U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Search Publications

NIST Authors in Bold

Displaying 201 - 225 of 372

Recommendation for Digital Signature Timeliness

September 23, 2009
Author(s)
Elaine B. Barker
Establishing the time when a digital signature was generated is often a critical consideration. A signed message that includes the (purported) signing time provides no assurance that the private key was used to sign the message at that time unless the

Static Analysis Tool Exposition (SATE) 2008

June 22, 2009
Author(s)
Vadim Okun, Romain Gaucher, Paul E. Black
The NIST SAMATE project conducted the first Static Analysis Tool Exposition (SATE) in 2008 to advance research in static analysis tools that find security defects in source code. The main goals of SATE were to enable empirical research based on large test

Randomized Hashing for Digital Signatures

February 25, 2009
Author(s)
Quynh H. Dang
NIST-approved digital signature algorithms require the use of an approved cryptographic hash function in the generation and verification of signatures. Approved cryptographic hash functions and digital signature algorithms can be found in FIPS 180-3

A Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS)

November 20, 2008
Author(s)
William I. MacGregor, Ketan L. Mehta, David A. Cooper, Karen A. Scarfone
This document provides best practice guidelines for integrating the PIV Card with the physical access control systems (PACS) that authenticate the cardholders in Federal facilities. Specifically, this document recommends a risk-based approach for selecting

Recommendation for Key Derivation Using Pseudorandom Functions

November 12, 2008
Author(s)
Lidong Chen
This Recommendation specifies techniques for the derivation of additional keying material from a secret key, either established through a key establishment scheme or shared through some other manner, using pseudorandom functions.

Security Considerations in the System Development Life Cycle

October 16, 2008
Author(s)
Richard L. Kissel, Kevin M. Stine, Matthew A. Scholl, Hart Rossman, J Fahlsing, Jessica Gulick
The purpose of this guideline is to assist agencies in building security into their IT development processes. This should result in more cost-effective, risk-appropriate security control identification, development, and testing. This guide focuses on the

Technical Guide to Information Security Testing and Assessment

September 30, 2008
Author(s)
Murugiah P. Souppaya, Karen A. Scarfone
The purpose of this document is to assist organizations in planning and conducting technical information security tests and examinations, analyzing findings, and developing mitigation strategies. The guide provides practical recommendations for designing

Guide to General Server Security

July 25, 2008
Author(s)
Karen A. Scarfone, Wayne Jansen, Miles C. Tracy
The purpose of this document is to assist organizations in understanding the fundamental activities performed as part of securing and maintaining the security of servers that provide services over network communications as a main function. The document

Guide to Securing Legacy IEEE 802.11 Wireless Networks

July 25, 2008
Author(s)
Karen A. Scarfone, Derrick Dicoi, Matt Sexton, Cyrus Tibbs
The purpose of this document is to provide guidance to organizations in securing their legacy Institute of Electrical and Electronics Engineers (IEEE) 802.11 wireless local area networks (WLAN) that cannot use IEEE 802.11i. The document provides an

Performance Measurement Guide for Information Security

July 16, 2008
Author(s)
Elizabeth Chew, Marianne M. Swanson, Kevin M. Stine, N Bartol, Anthony Brown, W Robinson
This document provides guidance on how an organization, through the use of metrics, identifies the adequacy of in-place security controls, policies, and procedures. It provides an approach to help management decide where to invest in additional security
Displaying 201 - 225 of 372