with a very loose set of parameters. How ...
15
votes
1answer
5k views

What are the key differences between the draft SHA-3 standard and the Keccak submission?

I just noticed that on the NIST website there is a PDF with a draft of the SHA-3 standard (i.e. FIPS 202) (marked as "new", and seemingly the page was last changed on April 7, 2014). Previously it ...