Search CSRC

Conference: 11th International Conference on Cryptology (INDOCRYPT 2010) Abstract: In this paper we propose a new sequential mode of operation – the Fast wide pipe or FWP for short – to hash messages of arbitrary length. The mode is shown to be (1) preimage-resistance preserving, (2) collision-resistance-preserving and, most importantly, (3) indifferentiable from a random oracle u...

Conference: 15th European Symposium on Research in Computer Security (ESORICS 2010) Abstract: The security risk of a network against unknown zero day attacks has been considered as something unmeasurable since software flaws are less predictable than hardware faults and the process of finding such flaws and developing exploits seems to be chaotic [10]. In this paper, we propose a novel secur...

Conference: 5th International Conference on Information Security and Cryptology (Inscrypt 2009) Abstract: ESSENCE is a family of cryptographic hash functions, accepted to the first round of NIST’s SHA-3 competition. This paper presents the first known attacks on ESSENCE. We present a semi-free-start collision attack on 31 out of 32 rounds of ESSENCE-512, invalidating the design claim that at least 24 ro...

Abstract: This bulletin summarizes the information presented in NISTIR 7497, Security Architecture Design Process for Health Information Exchanges (HIEs). The publication describes a systematic approach to designing a technical security architecture for the exchange of health information by building on common...

Abstract: This publication assists organizations in understanding the purpose, process, and format of information system contingency planning development through practical, real-world guidelines. This guidance document provides background information on interrelationships between information system contingenc...

Abstract: This report describes the use of combinatorial test methods to reduce the cost of testing for the Document Object Model Events standard while maintaining an equivalent level of assurance. More than 36,000 tests – all possible combinations of equivalence class values –were reduced by approximately a...

In: Handbook of Information and Communication Security (2010) Abstract: Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents, which are violations or imminent threats of violation of computer security policies, acceptable use policies, or standard security practices. An i...

Abstract: A limitation to Cipher Block Chaining (CBC) mode, as specified in NIST Special Publication 800-38A, is that the plaintext input must consist of a sequence of blocks. Ciphertext stealing is a padding method in which the required padding bits are "stolen" from the penultimate ciphertext block. This ad...

Journal: Information Processing Letters Abstract: A Bloom filter is a space-efficient data structure used for probabilistic set membership testing. When testing an object for set membership, a Bloom filter may give a false positive. The analysis of the false positive rate is a key to understanding the Bloom filter and applications that use it. We s...

Journal: Computer (IEEE Computer) Abstract: The term trust has had a well understood definition for centuries. However after e-trust came along, and then cloud, where e-trust is not sufficient due to the non-touchability of a public cloud, the need to reconsider what trust means for a public cloud arises. This paper looks at the issues of thi...

Journal: IEEE Security & Privacy Abstract: This short piece is the guest editor intro for IEEE Security and Privacy Magazine for the September 2010 issue. This short piece introduces the topic and selected papers. Cyber-physical systems feature a tight combination of a system's computational and physical elements. Understanding how to assess...

Conference: 35th IEEE Conference on Local Computer Networks (LCN 2010) Abstract: In recent years, it has been a common practice to execute client authentications for network access inside a protective tunnel. Man-in-the-middle (MitM) attacks on such tunneled authentications have been discovered early on and cryptographic bindings are widely adopted to mitigate these attacks. In...

Abstract: Combinatorial testing can help detect problems like this early in the testing life cycle. The key insight underlying t-way combinatorial testing is that not every parameter contributes to every fault and most faults are caused by interactions between a relatively small number of parameters. This pub...

Abstract: The purpose of this publication is to provide a systematic approach to designing a technical security architecture for the exchange of health information that leverages common government and commercial practices and that demonstrates how these practices can be applied to the development of HIEs. Thi...

Journal: IT Professional Abstract: Cloud computing is an idea that's rapidly evolving. Still, the amount of money and attention devoted to this topic makes it seems sensible to discuss how ethicists view the kinds of changes in computing that are being called "the cloud." This department is part of a special issue on cloud computing.

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-117, Guide To Adopting and Using the Security Content Automation Protocol (SCAP), Version 1.0: Recommendations of the National Institute of Standards and Technology. The publication, which was written by Stephen...

Journal: IT Professional Abstract: Enterprise security, often considered a burden for system administrators and users alike, is one of the most rapidly evolving areas of IT. The articles in this issue can help IT professionals who want to be intelligent providers or consumers of secure products and services.

Abstract: This document describe a framework (with the acronym ERO-AA) for establishing an infrastructure for authentication and authorization of Emergency Response officials (ERO) who respond to various types of man-made and natural disasters. The population of individuals authenticated and authorized under...

Conference: The Second SHA-3 Candidate Conference Abstract: A hash function is near-collision resistant, if it is hard to find two messages with hash values that differ in only small number of bits. In this study, we used hill climbing methods to find near-collisions for some of the second round SHA-3 candidates. We practically obtained (i) 72-bit near-colli...

Conference: Sixth International Conference on Information Assurance and Security (IAS 2010) Abstract: Attribute relations in access control mechanisms or languages allow accurate and efficient specification of some popular access control models. However, most of the access control systems including today s de-facto access control protocol and specification language, XACML, does not provide sufficien...

Conference: 2010 Electronic Voting Technology Workshop/ Workshop on Trustworthy Elections (EVT/WOTE '10) Abstract: The term "end-to-end verifiability" has been used over the past several years to describe multiple voting system proposals. The term has, however, never been formally defined. As a result, its meaning tends to change from voting system to voting system. We propose a definition for end-to-end verifia...

Conference: First International Conference on Cryptology and Information Security in Latin America, LATINCRYPT 2010 Abstract: Hamsi is one of the second round candidates of the SHA-3 competition. In this study, we present non-random differential properties for the compression function of Hamsi-256. Based on these properties, we first demonstrate a distinguishing attack that requires a few evaluations of the compression fun...

Journal: IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences Abstract: Feedback shift registers are basic building blocks for many cryptographic primitives. Due to the insecurities of Linear Feedback Shift Register (LFSR) based systems, the use of Nonlinear Feedback Shift Registers (NFSRs) became more popular. In this work, we study the feedback functions of NFSRs with...

Conference: 4th International Conference on Electronic Voting (EVOTE2010) Abstract: We present Sigma ballots, a new type of ballot to be used in secure elections. Sigma ballots use the random order of candidates introduced by Pret a Voter, combined with the confirmation codes of Scantegrity II. These ballots can be produces by a DRE machine with a slightly modified VVPAT, or can be...

Abstract: This bulletin summarizes the information presented in NIST Special Publication (SP) 800-34, Rev. 1, Contingency Planning Guide for Federal Information Systems. This publication updates federal contingency planning practices by integrating risk management and system development life cycle considerati...