In a move to strengthen its cryptography efforts, the National Institute of Standards and Technology (NIST) needs to increase its staffing to implement more explicit processes for ensuring openness and transparency, an advisory board said.
The Visiting Committee on Advanced Technology (VCAT) report also highlights the importance of having the trust and participation of the broader cryptographic community in NIST’s program.
In the fall of 2013, former NIST Director Patrick D. Gallagher requested the VCAT review NIST’s cryptographic standards and guidelines development process, in response to concerns a cryptographic algorithm in a NIST standard ended up deliberately weakened.
In making its recommendations, the VCAT specifically addressed NIST’s interactions with the National Security Agency (NSA). The report states, “NIST may seek the advice of the NSA on cryptographic matters but it must be in a position to assess it and reject it when warranted.”
“Ensuring we have a process that delivers strong cryptography and protects the integrity of our standards and guidelines is our highest priority,” said Acting NIST Director Willie May. “We appreciate this review by the VCAT and the individual Committee of Visitor experts. NIST has already taken several steps to strengthen the process for developing cryptographic standards and will carefully consider these recommendations.”
The Federal Information Security Management Act (FISMA) of 2002 gives NIST responsibility for developing information security standards and guidelines for non-national security federal information systems. These standards and guidelines have been widely adopted by U.S. industry and the international community. FISMA also directs NIST to consult with other agencies such as the NSA, to promote coordination and avoid conflicting standards.
In May 2014, the VCAT convened a blue ribbon panel of experts called the Committee of Visitors (COV) and asked each expert to review NIST’s cryptographic process and provide individual reports of their conclusions and recommendations. The experts “point out several shortcomings and procedural weaknesses that led to the inclusion” of the algorithm, despite known community concerns with its security.
In its report, the VCAT said “it is of paramount importance that NIST’s process for developing cryptographic standards is open and transparent and has the trust and support of the cryptographic community.” The committee recommends NIST explore, “in addition to the current avenues, expanding its programs to engage academia and outside experts to aid in the review of specific technical topics.”The report also recommends that NIST review the current requirement for interaction with the NSA and recommends changes in instances where it “hinders [NIST’s] ability to independently develop the best cryptographic standards.”
The VCAT review was part of a larger initiative by NIST that included an internal review of its development process and the February 2014 release of a document outlining the principles behind that process. NIST IR 7977: DRAFT NIST Cryptographic Standards and Guidelines Development Process will wrap up by the end of this year, and will include more detailed processes and procedures that incorporate feedback from the VCAT and the public.
“We will continue to work with the best cryptography experts in the world, both inside and outside of government,” said May. “At the same time, we recognize and agree with the VCAT that NIST must strengthen its in-house cryptography capabilities to ensure we can reach independent conclusions about the merits of specific algorithms or standards.”