FIPS

컴퓨터 보안에 관련된 FIPS 표준문서

[Access Control]

• FIPS PUB 201-1 : Personal Identity Verification (PIV) of Federal Employees and Contractors, March 14, 2006. (local copy).
  - Change Notice 1, June 26, 2006. (local copy).
  - FIPS PUB 201, February 25, 2005. (local copy).
• FIPS PUB 196 : Entity Authentication Using Public Key Cryptography, February 18, 1997 (local copy).
• FIPS PUB 190 : Guideline for the Use of Advanced Authentication Technology Alternatives, September 28, 1994.
• FIPS PUB 112 (Part 1 /Part 2) : Password Usage, May 30, 1985 (local copy Part 1/ Part 2).
• FIPS PUB 83 : Guideline on User Authentication Techniques for Computer Network Access Control, September 29, 1980.
• FIPS PUB 48 : Guidelines on Evaluation of Techniques for Automated Personal Identification, April 1, 1977.

  [Cryptography]

• FIPS PUB 198 : The Keyed-Hash Message Authentication Code(HMAC), April 3, 2002. (local copy).
• FIPS PUB 197 : Advanced Encryption Standard (AES), December 04, 2001 (local copy).
• FIPS PUB 186-2 : Digital Signature Standard (DSS), January 27, 2000 (local copy).
  - NIST statement, An attack on RSA digital signatures using the padding scheme for RSASSA-PKCS1-v1_5 as specified in Public Key Cryptography Standards (PKCS) #1 v2.1(RSA Cryptography Standard-2002), October 20, 2006. (local copy)
  - FIPS PUB 186-2 : Change notice(2001/08/03) included version, October 09, 2001 (local copy)
• FIPS PUB 186-1 : Digital Signature Standard (DSS), Dec. 15, 1998 (local copy).
• FIPS PUB 185 : Escrowed Encryption Standard (EES), February 9, 1994.
• FIPS PUB 181 : Automated Password Generator (APG), October 5, 1993.
• FIPS PUB 180-1 : Secure Hash Standard (SHS), April 17, 1995. (local copy).
• FIPS PUB 180-2 : Secure Hash Standard (SHS) (Updated version with change notice), February 28, 2004 (local copy).
  - NIST statement, March 15, 2006
  - Brief Comments : Brief comments on the recent SHA-1 cryptanalytic attacks, February 22, 2005 (local copy)
  - Brief Comments : Comments on Recent Cryptanalytic Attacks on Secure Hashing Functions and the Continued Security Provided by SHA-1, August 25, 2004 (local copy)
  - Change notice : Specify an additional hash function, SHA-224, that is based on SHA-256, December 01, 2003 (local copy)
  - Original version, August 28, 2002. (local copy).
  
• FIPS PUB 171 : Key Management Using ANSI X9.17, April 27, 1992.
• FIPS PUB 140-1 : Security Requirements for Cryptographic Modules, January 11, 1994 (local copy).
• FIPS PUB 140-2 : Security Requirements for Cryptographic Modules, May 25, 2001. (local copy).
  - A Comparison of the Security Requirements for Cryptographic Modules in FIPS 140-1 and FIPS 140-2, ITL Computer Security Bulletins, July 2001. (local copy).
• FIPS PUB 113 : Computer Data Authentication, May 30, 1985 (local copy).
• FIPS PUB 81 : DES Modes of Operation, December 2, 1980 (local copy).
• FIPS PUB 74 (Part 1 /Part 2 /Part 3) : Guidelines for Implementing and Using the NBS Data Encryption Standard, April 1, 1981 (local copy Part 1, Part 2, Part 3).
• FIPS PUB 46-3 : Data Encryption Standard (DES); specifies the use of Triple DES, October 25, 1999 (local copy).

  [General Computer Security]

• FIPS PUB 200 : Minimum Security Requirements for Federal Information and Information Systems, March 14, 2006 (local copy).
• FIPS PUB 102 : Guidelines for Computer Security Certification and Accreditation, September 27, 1983 (local copy Part 1, Part 2, Part 3, Part 4, Part 5, Part 6, Part 7).
• FIPS PUB 73 : Guidelines for Security of Computer Applications, June 30, 1980 (local copy).
• FIPS PUB 31 : Guidelines for Automatic Data Processing Physical Security and Risk Management, June 1974 (local copy).

  [Risk Analysis and Contingency Planning]

• FIPS PUB 191 : Guideline for The Analysis of Local Area Network Security, November 9, 1994 (local copy).
• FIPS PUB 87 : Guidelines for ADP Contingency Planning, March 27, 1981 (local copy).

  [Security Labels]

• FIPS PUB 199 : Standards for Security Categorization of Federal Information and Information Systems, February 10, 2004. (local copy).
• FIPS PUB 188 : Standard Security Labels for Information Transfer, September 6, 1994 (local copy).

NIST Special Publications 800

• 800-101 Guidelines on Cell Phone Forensics, June 1, 2007. (local copy).
• 800-100 Information Security Handbook: A Guide for Managers, November 7, 2006. (local copy).
• 800-98 Guidelines for Securing Radio Frequency Identification (RFID) Systems, April 2007. (local copy).
• 800-97 Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11i, February 20, 2007. (local copy).
• 800-96 PIV Card to Reader Interoperability Guidelines, September 11, 2006. (local copy).
• 800-94 Guide to Intrusion Detection and Prevention Systems (IDPS), February 20, 2007. (local copy).
• 800-92 Guide to Computer Security Log Management, September 29, 2006. (local copy).
• 800-90 Recommendation for Random Number Generation Using Deterministic Random Bit Generators, June 12, 2006. (local copy).
• 800-89 Recommendation for Obtaining Assurances for Digital Signature Applications, December 6, 2006. (local copy).
• 800-88 Guidelines for Media Sanitization, August 31, 2006. (local copy).
• 800-87 Codes for the Identification of Federal and Federally-Assisted Organizations, October 20, 2005. (local copy).
• 800-86 Guide to Integrating Forensic Techniques into Incident Response, August 31, 2006. (local copy).
• 800-85 PIV Middleware and PIV Card Application Conformance Test Guidelines, October 19, 2005. (local copy).
• 800-85A PIV Card Application and Middleware Interface Test Guidelines (SP800-73 Compliance), April 5, 2006. (local copy).
• 800-85B PIV Data Model Conformance Test Guidelines, July 27, 2006. (local copy).
• 800-84 Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, September 29, 2006. (local copy).
• 800-83 Guide to Malware Incident Prevention and Handling, November 17, 2005. (local copy).
• 800-81 Secure Domain Name System (DNS) Deployment Guide, May 16, 2006. (local copy).
• 800-79 Guidelines for the Certification and Accreditation of PIV Card Issuing Organizations, July 27, 2005. (local copy).
• 800-78 Cryptographic Algorithms and Key Sizes for Personal Identity Verification, April 25, 2005. (local copy).
• 800-77 Guide to IPsec VPNs, December 15, 2005. (local copy).
• 800-76 Biometric Data Specification for Personal Identity Verification, February 1, 2006. (local copy).
• 800-76-1 Biometric Data Specification for Personal Identity Verification, January 25, 2007. (local copy).
• 800-73(Revision 1), Interfaces for Personal Identity Verification, March 24, 2006. (local copy).
  - Old version, April 12, 2005. (local copy).
  - Proposed Changes to 800-73(Draft Special Publication 800-73-1), February 8, 2006. (local copy).
  - Proposed changes to 800-73-1, February 13, 2006. (local copy).
• 800-72 Guidelines on PDA Forensics, November 15, 2004. (local copy).
• 800-70 Security Configuration Checklists Program for IT Products, May 2005. (local copy).
• 800-69 Guidance for Securing Microsoft Windows XP Home Edition: A NIST Security Configuration Checklist, September 29, 2006. (local copy).
• 800-68 Guidance for Securing Microsoft Windows XP Systems for IT Professionals: A NIST Security Configuration Checklist, October 2005. (local copy).
• 800-67 Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher, May 12, 2004. (local copy).
• 800-66 An introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, March 25, 2004. (local copy).
• 800-65 Integrating Security into the Capital Planning and Investment Control Process, January 27, 2005. (local copy).
• 800-64 Security Considerations in the Information System Development Life Cycle, October 10, 2003. (local copy).
• 800-63 Electronic Authentication Guideline, June 30, 2004. (local copy).
• 800-61 Computer Security Incident Handling Guide, January 2004. (local copy).
• 800-60 Guide for Mapping Types of Information and Information Systems to Security Categories(Volume I), June 09, 2004. (local copy).
  - Volume II
• 800-59 Guideline for Identifying an Information System as a National Security System, August 13, 2003. (local copy).
• 800-58 Security Considerations for Voice Over IP Systems, January 2005. (local copy).
• 800-57, Recommendation for Key Management
  - Part 1(General), The Recommendation for Key Management, August 17, 2005. (local copy).
  - Part 2, Best Practices for Key Management Organization, August 26, 2005. (local copy).
• 800-56A Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography, March 13, 2006. (local copy).
• 800-55 Security Metrics Guide for Information Technology (IT) Systems, August 12, 2003. (local copy).
• 800-53(Revision 1) Recommended Security Controls for Federal Information Systems, December 21, 2006. (local copy).
  - Annex 1: Baseline Security Controls for Low-Impact Information Systems, December 2006. (local copy).
  - Annex 2: Baseline Security Controls for Moderate-Impact Information Systems, December 2006. (local copy).
  - Annex 3: Baseline Security Controls for High-Impact Information Systems, December 2006. (local copy).
  - Old Version#2, October 20, 2006. (local copy).
  - Old Version#1, February 28, 2005. (local copy).
• 800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations, June 14, 2005. (local copy).
• 800-51 Use of the Common Vulnerabilities and Exposures (CVE) Vulnerability Naming Scheme, September 2002 (local copy).
• 800-50 Building an Information Technology Security Awareness and Training Program, October 10, 2003. (local copy).
• 800-49 Federal S/MIME V3 Client Profile, November 21, 2002. (local copy).
• 800-48 Wireless Network Security: 802.11, Bluetooth, and Handheld Devices, November 22, 2002. (local copy).
• 800-47 Security Guide for Interconnecting Information Technology Systems, September 2002 (local copy).
• 800-46 Security for Telecommuting and Broadband Communications, September 2002 (local copy).
• 800-45(Version 2), Guidelines on Electronic Mail Security, February 20, 2007 (local copy).
  - Old version, September 2002 (local copy).
• 800-44 Guidelines on Securing Public Web Servers, September 2002 (local copy).
• 800-43 Systems Administration Guidance for Windows 2000 Professional, November 21, 2002. (local copy).
  - 800-43 doc. with security templates, V.R1.2.3. Systems Administration Guidance for Windows 2000 Professional, November 21, 2002. (local copy)
• 800-42 Guideline on Network Security Testing, October 10, 2003. (local copy).
• 800-41 Guidelines on Firewalls and Firewall Policy, January 2002 (local copy).
  - Guidelines on Firewalls and Firewall Policy, ITL Computer Security Bulletins, January 2002. (local copy)
• 800-40(Version 2), Creating a Patch and Vulnerability Management Program, November 17, 2005. (local copy).
  - Old version, September 2002. (local copy).
• 800-38A Recommendation for Block Cipher Modes of Operation - Methods and Techniques, December 2001 (local copy).
• 800-38B Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication, May 18, 2005. (local copy).
• 800-38C Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality, May 12, 2004. (local copy).
• 800-37 Guide for the Security Certification and Accreditation of Federal Information Systems, May 12, 2004. (local copy).
• 800-36 Guide to Selecting Information Security Products, October 10, 2003. (local copy).
• 800-35 Guide to Information Technology Security Services, October 10, 2003. (local copy).
• 800-34 Contingency Planning Guide for Information Technology Systems, June 11, 2002. (local copy).
  - Contingency Planning Guide For Information Technology Systems, ITL Computer Security Bulletins, June 2002. (local copy)
• 800-33 Underlying Technical Models for Information Technology Security, February 04, 2002. (local copy).
• 800-32 Introduction to Public Key Technology and the Federal PKI Infrastructure, February 2001 (local copy).
• 800-31 Intrusion Detection Systems (IDS), August 2001 (local copy).
• 800-30 Risk Management Guide for Information Technology Systems, February 04, 2002. (local copy).
• 800-29 A Comparison of the Security Requirements for Cryptographic Modules in FIPS 140-1 and FIPS 140-2, June 2001 (local copy).
• 800-28 Guidelines on Active Content and Mobile Code, October 2001 (local copy).
• 800-27(Revision A) The Engineering Principles for Information Technology Security, July 2, 2004. (local copy).
  - Old version, June 2001. (local copy).
• 800-26 Security Self-Assessment Guide for Information Technology Systems, August 2001 (local copy).
• 800-25 Federal Agency Use of Public Key Technology for Digital Signatures and Authentication, October 2000 (local copy).
• 800-24 PBX Vulnerability Analysis: Finding Holes in Your PBX Before Someone Else Does, August 2000 (local copy).
• 800-23 Guideline to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products, August 2000 (local copy).
• 800-22 A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, October 2000, (Revised:May 2001) (local copy).
  -Errata sheet for originally published version, (local copy).
• 800-21-1, Guideline for Implementing Cryptography in the Federal Government, December 22, 2005. (local copy).
  - First Edition, November 1999. (local copy).
• 800-20 Modes of Operation Validation System for the Triple Data Encryption Algorithm (TMOVS): Requirements and Procedures, November 1999 (local copy).
• 800-19 Mobile Agent Security, October 1999 (local copy).
• 800-18(Rev. 1), Guide for Developing Security Plans for Federal Information Systems, February 7, 2006. (local copy).
  - Old Version, December 1998. (local copy).
• 800-17 Modes of Operation Validation System (MOVS): Requirements and Procedures, February 1998 (local copy).
• 800-16 ( Part 1/ Part 2/ Part 3) Information Technology Security Training Requirements: A Role and Performance-Based Model (supersedes SP 500-172), April 1998 (local copy Part 1, Part 2, Part 3).
• 800-15 Minimum Interoperability Specification for PKI Components (MISPC), Version 1, January 1998 (local copy).
• 800-14 Generally Accepted Principles and Practices for Securing Information Technology Systems, September 1996 (local copy).
• 800-13 Telecommunications Security Guidelines for Telecommunications Management Network, October 1995 (local copy).
• 800-12 Introduction to Computer Security: The NIST Handbook, October 1995 (local copy).
• 800-11 The Impact of the FCC's Open Network Architecture on NS/NP Telecommunications Security, February 1995 (local copy).
• 800-10 Keeping Your Site Comfortably Secure: An Introduction to Internet Firewalls, December 1994 (local copy).
• 800-9 Good Security Practices for Electronic Commerce Including Electronic Data Interchange, December 1993 (local copy).
• 800-8 Security Issues in the Database Language SQL, August 1993 (local copy).
• 800-7 Security in Open Systems, July 1994 (local copy).
• 800-6 Automated Tools for Testing Computer System Vulnerability, December 1992 (local copy).
• 800-5 A Guide to the Selection of Anti-Virus Tools and Techniques, December 1992 (local copy).
• 800-4 Computer Security Considerations in Federal Procurements: A Guide for Procurement Initators, Contracting Officers, and Computer Security Officials, March 1992.
• 800-3 Establishing a Computer Security Incident Response Capability (CSIRC), November 1991 (local copy).
• 800-2 Public-Key Cryptography, April 1991.
• 800-1 Computer Security in the 1980s: Selected BibliographyR, December 1990.

• SP 868 The Information Infrastructure: Reaching Society's Goals, September 1994.
• SP 857 Putting the Information Infrastructure to Work: Report of the Information Infrastructure Task Force Committee on Applications and Technology, May 1994.

• Securing Radio Frequency Identification (RFID) Systems, ITL Computer Security Bulletin, May 2007. (local copy).
• Securing Wireless Networks, ITL Computer Security Bulletin, April 2007. (local copy).
• Improving The Security Of Electronic Mail: Updated Guidelines Issued By NIST, ITL Computer Security Bulletin, March 2007. (local copy).
• Intrusion Detection And Prevention Systems, ITL Computer Security Bulletin, February 2007. (local copy).
• Security Controls For Information Systems: Revised Guidelines Issued By NIST, ITL Computer Security Bulletin, January 2007. (local copy).
• Maintaining Effective Information Technology (IT) Security Through Test, Training, And Exercise Programs, ITL Computer Security Bulletin, December 2006. (local copy).
• Guide To Securing Computers Using Windows XP Home Edition, ITL Computer Security Bulletin, November 2006. (local copy).
• Log Management: Using Computer And Network Records To Improve Information Security, ITL Computer Security Bulletin, October 2006. (local copy).
• Forensic Techniques: Helping Organizations Improve Their Responses To Information Security Incidents, ITL Computer Security Bulletin, September 2006. (local copy).
• Protecting Sensitive Information Processed And Stored In Information Technology (It) Systems, ITL Computer Security Bulletin, August 2006. (local copy).
• Domain Name System (DNS) Services: NIST Recommendations For Secure Deployment, ITL Computer Security Bulletin, June 2006. (local copy).
• An Update On Cryptographic Standards, Guidelines, And Testing Requirements, ITL Computer Security Bulletin, May 2006. (local copy).
• Minimum Security Requirements For Federal Information And Information Systems : Federal Information Processing Standard (Fips) 200 Approved By The Secretary Of Commerce, ITL Computer Security Bulletin, March 2006. (local copy).
• Creating A Program To Manage Security Patches And Vulnerabilities : NIST Recommendations For Improving System Security , ITL Computer Security Bulletin, February 2006. (local copy).
• Testing And Validation Of Personal Identity Verification (Piv) Components And Subsystems For Conformance To Federal Information Processing Standard 201, ITL Computer Security Bulletin, January 2006. (local copy).
• Preventing And Handling Malware Incidents: How To Protect Information Technology Systems From Malicious Code And Software, ITL Computer Security Bulletin, December 2005. (local copy).
• Securing Microsoft Windows XP Systems: NIST Recommendations For Using A Security Configuration Checklist, ITL Computer Security Bulletin, November 2005. (local copy).
• National Vulnerability Database: Helping Information Technology System Users And Developers Find Current Information About Cyber Security Vulnerabilities, ITL Computer Security Bulletin, October 2005. (local copy).
• Biometric Technologies: Helping To Protect Information And Automated Transactions In Information Technology Systems, ITL Computer Security Bulletin, September 2005. (local copy).
• Protecting Sensitive Information That Is Transmitted Across Networks: Nist Guidance For Selecting And Using Transport Layer Security Implementations, ITL Computer Security Bulletin, July 2005. (local copy).
• Security Configuration Checklists Program For IT Products, ITL Computer Security Bulletin, June 2005. (local copy).
• Recommended Security Controls For Federal Information Systems: Guidance For Selecting Cost-Effective Controls Using A Risk-Based Process, ITL Computer Security Bulletin, May 2005. (local copy).
• Implementing The Health Insurance Portability And Accountability Act (HIPAA) Security Rule, ITL Computer Security Bulletin, April 2005. (local copy).
• Personal Identity Verification (Piv) Of Federal Employees And Contractors, ITL Computer Security Bulletin, March 2005. (local copy).
• Integrating It Security Into The Capital Planning And Investment Control Process, ITL Computer Security Bulletin, January 2005. (local copy).
• Understanding the New NIST Standards and Guidelines Required by FISMA: How Three Mandated Documents are Changing the Dynamic of Information Security for the Federal Government, ITL Computer Security Bulletin, November 2004. (local copy).
• Securing Voice Over Internet Protocol (IP) Networks, ITL Computer Security Bulletin, October 2004. (local copy).
• Information Security Within the System Development Life Cycle, ITL Computer Security Bulletins, September 2004. (local copy).
• Electronic Authentication: Guidance For Selecting Secure Techniques, ITL Computer Security Bulletins, August 2004. (local copy).
• Guide For Mapping Types Of Information And Information Systems To Security Categories, ITL Computer Security Bulletins, July 2004. (local copy).
• Information Technology Security Services: How To Select, Implement, And Manage, ITL Computer Security Bulletins, June 2004. (local copy).
• Guide For The Security Certification And Accreditation Of Federal Information Systems, ITL Computer Security Bulletins, May 2004. (local copy).
• Selecting Information Technology Security Products, ITL Computer Security Bulletins, April 2004. (local copy).
• Comments for FIPS PUB 199(Standards For Security Categorization Of Federal Information And Information Systems), ITL Computer Security Bulletins, March 2004. (local copy).
• Computer Security Incidents: Assessing, Managing, And Controlling The Risks, ITL Computer Security Bulletins, January 2004. (local copy).
• Security Considerations in the Information System Development Life Cycle, ITL Computer Security Bulletins, December 2003. (local copy).
• Network Security Testing, ITL Computer Security Bulletins, November 2003. (local copy).
• Information Technology Security Awareness, Training, Education, and Certification, ITL Computer Security Bulletins, October 2003. (local copy).
• IT Security Metrics, ITL Computer Security Bulletins, August 2003. (local copy).
• Testing Intrusion Detection Systems, ITL Computer Security Bulletins, July 2003. (local copy).
• Asset: Security Assessment Tool For Federal Agencies, ITL Computer Security Bulletins, June 2003. (local copy).
• Security For Wireless Networks And Devices, ITL Computer Security Bulletins, March 2003. (local copy).
• Secure Interconnections for Information Technology Systems, ITL Computer Security Bulletins, February 2003. (local copy).
• Security Of Electronic Mail, ITL Computer Security Bulletins, January 2003. (local copy).
• Security of Public Web Servers, ITL Computer Security Bulletins, December 2002. (local copy).
• Security For Telecommuting And Broadband Communications, ITL Computer Security Bulletins, November 2002. (local copy).
• Security Patches And The CVE Vulnerability Naming Scheme: Tools To Address Computer System Vulnerabilities, ITL Computer Security Bulletins, October 2002. (local copy).
• Cryptographic Standards and Guidelines: A Status Report, ITL Computer Security Bulletins, September 2002. (local copy).
• Techniques for System and Data Recovery, ITL Computer Security Bulletins, April 2002. (local copy).
• Risk Management Guidance For Information Technology Systems, ITL Computer Security Bulletins, February 2002. (local copy).
• Computer Forensics Guidance, ITL Computer Security Bulletins, November 2001. (local copy).
• An Introduction to IPsec (Internet Protocol Security), ITL Computer Security Bulletins, March 2001. (local copy).

• Managing Enterprise Risk in Today’s World of Sophisticated Threats, A Framework for Developing Broad-Based, Cost-Effective Information Security Programs, NIST White paper, December 21, 2006. (local copy).
• Withdrawal of the (single) Data Encryption Standard (DES) as specified in FIPS 46-3, NIST Announcenemt, May 19, 2005. (local copy).
• Technology Assessment-Cybersecurity for Critical Infrastructure Protection, GAO(General Accounting Office), June 16, 2004. (local copy).
• Cyber Security Research and Development Act, NIST Publication for Policy, May 14, 2003. (local copy).
• TDES Guidance, NIST Special Comment, November 14, 2002. (local copy).
• Government Smart Card Interoperability Specification(GSC-IS, v2.0), NIST Internal Report 6887, June 27, 2002. (local copy).
  - Overview: The Governemt Smart Card Interoperability Specification, ITL Computer Security Bulletins, July 2002. (local copy)
• The Economic Impact of Role-Based Access Control, NIST Planning Report, March 2002. (local copy).

Draft Publications

• Draft(FIPS 198-1 Publication) : The Keyed-Hash Message Authentication Code (HMAC), June 12, 2007. (local copy).
• Draft(FIPS 180-3 Publication) : Secure Hash Standard (SHS), June 12, 2007. (local copy).
• Draft(NIST Special Publication 800-104) : A Scheme for PIV Visual Card Topography, January 29, 2007. (local copy).
• Draft(NIST Special Publication 800-103) : An Ontology of Identity Credentials, Part 1: Background and Formulation, October 6, 2006. (local copy).
• Draft(NIST Special Publication 800-98) : Guidance for Securing Radio Frequency Identification (RFID) Systems, September 26, 2006. (local copy).
• Draft(NIST Special Publication 800-82) : Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems Security, September 26, 2006. (local copy).
• Draft(NIST Special Publication 800-54) : Border Gateway Protocol Security, September 26, 2006. (local copy).
• Draft(NIST Special Publication 800-76-1) : Biometric Data Specification for Personal Identity Verification, September 14, 2006. (local copy).
• Draft(NIST Special Publication 800-101) : Guidelines on Cell Phone Forensics, August 31, 2006. (local copy).
• Draft(NIST Special Publication 800-95) : Guide to Secure Web Services, August 31, 2006. (local copy).
• Draft(NIST Special Publication 800-94) : Guide to Intrusion Detection and Prevention (IDP) Systems, August 31, 2006. (local copy).
• Draft(NIST Special Publication 800-45A) : Guidelines on Electronic Mail Security, August 31, 2006. (local copy).
• Draft(NIST Special Publication 800-69) : Guidance for Securing Microsoft Windows XP Home Edition: A NIST Security Configuration Checklist, August 1, 2006. (local copy).
• Draft(NIST Special Publication 800-96) : PIV Card / Reader Interoperability Guidelines, July 28, 2006. (local copy).
• Draft(NIST Special Publication 800-53) : Recommended Security Controls for Federal Information Systems(Revision 1), July 26, 2006. (local copy).
  - First Draft, February 28, 2006. (local copy).
• Draft(NIST Special Publication 800-78-1) : Cryptographic Standards and Key Sizes for Personal Identity Verification, July 3, 2006. (local copy).
• Draft(NIST Special Publication 800-100) : Information Security Handbook: A Guide for Managers, June 7, 2006. (local copy).
• Draft(NIST Special Publication 800-97) : Guide to IEEE 802.11i: Robust Security Networks, June 5, 2006. (local copy).
• Draft(NIST Special Publication 800-85B) : PIV Data Model Conformance Test Guidelines, May 25, 2006. (local copy).
• Draft(NIST Special Publication 800-96) : PIV Card / Reader Interoperability Guidelines, May 23, 2006. (local copy).
• Draft(NIST Special Publication 800-80) : Guide for Developing Performance Metrics for Information Security, May 4, 2006. (local copy).
• Draft(NIST Special Publication 800-92) : Guide to Computer Security Log Management, April 21, 2006. (local copy).
• Draft(NIST Special Publication 800-53A) : Guide for Assessing the Security Controls in Federal Information Systems(The third public draft), (local copy).
  - Second Draft, April 21, 2006. (local copy).
  - First Draft, July 15, 2005. (local copy).
• Draft(NIST Special Publication 800-38D) : Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) for Confidentiality and Authentication, April 20, 2006. (local copy).
• Draft(NIST Special Publication 800-89) : Recommendation for Obtaining Assurances for Digital Signature Applications, March 13, 2006. (local copy).
• Draft(NIST FIPS Publication 186-3) : Digital Signature Standard (DSS), March 13, 2006. (local copy).
• Draft(NIST Special Publication 800-88) : Guidelines for Media Sanitization, February 3, 2006. (local copy).
• Draft(NIST Special Publication 800-90) : Recommendation for Random Number Generation Using Deterministic Random Bit Generators, December 16, 2005. (local copy).
• Draft(NIST Special Publication 800-76) : Biometric Data Specification for Personal Identity Verification, December 15, 2005. (local copy) (Comment Template Form).
• Draft(NIST Special Publication 800-21, Revision 1) : Guideline for Implementing Cryptography in the Federal Government, September 15, 2005. (local copy).
• Draft(NIST Special Publication 800-26, Revision 1) : Guide for Information Security Program Assessments and System Reporting Form, August 15, 2005. (local copy).
• Draft(NIST Special Publication 800-86) : Guide to Computer and Network Data Analysis: Applying Forensic Techniques to Incident Response, August 11, 2005. (local copy).
• Draft(NIST Special Publication 800-84) : Guide to Single-Organization IT Exercises, August 11, 2005. (local copy).
• Draft(NIST Special Publication 800-83) : Guide to Malware Incident Prevention and Handling, August 11, 2005. (local copy).
• Draft(NIST Special Publication 800-81) : Secure Domain Name System (DNS) Deployment Guide, August 11, 2005. (local copy).
• Draft(NIST Special Publication 800-40, Version 2) : Creating a Patch and Vulnerability Management Program, August 11, 2005. (local copy).
  - Old Version, April 2, 2002. (local copy).
• Draft(NIST Special Publication 800-85) : PIV Middleware and PIV Card Application Conformance Test Guidelines, August 5, 2005. (local copy).
• Draft(NIST Special Publication 800-18, Revision 1) : Guide for Developing Security Plans for Federal Information Systems, August 2, 2005. (local copy).
• Draft(NIST FIPS Publication 200) : Minimum Security Requirements for Federal Information and Information Systems, July 15, 2005. (local copy).
• Draft(NIST Special Publication 800-56) : Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography, July 6, 2005. (local copy).
• Draft(NIST Special Publication 800-79) : Guidelines for the Certification and Accreditation of PIV Card Issuing Organizations, June 17, 2005. (local copy).
• Draft(NIST Special Publication 800-57) : Recommendation for Key Management, April 21, 2005.
  - Parts 1 (Draft) (local copy).
  - Parts 2 (Draft) (local copy).
• Draft(NIST Special Publication 800-38B) : Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication, March 10, 2005. (local copy).
  - Old Version#1, November 5, 2002. (local copy).
  - Old Version#2, October 18, 2002. (local copy).
• Draft(NIST Special Publication 800-77) : Guide to IPsec VPNs, January 31, 2005. (local copy).
• Second Draft(NIST Special Publication 800-73) : Integrated Circuit Card for Personal Identity Verification, March 8, 2005. (local copy).
  -Second Draft(old version), January 31, 2005. (local copy).
  - First Draft, November 8, 2004. (local copy).
• Final Public Draft(NIST Special Publication 800-53) : Recommended Security Controls for Federal Information Systems, January 26, 2005. (local copy).
• Draft(NIST Special Publication 800-76) : Biometric Data Specification for Personal Identity Verification, January 24, 2005. (local copy).
• Draft(NIST FIPS PUB 201) : Personal Identity Verification for Federal Employees and Contractors, November 8, 2004. (local copy).
• Draft(NIST Special Publication 800-52) : Guidelines on the Selection and Use of Transport Layer Security, September 29, 2004. (local copy).
• Second Draft(NIST Special Publication 800-53) : Recommended Security Controls for Federal Information Systems, September 28, 2004. (local copy).
  - First Draft, October 31, 2003. (local copy).
• Draft(NIST Special Publication 800-70) : The NIST Security Configuration Checklists Program, August 12, 2004. (local copy).
• Draft(NIST Special Publication 800-72) : Guidelines on PDA Forensics, August 6, 2004. (local copy).
• Draft(NIST Special Publication 800-65) : Integrating Security into the Capital Planning and Investment Control Process, July 7, 2004. (local copy).
• Draft(NIST Special Publication 800-68) : Guidance for Securing Microsoft Windows XP Systems for IT Professionals: A NIST Security Configuration Checklist, June 28, 2004. (local copy).
• Draft(NIST Special Publication 800-66) : An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, May 12, 2004. (local copy).
• Draft(NIST Special Publication 800-58) : Security Considerations for Voice Over IP Systems, May 3, 2004. (local copy).
• Final draft7(NIST Special Publication 800-37) : Guide for the Security Certification and Accreditation of Federal Information Systems , April 6, 2004. (local copy).
  - 2nd Draft, June 30, 2003. (local copy).
  - 1st Draft, October 28, 2002. (local copy).
• Second Draft(Volume I)(NIST Special Publication 800-60) : Guide for Mapping Types of Information and Information Systems to Security Categories, March 29, 2004. (local copy).
  -Draft(Volume II) (local copy).
  -First draft : Volume I(local copy)/ Volume II (local copy).
• Draft(NIST Special Publication 800-67) : Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher, March 4, 2004. (local copy).
• Draft(NIST Special Publication 800-30) : Risk Management Guide for Information Technology Systems(Rev A), January 21, 2004. (local copy).
• Draft(NIST Special Publication 800-27) : Engineering Principles for Information Technology Security (A Baseline for Achieving Security)(Rev A), January 21, 2004 (local copy).
  
• Draft(NIST FIPS Publication 199) : Standards for Security Categorization of Federal Information and Information Systems, September 18, 2003 (local copy).
• Draft(NIST Special Publication 800-61) : Computer Security Incident Handling Guide, September 15, 2003 (local copy).
• Draft(NIST Special Publication 800-38C) : Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality, September 4, 2003. (local copy).
• Draft(NIST Special Publication 800-59) : Guideline for Identifying an Information System as a National Security System, June 3, 2003. (local copy).
• Draft(NIST Publication 199) : Standards for Security Categorization of Federal Information and Information Systems, May 16, 2003. (local copy).
  - Federal Information Security Management Act of 2002, NIST Publication for Policy, 2002. (local copy).
• 2nd Draft(NIST Special Publication 800-50) : Building an Information Technology Security Awareness and Training Program, April 4, 2003. (local copy).
  - 1st Draft, July 19, 2002. (local copy).
• Draft(NIST Special Publication 800-55) : Security Metrics Guide for Information Technology Systems, October 28, 2002. (local copy).
• Draft(NIST Special Publication 800-36) : Guide to Selecting IT Security Products, October 9, 2002. (local copy).
• Draft(NIST Special Publication 800-35) : Guide to IT Security Services, October 9, 2002. (local copy).
• Draft(NIST Special Publication 800-4A) : Security Considerations in Federal Information Technology Procurements, October 9, 2002. (local copy).
• Special Draft : National Strategy to Secure Cyberspace(for public review and comment), September 2002. (local copy).
• Draft(NIST Special Publication 800-48) : Wireless Network Security: 802.11, Bluetooth, and Handheld Devices, July 24, 2002. (local copy).
• Draft(NIST Special Publication 800-46, Version 2) : User's Guide to Securing External Devices for Telework and Remote Access, June 1, 2007. (local copy).
  
• Draft(NIST Special Publication 800-45) : Guidelines on Electronic Mail Security, April 2, 2002. (local copy).
• Draft(NIST Special Publication 800-44, Version 2) : Guidelines on Securing Public Web Servers, June 1, 2007. (local copy).
  - V1 Draft, February 28, 2002. (local copy).
• Draft(NIST Special Publication 800-42) : Guideline on Network Security Testing, February 04, 2001. (local copy).
• Draft(NIST Special Publication 800-43) : System Administration Guidance for Windows 2000 Professional, January 28, 2001. (local copy).
• Recommendation : Use of the CVE Vulnerability Naming Scheme Within its Acquired Products and Information Technology Security Procedures, January, 2001. (local copy).
• Draft(NIST Special Publication 800-34) : Contingency Planning Guide for Information Technology Systems, January, 2001. (local copy).
• Recommendation : Security for Telecommuting and Broadband Communications, December 14, 2001. (local copy).
• 800-XX : Guide for Interconnecting Information Systems, November, 2001. (local copy).
• Draft : Guide to Firewall Selection and Policy Recommendations, October 03, 2001. (local copy).
• Draft : Recommendations Regarding Federal Information Processing Standard (FIPS) 186-2, Digital Signature Standard (DSS), August 03, 2001. (local copy).
• Draft : Recommendation for Block Cipher Modes of Operation, July 27, 2001. (local copy).
• Draft : Risk Management Guide, June 04, 2001. (local copy).
• Draft : Introduction to Public Key Technology and the Federal PKI Infrastructure, March 21, 2001. (local copy).
• Draft : Guidelines on Active Contents and Mobile Code, March 21, 2001. (local copy).
• 800-XX :Self-Assessment Guide for Information Technology Systems, March 9, 2001. (local copy).
• Draft : Draft FIPS for the AES, February 28, 2001. (local copy).
• Draft : Engineering Principles for IT Security (EP-ITS), February 12, 2001. (local copy).
• Draft : Draft guidance document on Intrusion Detection systems, February 12, 2001. (local copy).
• Draft : Keyed-Hash Message Authentication Code (HMAC), January 5, 2001. (local copy).
• Draft : Information Technology Security Assessment Framework, June 11, 2000. (local copy).
• FIPS PUB 140-2 : Security requirements for Cryptographic Modules (Draft), November 1999. (local copy).
• 800-XXX Implementing Internet Firewall Security Policy (Draft), April 1998. (local copy).
• 800-XXX Internet Security Policy: A Technical Guide (Draft), July 1997. (local copy).
  
  
• ISO/IEC 17799:2000 Code of Practice for Information Security Management(revised version), November 2002(original version published July 2001). (local copy).

NIST IR(Interagency reports)

• "2006 Annual Report: Computer Security Division", NIST IR 7399, April 9, 2007. (local copy).
• Cell Phone Forensic Tools: An Overview and Analysis Update, NIST IR 7387, June 1, 2007. (local copy).
• Information Security Guide for Government Executives, NIST IR 7359, February 12, 2007. (local copy).
• Program Review for Information Security Management Assistance (PRISMA), NIST IR 7358, February 12, 2007. (local copy).
• Assessment of Access Control Systems, NIST IR 7316, September 2006. (local copy).
• Personal Identity Verification Card Management Report, NIST IR 7284, January 2006. (local copy).
• Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.3(Revision 2), NIST IR 7275, June 1, 2007. (local copy).
• Cell Phone Forensic Tools: An Overview and Analysis, NIST IR 7250, October 2005. (local copy).
• 4th Annual PKI R&D Workshop Proceedings, NIST IR 7224, August 2005. (local copy).
• Smart Cards and Mobile Device Authentication: An Overview and Implementation, NIST IR 7206, July 2005. (local copy).
• Proximity Beacons and Mobile Handheld Devices: Overview and Implementation, NIST IR 7200, June 2005. (local copy).
• Computer Security Division - 2004 Annual Report, NIST IR 7219, May 2, 2005. (local copy).
• PDA Forensic Tools: An Overview and Analysis, NIST IR 7100, August 2004. (local copy).
• Computer Security Division - 2003 Annual Report, NIST IR 7111, June 15, 2004. (local copy).
• Card Technology Development and Gap Analysis Interagency Report, NIST IR 7056, April 2004. (local copy).
  - Draft V2.0, December 19, 2003. (local copy).
• A Framework for Multi-Mode Authentication: Overview and Implementation Guide, NIST IR 7046, August 2003. (local copy).
• Picture Password: A Visual Login Technique for Mobile Devices, NIST IR 7030, July 2003. (local copy).
• An Overview of Issues in Testing Intrusion Detection Systems, NIST IR 7007, June 2003. (local copy).
• COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP), NIST IR 6985, April 2003. (local copy).
• Policy Expression and Enforcement for Handheld Devices, NIST IR 6981, May 2003. (local copy).
• Government Smart Card Interoperability Specification (GSC-IS), v2.1, NIST IR 6887, July 2003. (local copy).

NIST Projects

• NIST IPsec Project: NIST의 IPsec Project는 IP Layer에 인증, 무결성, 기밀성 등의 암호기능을 지원하기 위한 프로젝트이며, 이는 현재 사용되는 IPv4와 차기에 사용될 IPv6를 대상으로 한다.
• NIST PKI Program: 전자서명이나 기타 공개키 암호 서비스를 제공하기 위한 공개키 기반구조의 개발에 관한 프로젝트.
  • 4th Annual PKI Research Workshop, Gaithersburg, Maryland, USA, April 19-21, 2005. Online Preliminary Proceedings (local copy)
  • 3rd Annual PKI R&D Workshop, Gaithersburg, Maryland, USA, April 12-14, 2004. Online Preliminary Proceedings
  • 2nd Annual PKI Research Workshop, Gaithersburg, Maryland, USA, April 28-29, 2003. Proceeding (local copy)
  • 1st Annual PKI Research Workshop, Gaithersburg, Maryland, USA, April 24-25, 2002. Proceeding (local copy)
• Random Number Generation and Testing: 다양한 암호기법을 이용한 난수생성기나 의사난수생성기에 대해 난수성을 확인할 수 있는 일련의 통계적인 테스트를 개발하고, 이에 관련된 문서와 소프트웨어 구현, 지침등을 제공한다.
• Role Based Access Control: RBAC(Role based access control:역할별 접근제어)은 대단위 네트워크의 복잡성과 보안관리 비용을 줄이는 대안으로 매우 주목받고 있다. RBAC에서는 조직의 구조와 연동하여 직책에 따라 보안등급을 부여하며, 개별 사용자가 특정 직책를 부여받으면 그에 상응하는 권한을 획득한다. 그러므로 RBAC 시스템에서의 보안관리는 각 직책에 해당하는 권한을 결정하여 두고, 각 사용자에게는 직책만을 배정하면 된다. 한 사용자가 여러 직책을 부여받거나 직책간의 계층구조 등으로 발생하는 복잡성은 RBAC 시스템에서 관리하므로 보안관리가 쉬워진다.
• Key Recovery Demonstration Project: 연방정부기관의 요청에 의해 긴급하게 암호화된 데이타에 접근하는 것을 지원하기 위한 프로젝트.
• COMMON CRITERIA PROJECT:
  • COMMON CRITERIA VERSION 2.1 / ISO IS 15408 Common Criteria for Information Technology Security Evaluation, August 1999
    • Part 1 - Intro & General Model (local copy FIPS / ISO/IEC 15408-1)
    • Part 2 - Functional Requirements (local copy FIPS / ISO/IEC 15408-2)
    • Part 3 - Assurance Requirements (local copy FIPS / ISO/IEC 15408-3)
• Advanced Encryption Standard (AES): 민간분야 사용을 목적으로 DES를 대체할 새로운 암호표준을 공모하고 3년여에 걸친 공개적인 평가작업을 거친 후, 2000년 10월 2일 Rijndael을 최종 AES 블록암호 알고리즘으로 채택하였다. AES는 2001년 11월 26일 정식으로 승인되어 12월 4일 NIST에 의해 공식적으로 발표되었다.
• Cryptographic toolkit: 암호 기술에 대한 표준 개발 및 유지보수를 목적으로 하며 다음과 같은 분야를 포함한다.
  • Guidance
  • Encryption
  • Modes of Operation - Modes of Operation Homepage
    - Comments on Draft SP 800-38B
    - Consultation Paper on the Selection of a Block Cipher Based MAC Algorithm, April 8, 2003. (local copy). *In response to the comments, a NIST consultation paper summarizes technical issues underlying the selection of a block cipher based MAC and proposes to refocus the RMAC specification to its underlying EMAC construction.
    • Second Modes of Operation Workshop Goleta, California, USA, August 24, 2001.
    • First Modes of Operation Workshop Baltimore, Maryland, USA, October 20, 2000.
  • Digital Signatures
  • Secure Hashing
  • Key Management
    - Key Management Homepage
    • Second Key Management Workshop, November 1-2, 2001.
    • First Key Management Workshop, February 10-11, 2000.
  • Random Number Generation
  • Message Authentication
  • Entity Authentication
  • Password Usage and Generation
• Cryptographic Module Validation(CMV) Program: 암호 모듈 및 알고리즘의 NIST 표준(FIPS 140-1/140-2/46-3/180-1/185/186-2/197) 준수 여부를 실증하기 위한 프로그램.
• System Certification and Accrediation Project: Securing the Nation's Critical Information Infrastructure.
• Smartcard Research and Development: Smartcard에 대한 표준과 상호 호환성 테스트를 위한 프로젝트 사이트.
• PIV: Personal Identity Verification (PIV) of Federal employees and contractors.
• ASSET: The Automated Security Self-Evaluation Tool.
• ANTD: NIST-ITL’s Advanced Network Technologies Division.

  [Online Proceeding/Presentation]
  

• Wireless LAN Security Workshop, Falls Church, Virginia, December 4-5, 2002.
• IT Security Capital Investment Planning Workshop, June 4, 2003.
• Workshop on Storage and Processor Card-based Technologies, June 8-9, 2003.
• Workshop on Spam Technologies, February 17, 2004.
• Workshop on FIPS 201 Personal Identity Verification For Federal Employees and Contractors, November 2004.
• CRYPTOGRAPHIC HASH WORKSHOP, October 31 - November 1, 2005.