On February 28, 2019, NIST announced a public comment period, ending April 15, 2019, on Draft Special Publication 800-38G Revision 1, Recommendation for Block Cipher Modes of Operation: Methods for Format-Preserving Encryption.  In this revision of SP 800-38G, the specifications of the two encryption methods, called FF1 and FF3-1, are updated in order to address potential vulnerabilities when the domain size is too small. 

• Public Comments Received

On July 8, 2013, NIST announced a period of public comment, ending September 3, 2013, on Draft Special Publication 800-38G, which specifies three modes of the AES block cipher for format preserving encryption.

• Public Comments Received

In subsequent analysis, NIST explains that one of the FPE modes in the draft, FF2, does not provide the expected 128 bits of security for some use cases.

On August 2011, NIST announced a period of public comments on the draft NIST Special Publication 800-38F: Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping.

• Public Comments Received.

On June 9, 2011, NIST announced a period of public comment on a proposal to approve two schemes of the FFX framework for format preserving encryption: FFX[radix] and VAES3.

• Public Comments Received

In Request for Public Comments on XTS, NIST requested public comments on the proposal to approve the XTS-AES confidentiality mode by reference to IEEE Stnd. 1619-2007. The comment period ended September 3, 2008. The following are links to documents that NIST received from the indicated commenter:

• Moses Liskov and Kazuhiko Minematsu
• Seagate Technology (revised)
• Matthew Ball, Chair, IEEE Security in Storage Working Group (P1619)
  • response from Laszlo Hars, Seagate Technology
• Other public comments received.

Matthew Ball provided follow-up comments to the public comments on XTS-AES.

Public comments received on draft NIST Special Publication 800-38E, Recommendation for Block Cipher Modes of Operation: The XTS-AES Mode for Confidentiality in Block-Oriented Storage Devices.

The following public comments were submitted on the second (July 2007) draft NIST SP 800-38D: Recomendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC :

Commenter

• IEEE P1619.1 Task Group
• Department of State
• Thales e-Security, Ltd

The following paper was submitted as a public comment on the first (April 2006) draft NIST SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM):

• Authentication Failures in NIST version of GCM - Antoine Joux

• Other Public Comments Received

NIST requested public comments on its intention to recommend either the CWC mode or the GCM mode. Links to PDF files of papers that were submitted::

• Authentication Weaknesses in GCM - Niels Ferguson
• A High Speed Architecture for Galois/Counter Mode of Operation (GCM) - Bo Yang, Sambit Mishra, Ramesh Karri
• GCM Update - David McGrew, John Viega
• Multiple forgery attacks against Message Authentication Codes - David McGrew, Scott R. Fluhrer

The comment period ended June 1, 2005.

Public comments received on the draft NIST Special Publication 800-38B, Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication.

Links to PDF files of papers that were submitted as public comments on the draft NIST Special Publication 800-38C, Recommendation for Block Cipher Modes of Operation: The CCM Mode for Authentication and Confidentiality are provided below:

• A Critique of CCM - Phillip Rogaway, David Wagner
• Comments on NIST Draft Pub 800-38C: CCM mode of operation - Rene Struik

• Other public comments received

Another document briefly describes NIST's responses to the most significant public comments.

The general public comments on modes of operation that were submitted within email messages are available in two PDF files:

• comments submitted before the first modes workshop
• ongoing comments (updated periodically).

Links to PDF files of the papers on modes of operation that were submitted as public comments are provided below:

• Galois MAC with forgery probability close to ideal - Kaisa Nyberg, Henri Gilbert, Matt Robshaw
• Collision attacks on OCB - Niels Ferguson
• Cryptographic Modes of Operation for the Internet - Steven M. Bellovin, Matt Blaze
• Stronger Security Bounds for OMAC, TMAC and XCBC - Tetsu Iwata
• On the security of XCBC, TMAC and OMAC - Chris J. Mitchel
• Correction to "On the Security of Two New OMAC Variants" - Tetsu Iwata and Kaoru Kurosawa
• Comments on "On the security of XCBC, TMAC and OMAC" by Mitchell - Tetsu Iwata