NIST Advisory Group Releases Report on Cryptography Expertise and Standards Process

The National Institute of Standards and Technology (NIST)'s primary external advisory board today released a report calling for the agency to increase its staff of cryptography experts and implement more explicit processes for ensuring openness and transparency to strengthen its cryptography efforts. The Visiting Committee on Advanced Technology (VCAT) report also highlights the importance of having the trust and participation of the broader cryptographic community in NIST's program.

In the fall of 2013, former NIST Director Patrick D. Gallagher requested that the VCAT review NIST's cryptographic standards and guidelines development process, in response to community concerns that a cryptographic algorithm in a NIST standard had been deliberately weakened.

In making its recommendations, the VCAT specifically addressed NIST's interactions with the National Security Agency (NSA). The report states, "NIST may seek the advice of the NSA on cryptographic matters but it must be in a position to assess it and reject it when warranted."

"Ensuring we have a process that delivers strong cryptography and protects the integrity of our standards and guidelines is our highest priority," said Acting NIST Director Willie May. "We appreciate this review by the VCAT and the individual Committee of Visitor experts. NIST has already taken several steps to strengthen the process for developing cryptographic standards and will carefully consider these recommendations."

The Federal Information Security Management Act (FISMA) of 2002 gives NIST responsibility for developing information security standards and guidelines for non-national security federal information systems. These standards and guidelines have been widely adopted by U.S. industry and the international community. FISMA also directs NIST to consult with other agencies such as the NSA, to promote coordination and avoid conflicting standards.

In May 2014, the VCAT convened a blue ribbon panel of experts called the Committee of Visitors (COV) and asked each expert to review NIST's cryptographic process and provide individual reports of their conclusions and recommendations. The experts, states the VCAT report, "point out several shortcomings and procedural weaknesses that led to the inclusion" of the algorithm, despite known community concerns with its security.

In its report, the VCAT noted that "it is of paramount importance that NIST's process for developing cryptographic standards is open and transparent and has the trust and support of the cryptographic community." The committee recommends that NIST explore, "in addition to the current avenues, expanding its programs to engage academia and outside experts to aid in the review of specific technical topics." The report also recommends that NIST review the current requirement for interaction with the NSA and recommends changes in instances where it "hinders [NIST's] ability to independently develop the best cryptographic standards."

The VCAT review was part of a larger initiative by NIST that included an internal review of its development process and the February 2014 release of a document outlining the principles behind that process. NIST IR 7977: DRAFT NIST Cryptographic Standards and Guidelines Development Process will be finalized by the end of 2014, and will include more detailed processes and procedures that incorporate feedback from the VCAT and the public.

"We will continue to work with the best cryptography experts in the world, both inside and outside of government," said May. "At the same time, we recognize and agree with the VCAT that NIST must strengthen its in-house cryptography capabilities to ensure we can reach independent conclusions about the merits of specific algorithms or standards."

The individual members of the COV also offered suggestions for improving technical aspects of various standards as well as the development process, and the VCAT recommends that NIST consider those recommendations.

NIST has posted the full VCAT report to its website, as well as the expert panel's individual written conclusions and recommendations and related materials.

As a non-regulatory agency of the U.S. Department of Commerce, NIST promotes U.S. innovation and industrial competitiveness by advancing measurement science, standards and technology in ways that enhance economic security and improve our quality of life. To learn more about NIST, visit www.nist.gov