Questions tagged [nist]

Abreviation for National Institute of Standards and Technology. A USA government institution which publishes standards, most notably the FIPS 140-2 standard for cryptographic modules.

Filter by
Sorted by
Tagged with
60
votes
4answers
32k views

What is SHA-3 and why did we change it?

On the 2nd of October NIST decided that SHA-3 is the new standard hashing algorithm, does this mean we need to stop using SHA-2 as it is not secure? What is this SHA-3 anyway?
33
votes
1answer
41k views

Which is the Best Cipher Mode and Padding Mode for AES Encryption? [closed]

As per PCI-DSS 3.4 requirement: For storing Credit Card Data Strong Cryptography should be used. I decided to use AES Encryption which is a strong and mostly recommended crypto for encrypting Credit ...
25
votes
6answers
7k views

Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?

Context NIST SP 800-63b gives the following guidance for password forms (aka login pages): Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This ...
24
votes
4answers
45k views

Difference between hardening guides (CIS, NSA, DISA)

I'm researching OS hardening and it seems there are a variety of recommended configuration guides. I realize the different configuration providers supply different offerings per Operating System, but ...
21
votes
1answer
2k views

Has SHA-3 Arrived?

I know NIST called for contenders (in 2007) regarding the new hash algorithm to replace SHA-2. Has there been a selection, or finalists selected?
9
votes
2answers
15k views

Password expiration and compliance (ISO, NIST, PCI, etc)

I'm quite confused about what is the current state in 2017 for the idea of password expiration/rotation especially related to security certifications as ISO, PCI, etc. I keep reading that password ...
8
votes
2answers
3k views

More secure curve than Curve25519

As far as I know, Curve25519 offers "only" a security level equal to an 128bit symmetric cipher. I'd like to know if there are new (not NIST) curves, which provide a security-level comparable to a ...
8
votes
2answers
1k views

How can Network Disconnect be implemented for RDP on a Windows system (2003/XP or later)?

From NIST SP 800-53, Rev. 3: SC-10 NETWORK DISCONNECT Control: The information system terminates the network connection associated with a communications session at the end of the session or after [...
7
votes
2answers
2k views

How can IA-5(1)(b) be enforced on Windows systems?

Note: I've also posted a question for this issue on non-Windows systems. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this ...
6
votes
1answer
355 views

Who can certify RNG according NIST SP800-22?

I have written my own random number generator as a C library and I tested it on NIST Statistical Test Suite. Now I would like to get a certification to have a formal proof that my C library generates ...
6
votes
3answers
160 views

Security Testing Methods for Enterprise Level

I have been asked to perform risk assessment for a company. The scope covers about 100 applications and in various business units. Major task is to assess currently implemented security controls and ...
5
votes
2answers
2k views

Why is NIST removing & not updating TLS guidance? What is the replacement?

The document NIST Special Publication 800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations was retired without superseding it with a newer document. In ...
5
votes
1answer
6k views

NIST test vectors for HMAC-SHA-256

I'm working on an implementation of HMAC-SHA-256 in classic ASP (legacy code). I currently have it working, and the resulting values are correct compared to some test cases I came up with along with ...
5
votes
2answers
3k views

What is the recommended expiration for a password reset link?

What is the recommended expiration for a password reset link generated for a user? Citations/ links to NIST guidelines and documentation are very much appreciated.
5
votes
2answers
5k views

What is the format of an X9.62 key?

RFC8292 contains this gem: The "k" parameter includes an ECDSA public key [FIPS186] in uncompressed form [X9.62] that is encoded using base64url encoding [RFC7515]. There is an example of ...
5
votes
1answer
636 views

Practical applications of NIST new password policy

I have previously asked about the application of the NIST Special Publication 800-63-3 (password policy). Password Policy Without a simple way to add a password blacklist to AD, what are the common ...
5
votes
1answer
409 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
5
votes
1answer
212 views

CCM instead of key wrap

Is there any instance of NIST or other encryption standards using AES-CCM to encrypt/authenticate key data? I would like to use CCM over a keywrap function, but cannot find any precedent for this in ...
4
votes
1answer
3k views

API to Get CVE Info [closed]

I'm working on a project that uses an API which gives back CVE IDs. We need to programmatically fetch details about those CVEs. The main thing we need is the CVSS v2 base vector (e.g. AV:A/AC:H/Au:M/C:...
4
votes
1answer
523 views

What are vendor affirmed algorithms in FIPS 140-2

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
4
votes
4answers
439 views

Can you establish a weak/common password policy in Active Directory in line with NIST guidelines?

Does anyone know if it is possible within Active Directory to add a table of 'weak passwords' that will be banned? Looking to align password policies with the new NIST recommendations: https://pages....
4
votes
2answers
471 views

Requirements Placed on a User of a FIPS 140-2 Validated System

Per customer requirements, I am working with a FIPS 140-2 validated network switch that is actually running in FIPS mode. This guarantees that any cryptographic operations the device performs will be ...
4
votes
1answer
180 views

FIPS-2 assumptions (CJIS)

I feel more like a lawyer than an IT admin today. When the CJIS Security Policy states that "The remote administrative personnel connection shall be via an encrypted (FIPS 140-2 certified) path," I'm ...
4
votes
2answers
365 views

How can IA-5(1)(b) be enforced on non-Windows systems?

I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing &...
4
votes
0answers
302 views

Enable FIPS 140.2 in Windows 7 (cng.sys version does not match with versions from NIST Validated list

I am currently working on an application running in Windows 7 Ultimate, and it has to be FIPS 140-2 compliance. As far as I have researched in https://technet.microsoft.com/en-us/library/security/...
3
votes
1answer
1k views

In-Memory Database Storage and Security (MemSQL, Spark, Redis, Geode, et al)

There is a growing trend to utilize more In-Memory Storage for a wide variety of use cases from big data analytics (Spark) to faster processing power (MemSQL) to caching (Redis) most frequently ...
3
votes
2answers
91 views

Incident Response and when to consider an incident resolved

I am currently making amendments to an IR process and the topic of incident closure has come up. The organisation follows NIST and therefore their IR process has four phases: Preparation Detection &...
3
votes
1answer
503 views

What are the NIST/FBI requirements for Fingerprint readers, and Iris scans?

Background I'm trying to locate the US government standard for fingerprint readers and mobile devices. I heard in passing that the iOS fingerprint reader only scans 9 points, where the FBI ...
3
votes
0answers
64 views

What options exist for logging off users after x time of inactivity? [closed]

I'm looking at NIST SC-10, and I thought something simple would exist in Group Policy that would control this, but I haven't been able to find anything built in. Things I've thought about trying: ...
2
votes
3answers
406 views

What are some best practices for WiFi security, in light of recently discovered vulnerabilities?

In the past few months, we've seen the revelation of several WiFi vulnerabilities (eg KRACK). It doesn't look like NIST has updated any of its best practices. How should we configure our enterprise ...
2
votes
3answers
4k views

I need assistance in properly understanding the IA-7 control in NIST SP 800-53

I've recently been working on a number of A&A tasks for the RMF for a US Government entity, and I'm having a hard time properly understanding the IA-7 control of NIST SP 800-53 and the supplement ...
2
votes
1answer
452 views

Why Microsoft claims that SQL Server is the least vulnerable database? [closed]

Microsoft claims in their official site that “SQL Server is the least vulnerable database for six years running in the NIST vulnerabilities database”, I reviewed the NIST web site, but I can’t find a ...
2
votes
1answer
1k views

OpenSSL implemented AES not according to NIST?

I have been using the Encryption/Decryption code from https://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption. The NIST test vectors (http://csrc.nist.gov/groups/STM/cavp/) for AES ...
2
votes
1answer
239 views

Suggestions on satisfying security controls described in NIST SP 800-53?

I recently started working on a project where my role is partially that of a cybersecurity engineer. Reading through the NIST SP 800-53, I understand the necessity of the security controls assigned, ...
2
votes
2answers
151 views

Conflicting requirements in FIPS 140-2 regarding manual key entry

Requirement 1 All output data exiting the cryptographic module via the "data output" interface shall only pass through the output data path. The output data path shall be logically disconnected ...
2
votes
2answers
486 views

Are there currently any standards for Homomorphic encryption?

I am curious if there are any released standards for homomorphic encryption, or computing on encrypted data. Perhaps by NIST, ANSI, or ISO. If not, are there any that are under development right now? ...
2
votes
1answer
730 views

NIST 800-53 rev 4 - CM-7(2) implementation on Linux

NIST 800-53 rev 4 CM-7(2) states: (2) LEAST FUNCTIONALITY | PREVENT PROGRAM EXECUTION The information system employs automated mechanisms to prevent program execution in accordance with [Selection (...
2
votes
1answer
1k views

ISO and Password Security

I have to go through background check. The company providing the service to the client is called Verifications, Inc. Verifications, Inc claims to have a data security plan, ISO certification and US ...
2
votes
1answer
2k views

What is the exactly mean of these CPE file fields?

I am working in the development of an application that have to download and parse this CPE file definition: http://static.nvd.nist.gov/feeds/xml/cpe/dictionary/official-cpe-dictionary_v2.3.xml My ...
2
votes
1answer
72 views

How to tell if Microsoft office has been patched for a vulnerability?

The NIST database holds records for Microsoft Office vulnerabilities, however it only lists the application (i.e. Word 2016) and the service pack. Microsoft release hotfixes outside of service packs, ...
2
votes
1answer
34 views

Periods in Common Platform Enumeration WFN (NIST Interagency Report 7695 )

I’m looking at NIST Interagency Report 7695 and the grammar described in 5.3.2 seems to say that all . need to be preceded by a \, but this doesn’t seem to be followed in the CPE dictionary. Am I ...
2
votes
1answer
122 views

What does the field vuln-security-protection stand-for in the NVD cve lists 2.0?

In the different NVD files which enumerates the CVE, which can be found here There is from time to time the field <vuln:security-protection> , containing often the value ALLOWS_OTHER_ACCESS or ...
2
votes
1answer
723 views

nvd json database without vendor and product info

I'm trying to parse nvd databases from nvd vulnerabilities feeds https://nvd.nist.gov/vuln/data-feeds#JSON_FEED I see many entries, where vendor product information is not filled in (cve->affects->...
2
votes
0answers
309 views

NIST Framework Cyber Security Maturity Assessment [closed]

How can I assess customer cyber security posture based on NIST framework and provide scoring? What is the easiest approach, milestones, steps to do it - I know that I need to ask questions and then ...
2
votes
0answers
213 views

NIST SI-7 experience [closed]

On a recent project we have been asked to implement NIST SI-7 parts 1, 3 and 4. I have looked for a full software solution, but cannot find anything like that. Does anyone have any experience on this?...
2
votes
0answers
57 views

Advice on if I should talk at my local user group about NIST, InfoSec etc [closed]

I have been toying with the idea for a while now about doing my first talk, on my last project I was building a Risk Management portal for information security so I had to read all about Risk ...
1
vote
1answer
108 views

Is there a documented security standard that forbids or discourages rolling your own crypto?

Is there any security standard published by NIST or another reputed body in information security that explicitly forbids or discourages rolling your own crypto? If yes, would you please post the ...
1
vote
1answer
158 views

Email under GDPR [closed]

I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
1
vote
1answer
68 views

How comprehensive is CPE?

How authoritative and comprehensive is NIST's CPE, as a list of applications, hardware and operating systems? It's clearly a vast labour for which I am grateful, but I need to know how good it is. ...
1
vote
1answer
165 views

The NIST randomness tests for a generated key

Does different tests for key randomness provided by NIST are available online? where one can test that which test for key generated are passed and which are failed?