Questions tagged [nist]
The National Institute of Standards and Technology (NIST) is a U.S. federal agency that works with industry to develop and apply technology, measurements, and standards.
200
questions
16
votes
2
answers
3k
views
NIST Diffie-Hellman prime: how was it picked? Where did it come from?
According to this Matasano Crypto challenge, the NIST "likes" the following prime modulus, which appears to be expressed in hexadecimal:
...
- 279
2
votes
1
answer
685
views
Is RSA encryption without padding secure with NIST Key Establishment schemes?
NIST SP800-56B standard (addressing IFC-based Key Establishment schemes) defines some key establishment (KE) schemes using the RSASVE primitive in which the common secret $Z$ is encrypted with RSA-EP ...
- 653
18
votes
1
answer
22k
views
Is there any difference between NIST and SECP curves in-terms of their algorithms and implementation?
I'm implementing ECDSA for NIST P-256 curve. I just want to know if the same implementation will also work for SECP curves? If it doesn't, can you point me to one or more references of algorithms for ...
- 605
2
votes
1
answer
923
views
NIST SP800-108 KDF modes comparison
According to NIST SP800-108, there are three modes that can build KDF from PRF: counter mode, feedback mode and double-pipeline iteration mode. Assume that the same PRF and input distribution are used,...
- 21
0
votes
1
answer
370
views
Scalar multiplication with projective coordinates
I'm implementing point addition, doubling and scalar multiplication using projective coordinates. I took reference from this link.
I have implemented
Routine 2.2.6 (ec_double)
Routine 2.2.7 (ec_add)
...
- 605
5
votes
2
answers
4k
views
How to convert AES to a PRNG in order to run NIST Statistical Test Suite?
I want to run statistical tests on my implementation of AES. How should I convert it into a PRNG? Is there a standard way to go about doing this? I could not find much information about this although ...
- 73
4
votes
1
answer
413
views
What is an impure NIST true random number generator?
I'm working on a true random number generator, and I came across this phrase in the American NIST guide, in section 6.4.1 Non-Approved Conditioning Components:
The entropy rate provided shall be no ...
- 14.8k
0
votes
2
answers
3k
views
NIST tests for AES [closed]
How to do the benchmarking of a self implementation of AES algorithm using NIST test suites?
I am unable to find enough material on the internet regarding this.
- 9
-1
votes
1
answer
610
views
NIST PRIMES - cryptography
I have a problem, If I have $p = \text{P-192} = 2^{192} - 2^{64} - 1$ with the base $2^{64}$
so, $2^{192} \equiv 2^{64} + 1 \pmod p$ the same that $(p=\text{P-192})$
or
$2^{256} \equiv 2^{128} + 2^{...
16
votes
2
answers
5k
views
How do I get the equivalent strength of an ECC key?
I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
- 417
2
votes
0
answers
380
views
How to compute projective coordinate Z in elliptic curve cryptography?
I was working on affine coordinates and struggling with the computation time taken for operations and then I was advised to use projective coordinates so that mul-inverse operation can be avoided
Can ...
- 605
5
votes
1
answer
743
views
More rounds after AES related key attack?
In his blog Schneier discusses that there is a new related key attack on 10 rounds of AES-256 "Another attack can break a 10 round version of AES-256 in 245 time, but it uses a stronger type of ...
- 73
5
votes
1
answer
318
views
A (current or soon-to-be) NIST-recommended alternative to ECC?
So this comes from the professional rumor-mill, and I'm wondering if anyone might either debunk or shed light on this.
My understanding is ECC is generally now preferred over RSA simply due to how ...
- 173
3
votes
1
answer
6k
views
What are the differences between curve NIST P-521 and Edwards E-521 for signature?
I implemented and used the P-521 curve for ECDSA. Signatures are 132 bytes long.
It seems that Edwards E-521 is safer but I did not investigated very deeper.
What is its signature length ?
How is it ...
- 49
1
vote
1
answer
1k
views
Modular reduction for NIST prime P256-- understanding the data
I am working on a project where I need to implement elliptic curve cryptography, I am struggling from a long time in order to understand the working and the process.
Modular finite field arithmetic, ...
- 13
2
votes
3
answers
295
views
Digital signature algorithms within the European Union
I've just noticed that US NIST has accepted DSA as a digital signature standard. Does the European Union have a similar standard, specifying an algorithm to use when digitally signing messages?
I ...
- 123
3
votes
2
answers
556
views
Meaning of entropy of a bitstring in NIST SP 800 - 90A
From NIST SP 800 - 90A from January 2012 (see http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf), page 6:
For the purposes of this Recommendation, an n-bit string is said to have
...
- 77
0
votes
3
answers
522
views
FIPS 113 Computer Data Authentication
on the NIST website for Message authentication There is a mention of 2 approved algorithms, i am curious about the first one. the link to FIPS 113, Computer Data Authentication appears to be dead ...
- 946
2
votes
2
answers
1k
views
Can I use the output from a DRBG directly as K for AES, or do I need to use a key generator algorithm?
NIST has 3 validated "Recommendation for Random Number Generation Using Deterministic Random Bit Generators" (DRBG's) that are based on NIST SP 800-90A:
Hash_DRBG (based on hash functions)
...
- 123
1
vote
1
answer
97
views
Errata for NIST SP 800-63
I'm looking through the latest version of NIST SP 800-63, and there is a table (Table A.1) in the Appendix that supposed give the "entropy" of a password for a 94 character alphabet for various ...
- 219
1
vote
1
answer
857
views
Where I can find a list of certified software / hardware RNGs compliant to NIST SP 800-22?
I need to use NIST SP 800-22 approved software / hardware to generate RSA key pair.
Where I can find a list of certified software / hardware RNGs compliant to NIST SP 800-22?
And how is the SP 800-...
- 563
3
votes
2
answers
2k
views
Why are twofish or other algorithms not NIST approved, are they still safe?
NIST has a total of 3 approved block ciphers on their website: AES, TDES and skipjack.
I get why those are on there (though personally I find TDES a bit iffy) but from my understanding Twofish and ...
- 946
2
votes
1
answer
991
views
test vectors for 3DES seem to in fact be testing DES - not 3DES
NIST SP 800-20 Appendix A has what presumably are supposed to be test vectors for 3DES except almost all of the test vectors utilize 8-byte keys and not the 24-byte keys that 3DES is supposed to have. ...
- 2,855
10
votes
3
answers
2k
views
Will X9.31 remain a secure & acceptable deterministic random generator beyond 2015?
I am actually looking for available crypto libraries including a deterministic random generator for the purpose of a dedicated crypto key generator unit.
I have a simple question about the X9.31 based ...
- 653
3
votes
1
answer
1k
views
What is the use of segments in Cipher Feedback Mode (CFB)
In NIST SP800-38A: Recommendation for Block Cipher Modes of Operation
CFB can be used with a parameter s - the size of a data segment in bits - which determines the ...
- 90.2k
2
votes
1
answer
1k
views
What are these twist attacks with cost $2^{58.4}$ on NIST P-224 curve, and when do they apply?
This page on Twist security mentions a combined attack and a twist rho attack, applicable in particular to NIST P-224 curve with cost $2^{58.4}$ something, with no mention precise definition of ...
- 134k
5
votes
2
answers
4k
views
Interpretation of the results of NIST (p)NRG suite
I have problems interpreting the NIST (sts-2.1.2) suite results. After running the statistics with 100 samples (each sample of 1000000 byte length) a new prng i got this result:
...
- 199
22
votes
1
answer
10k
views
What is the history of recommended RSA key sizes?
One can find up to date recommended key sizes for RSA at NIST sp800-131A for example. In short, it suggests a key size of at least 2048 bits.
Is it possible to find a history of recommended key sizes ...
- 289
7
votes
1
answer
4k
views
What is the difference between “secp…” and “sect…”?
The National Institute of Standards and Technology (NIST) recommended elliptic curve domain parameters to have names such as “secp…” and “sect…”.
For example: “secp224k1” and “sect571k1”.
What is ...
- 159
3
votes
1
answer
198
views
Is my implementation of a PRG at least intuitively secure?
I've devised a PRG using Bezier curves , constructed with Bernstein polynomials, and I was wondering if you guys could help me with some suggestions or constructive criticism.
Basicly I take a random ...
5
votes
1
answer
5k
views
How to specify a NIST SP 800-108 KBKDF
Strange question maybe, but say I want to specify a protocol that complies with NIST SP 800-108. This lists a whole set of key based key derivation functions, with a very loose set of parameters.
How ...
- 90.2k
18
votes
1
answer
6k
views
What are the key differences between the draft SHA-3 standard and the Keccak submission?
I just noticed that on the NIST website there is a PDF with a draft of the SHA-3 standard (i.e. FIPS 202) (marked as "new", and seemingly the page was last changed on April 7, 2014).
Previously it ...
- 22.4k
24
votes
5
answers
5k
views
How useful is NIST's Randomness Beacon for cryptographic use?
NIST have just launched a new service called the NSANIST Randomness Beacon. It has been met with some initial skepticism. Perhaps the cryptography community would have used it before June 2013 when ...
- 351
2
votes
1
answer
531
views
Verifying multiplicative inverse on a prime field in NIST's ECDSA_Prime.pdf
I am trying to learn about the Elliptic Curve Digital Signature Algorithm (ECDSA) by verifying the results in some example calculations. I found a PDF of example ECDSA calculations from NIST here:
...
- 123
5
votes
2
answers
2k
views
Safe elliptic curve point addition using projective coordinates: How do I tell if the points are the same?
I am trying to implement elliptic curve point addition in hardware for NIST p256 and p384 curves. I have noticed the following issue with the suggested NIST routines:
Consider routine 2.2.7 of http://...
- 51
21
votes
2
answers
6k
views
Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?
The NIST elliptic curves P-192, P-224, P-256, P-384, and P-521, prescribed in FIPS 186-4 appendix D.1.2, are generated according to a well defined process, but using an arbitrary random-looking seed ...
- 134k
17
votes
1
answer
2k
views
Did NIST verify “post-quantum” claims in the SHA3 proposal papers?
I have been reading Bernstein’s “Quantum attacks against Blue Midnight Wish, ECHO, Fugue, Grøstl, Hamsi, JH, Keccak, Shabal, SHAvite-3, SIMD, and Skein” paper from 2010…
This document disproves the ...
- 17.7k
12
votes
4
answers
3k
views
Do any non-US ciphers exist?
Plenty of ciphers come out of the USA from government research or selection competitions. AES and DES are examples.
Are there any public ciphers produced by other states, China or Iran for example? ...
user9070
24
votes
1
answer
6k
views
How exactly was the finalist chosen in the NIST AES competition?
I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen:
Unfortunately the NIST site is down so I can't gain further information ...
- 341
5
votes
3
answers
2k
views
NIST temporarily closed — will that have a negative impact on the future of cryptography?
For those who didn't notice yet, in the USA, the National Institute of Standards and Technology(NIST) has been shut down temporarily because of the poor fiscal situation of the USA.
The text at their ...
- 17.7k
3
votes
1
answer
7k
views
When NIST disallows the use of 1024-bit keys, what effect will that have on SHA-3 (with max. 512 bits)?
Quoting the article Gone in 60 Months or Less:
The National Institute of Standards and Technology (NIST) has disallowed the use of 1024-bit keys after 31 December 2013 because they are insecure. ...
- 17.7k
24
votes
3
answers
3k
views
Are NIST's changes to Keccak/SHA-3 problematic?
NIST is working on standardizing SHA-3. They have selected Keccak as the basis for SHA-3, and they plan to make some small changes to it; the result (with NIST's changes) will be standardized as SHA-...
- 36k
2
votes
1
answer
836
views
Hide a weakness in ECC by choosing the prime or one of the curve coefficients
Suppose you are given a value $c$. Can you find a prime $p$ and an integer $b$ such that the elliptic curve
$$E: y^2 \equiv x^3 -3x + b \pmod p$$
is cryptographically weak? You need to choose $p,b$...
- 36k
160
votes
4
answers
52k
views
Should we trust the NIST-recommended ECC parameters?
Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- ...
- 36k
17
votes
1
answer
1k
views
What NIST protocol was allegedly backdoored by NSA in 2006?
From a recent NY Times article:
Cryptographers have long suspected that the agency planted
vulnerabilities in a standard adopted in 2006 by the National
Institute of Standards and Technology ...
- 4,058
12
votes
2
answers
10k
views
Using a Hash as a secure PRNG
I was just looking at some NIST PRNG recommendations, specifically at Hash_DRBG. I read briefly through the algorithm, and even though it is not overly complex, it still seems unnecessary to me. I ...
- 345
10
votes
1
answer
2k
views
Are stream ciphers no longer considered by NIST?
While reading NIST SP 800-90A, "Recommendation for Random Number
Generation Using Deterministic
Random Bit Generators", I noted that no stream cipher was included among the various specified solutions....
- 653
12
votes
1
answer
2k
views
Windows 8/Server 2012: Passes FIPS-140-2 despite failing AES-GCM for IV != 96 bits long?
Background
Microsoft certifies Windows 7/8 as well as Server 2008 R2 and 2012 to be FIPS-140-2 compliant. Actually they certify just a small crypto core, bcrypt.dll (the library, which is unrelated ...
- 1,697
3
votes
1
answer
374
views
Is there a field guide to ECC for the IT Security layman?
I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
- 2,581
0
votes
0
answers
60
views
NIST Standard for Advanced Encryption Standard Algorithm [duplicate]
Possible Duplicate:
Advantage of AES(Rijndael) over Twofish and Serpent
What is the reason of NIST why Rijndael choose as the Advanced Encryption Standard
- 1,727