NIST releases report on cryptography expertise

NIST’s primary external advisory board released a report calling for the agency to increase its staff of cryptography experts and implement more explicit processes for ensuring openness and transparency to strengthen its cryptography efforts.

In the fall of 2013, former NIST Director Patrick D. Gallagher requested that the Visiting Committee on Advanced Technology (VCAT) review NIST’s cryptographic standards and guidelines development process, in response to community concerns that a cryptographic algorithm in a NIST standard had been deliberately weakened.

In making its recommendations, the VCAT specifically addressed NIST’s interactions with the NSA. The report states, “NIST may seek the advice of the NSA on cryptographic matters but it must be in a position to assess it and reject it when warranted.”

The Federal Information Security Management Act (FISMA) of 2002 gives NIST responsibility for developing information security standards and guidelines for non-national security federal information systems. These standards and guidelines have been widely adopted by U.S. industry and the international community. FISMA also directs NIST to consult with other agencies such as the NSA, to promote coordination and avoid conflicting standards.

In May 2014, the VCAT convened a blue ribbon panel of experts called the Committee of Visitors (COV) and asked each expert to review NIST’s cryptographic process and provide individual reports of their conclusions and recommendations. The experts, states the VCAT report, “point out several shortcomings and procedural weaknesses that led to the inclusion” of the algorithm, despite known community concerns with its security.

In its report, the VCAT noted that “it is of paramount importance that NIST’s process for developing cryptographic standards is open and transparent and has the trust and support of the cryptographic community.” The committee recommends that NIST explore, “in addition to the current avenues, expanding its programs to engage academia and outside experts to aid in the review of specific technical topics.”The report also recommends that NIST review the current requirement for interaction with the NSA and recommends changes in instances where it “hinders [NIST’s] ability to independently develop the best cryptographic standards.”

The VCAT review was part of a larger initiative by NIST that included an internal review of its development process and the February 2014 release of a document outlining the principles behind that process. NIST IR 7977: DRAFT NIST Cryptographic Standards and Guidelines Development Process will be finalized by the end of 2014, and will include more detailed processes and procedures that incorporate feedback from the VCAT and the public.