Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint //

Privacy

7/14/2014
12:50 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

NIST Advisory Group Releases Report on Cryptography Expertise and Standards Process

VCAT specifically addressed NIST's interactions with the NSA.

Contact: Jennifer Huergo 
301-975-6343

 

The National Institute of Standards and Technology (NIST)'s primary external advisory board today released a report calling for the agency to increase its staff of cryptography experts and implement more explicit processes for ensuring openness and transparency to strengthen its cryptography efforts. The Visiting Committee on Advanced Technology (VCAT) report also highlights the importance of having the trust and participation of the broader cryptographic community in NIST's program.

In the fall of 2013, former NIST Director Patrick D. Gallagher requested that the VCAT review NIST's cryptographic standards and guidelines development process, in response to community concerns that a cryptographic algorithm in a NIST standard had been deliberately weakened.

In making its recommendations, the VCAT specifically addressed NIST's interactions with the National Security Agency (NSA). The report states, "NIST may seek the advice of the NSA on cryptographic matters but it must be in a position to assess it and reject it when warranted."

"Ensuring we have a process that delivers strong cryptography and protects the integrity of our standards and guidelines is our highest priority," said Acting NIST Director Willie May. "We appreciate this review by the VCAT and the individual Committee of Visitor experts. NIST has already taken several steps to strengthen the process for developing cryptographic standards and will carefully consider these recommendations."

The Federal Information Security Management Act (FISMA) of 2002 gives NIST responsibility for developing information security standards and guidelines for non-national security federal information systems. These standards and guidelines have been widely adopted by U.S. industry and the international community. FISMA also directs NIST to consult with other agencies such as the NSA, to promote coordination and avoid conflicting standards.

In May 2014, the VCAT convened a blue ribbon panel of experts called the Committee of Visitors (COV) and asked each expert to review NIST's cryptographic process and provide individual reports of their conclusions and recommendations. The experts, states the VCAT report, "point out several shortcomings and procedural weaknesses that led to the inclusion" of the algorithm, despite known community concerns with its security.

In its report, the VCAT noted that "it is of paramount importance that NIST's process for developing cryptographic standards is open and transparent and has the trust and support of the cryptographic community." The committee recommends that NIST explore, "in addition to the current avenues, expanding its programs to engage academia and outside experts to aid in the review of specific technical topics."The report also recommends that NIST review the current requirement for interaction with the NSA and recommends changes in instances where it "hinders [NIST's] ability to independently develop the best cryptographic standards."

The VCAT review was part of a larger initiative by NIST that included an internal review of its development process and the February 2014 release of a document outlining the principles behind that process. NIST IR 7977: DRAFT NIST Cryptographic Standards and Guidelines Development Process will be finalized by the end of 2014, and will include more detailed processes and procedures that incorporate feedback from the VCAT and the public.

"We will continue to work with the best cryptography experts in the world, both inside and outside of government," said May. "At the same time, we recognize and agree with the VCAT that NIST must strengthen its in-house cryptography capabilities to ensure we can reach independent conclusions about the merits of specific algorithms or standards."

The individual members of the COV also offered suggestions for improving technical aspects of various standards as well as the development process, and the VCAT recommends that NIST consider those recommendations.

NIST has posted the full VCAT report to its website, as well as the expert panel's individual written conclusions and recommendations and related materials.

As a non-regulatory agency of the U.S. Department of Commerce, NIST promotes U.S. innovation and industrial competitiveness by advancing measurement science, standards and technology in ways that enhance economic security and improve our quality of life. To learn more about NIST, visit www.nist.gov

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 New Cybersecurity Vulnerabilities That Could Put Your Enterprise at Risk
In this Dark Reading Tech Digest, we look at the ways security researchers and ethical hackers find critical vulnerabilities and offer insights into how you can fix them before attackers can exploit them.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-8033
PUBLISHED: 2020-08-14
In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.
CVE-2020-15692
PUBLISHED: 2020-08-14
In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands...
CVE-2020-15693
PUBLISHED: 2020-08-14
In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call (such as httpClient.get or httpClient.post), the User-Agent header value, or custom HTTP header names or values...
CVE-2020-15694
PUBLISHED: 2020-08-14
In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() does not raise any error if a malicious server provides a negative Content-Length.
CVE-2015-8032
PUBLISHED: 2020-08-14
In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.