Guideline for Implementing Cryptography in the Federal Government

Abstract : In today's world, both private and public sectors depend upon information technology systems to perform essential and mission-critical functions. In the current environment of increasingly open and interconnected systems and networks, network and data security are essential for the optimum use of this information technology. For example, systems that carry out electronic financial transactions and electronic commerce must protect against unauthorized access to confidential records and unauthorized modification of data. The purpose of this document is to provide guidance to Federal agencies on how to select cryptographic controls for protecting Sensitive Unclassified1 information. This document focuses on Federal standards documented in Federal Information Processing Standards Publications (FIPS PUBs) and the cryptographic modules and algorithms that are validated against these standards. However, to provide additional information, other standards organizations, (e.g., American National Standards Institute (ANSI) and International Organization for Standardization (ISO)) are briefly discussed.

[1]  James R. Nechvatal.  Public-Key Cryptography , 1991 .

[2]  Barbara Guttman,et al.  COMPUTER SECURITY CONSIDERATIONS IN FEDERAL PROCUREMENTS: A Guide for Procurement Initiators, Contracting Officers and Computer Security Officials , 1992 .

[3]  Edward Roback,et al.  SP 800-12. An Introduction to Computer Security: the NIST Handbook , 1995 .

[4]  Elaine B. Barker,et al.  Message Authentication Code (MAC) Validation System: Requirements and Procedures , 1988 .

[5]  Shukri Wakid.  Entity Authentication Using Public Key Cryptography , 1997 .

[6]  Whitfield Diffie,et al.  New Directions in Cryptography , 1976, IEEE Trans. Inf. Theory.

[7]  P. S. Tasker,et al.  DEPARTMENT OF DEFENSE TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA , 1985 .

[8]  Carlisle M. Adams,et al.  X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP , 1999, RFC.

[9]  William E. Burr,et al.  Minimum Interoperability Specification for PKI Components (MISPC), Version 1 | NIST , 1998 .

[10]  Morris J. Dworkin,et al.  Recommendation for Block Cipher Modes of Operation: Methods and Techniques , 2001 .

[11]  William E. Burr,et al.  MISPC Minimum Interoperability Specification for PKI Components, Version 1 , 1998 .

[12]  尚弘 島影.  National Institute of Standards and Technologyにおける超伝導研究及び生活 , 2001 .

[13]  Alfred Menezes,et al.  Handbook of Applied Cryptography , 2018 .

[14]  Kathy Lyons-Burke.  Federal Agency Use of Public Key Technology for Digital Signatures and Authentication , 2000 .

[15]  Marianne Swanson,et al.  SP 800-14. Generally Accepted Principles and Practices for Securing Information Technology Systems , 1996 .

[16]  NSA Cross.  Security Service API : Cryptographic API Recommendation , 1995 .