U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Publications

NIST Authors in Bold

Displaying 651 - 675 of 1430

Cryptographic Key Management Issues & Challenges in Cloud Services

September 18, 2013
Author(s)
Ramaswamy Chandramouli, Michaela Iorga, Santosh Chokhani
To interact with various services in the cloud and to store the data generated/processed by those services, several security capabilities are required. Based on a core set of features in the three common cloud services - Infrastructure as a Service (IaaS)

Related-Key Slide Attacks on Block Ciphers with Secret Components

September 18, 2013
Author(s)
Meltem Sonmez Turan
Lightweight cryptography aims to provide sufficient security with low area/power/energy requirements for constrained devices. In this paper, we focus on the lightweight encryption algorithm specified and approved in NRS 009-6-7:2002 by Electricity

Secure Domain Name System (DNS) Deployment Guide

September 18, 2013
Author(s)
Ramaswamy Chandramouli, Scott W. Rose
The Domain Name System (DNS) is a distributed computing system that enables access to Internet resources by user-friendly domain names rather than IP addresses, by translating domain names to IP addresses and back. The DNS infrastructure is made up of

ITL Publishes Guidance on Preventing and Handling Malware Incidents

August 22, 2013
Author(s)
Elizabeth B. Lennon
This ITL Bulletin summarizes a new ITL publication, NIST Special Publication 800- 83 Revision 1,Guide to Malware Incident Prevention and Handling for Desktops and Laptops,which gives receommendations for organizations to improve their malware incident

A Framework for Designing Cryptographic Key Management Systems

August 15, 2013
Author(s)
Elaine B. Barker, Miles Smid, Dennis Branstad, Santosh Chokhani
This Framework for Designing Cryptographic Key Management Systems (CKMS) contains topics that should be considered by a CKMS designer when developing a CKMS design specification. For each topic, there are one or more documentation requirements that need to

Investigating the Application of Moving Target Defenses to Network Security

August 15, 2013
Author(s)
Rui Zhuang, Su Zhang, Alex Bardas, Scott DeLoach, Xinming Ou, Anoop Singhal
This paper presents a preliminary design for a moving-target defense (MTD) for computer networks to combat an attacker's asymmetric advantage. The MTD system reasons over a set of abstract models that capture the network's configuration and its operational

ITL Publishes Guidance on Enterprise Patch Management Technologies

August 8, 2013
Author(s)
Elizabeth B. Lennon
This ITL Bulletin summarizes a new ITL publication, NIST Special Publication 800-40 Revision 3, Guide to Enterprise Patch Management Technologies, which gives recommendations for organizations to improve the effectiveness and efficiency of their patch

An Efficient Approach to Assessing the Risk of Zero-Day Vulnerabilities

July 31, 2013
Author(s)
M. Albanese, Sushil Jajodia, Anoop Singhal, Lingyu Wang
Computer systems are vulnerable to both known and zero-day attacks. Although known attack patterns can be easily modeled, thus enabling the definition of suitable hardening strategies, handling zero-day vulnerabilities is inherently difficult due to their

A Chosen IV Related Key Attack on Grain-128a

July 24, 2013
Author(s)
Subhadeep Banik, Subhamoy Maitra, Santanu (. Sarkar, Meltem Sonmez Turan
Due to the symmetric padding used in the stream cipher Grain v1 and Grain-128, it is possible to find Key-IV pairs that generate shifted keystreams efficiently. Based on this observation, Lee et al. presented a related-Key chosen IV attack on Grain v1 and

Computer Security Division 2012 Annual Report

July 22, 2013
Author(s)
Patrick D. O'Reilly
Title III of the E-Government Act of 2002, entitled the Federal Information Security Management Act (FISMA) of 2002, requires NIST to prepare an annual public report on activities undertaken in the previous year, and planned for the coming year, to carry

Guide to Enterprise Patch Management Technologies

July 22, 2013
Author(s)
Murugiah P. Souppaya, Karen Scarfone
Patch management is the process for identifying, acquiring, installing, and verifying patches for products and systems. Patches correct security and functionality problems in software and firmware. There are several challenges that complicate patch

Guide to Malware Incident Prevention and Handling for Desktops and Laptops

July 22, 2013
Author(s)
Murugiah P. Souppaya, Karen Scarfone
Malware, also known as malicious code, refers to a program that is covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity, or availability of the

Digital Signature Standard (DSS)

July 19, 2013
Author(s)
Elaine B. Barker
This Standard specifies a suite of algorithms that can be used to generate a digital signature. Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition, the recipient of signed

Biometric Specifications for Personal Identity Verification

July 11, 2013
Author(s)
Patrick J. Grother, Wayne J. Salamon, Ramaswamy Chandramouli
Homeland Security Presidential Directive HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors [HSPD-12], called for new standards to be adopted governing interoperable use of identity credentials to allow physical and

IREX IV: Part 1, Evaluation of Iris Identification Algorithms

July 11, 2013
Author(s)
George W. Quinn, Patrick J. Grother, Mei L. Ngan, James R. Matey
IREX IV aims to provide a fair and balanced scientific evaluation of the performance of automated iris recognition algorithms. IREX IV evaluated the performance of 66 identification (i.e. one-to-many matching) algorithms submitted by 12 companies and

Economic Case Study: The Impact of NSTIC on the Internal Revenue Service

July 9, 2013
Author(s)
Gregory C. Tassey
The National Strategy for Trusted Identities in Cyberspace (NSTIC) offers a vision of more secure, efficient, and cost-effective authentication through widespread use of robust third-party credentials standardized to a national strategy. If successful

Quantifying Network Topology Robustness Under Budget Constraints

June 24, 2013
Author(s)
Assane Gueye, Aron Lazska
To design robust network topologies that resist strategic attacks, one must first be able to quantify robustness. In a recent line of research, the theory of network blocking games has been used to derive robustness metrics for topologies. A network

Four Measures of Nonlinearity

June 23, 2013
Author(s)
Joan Boyar, Magnus Find, Rene Peralta
Cryptographic applications, such as hashing, block ciphers and stream ciphers, make use of functions which are simple by some criteria (such as circuit implementations), yet hard to invert almost everywhere. A necessary condition for the latter property is

Enabling an Enterprise-wide, Data-centric Operating Environment

June 21, 2013
Author(s)
David F. Ferraiolo, Serban I. Gavrila, Wayne Jansen
Although access control (AC) currently plays an important role in securing DSs, if properly envisaged and designed, access control can serve a more vital role in computing than one might expect. The Policy Machine (PM), a framework for AC developed at NIST

Exposing Software Security and Availability Risks For Commercial Mobile Devices

June 21, 2013
Author(s)
Ryan Johnson, Zhaohui Wang, Angelos Stavrou, Jeff Voas
In this manuscript, we present our efforts towards a framework for exposing the functionality of a mobile application through a combination of static and dynamic program analysis that attempts to explore all available execution paths including libraries

Guidelines for Managing the Security of Mobile Devices in the Enterprise

June 21, 2013
Author(s)
Murugiah P. Souppaya, Karen Scarfone
Mobile devices, such as smart phones and tablets, typically need to support multiple security objectives: confidentiality, integrity, and availability. To achieve these objectives, mobile devices should be secured against a variety of threats. The purpose
Displaying 651 - 675 of 1430