NISTIR 7298 Revision 1, Glossary of Key Information Security Terms

23.03.2013 Views
NIST IR 7298 Revision 1, Glossary of Key Information Security Terms Non-Repudiation – Is the security service by which the entities involved in a communication cannot deny having participated. Specifically, the sending entity cannot deny having sent a message (non-repudiation with proof of origin), and the receiving entity cannot deny having received a message (non-repudiation with proof of delivery). SOURCE: FIPS 191 A service that is used to provide assurance of the integrity and origin of data in such a way that the integrity and origin can be verified and validated by a third party as having originated from a specific entity in possession of the private key (i.e., the signatory). SOURCE: FIPS 186 Nonce – A value used in security protocols that is never repeated with the same key. For example, challenges used in challenge-response authentication protocols generally must not be repeated until authentication keys are changed, or there is a possibility of a replay attack. Using a nonce as a challenge is a different requirement than a random challenge, because a nonce is not necessarily unpredictable. SOURCE: SP 800-63 A random or non-repeating value that is included in data exchanged by a protocol, usually for the purpose of guaranteeing the transmittal of live data rather than replayed data, thus detecting and protecting against replay attacks. SOURCE: CNSSI-4009 NSA-Approved Cryptography – Cryptography that consists of: (i) an approved algorithm; (ii) an implementation that has been approved for the protection of classified information in a particular environment; and (iii) a supporting key management infrastructure. SOURCE: SP 800-53 Null – Dummy letter, letter symbol, or code group inserted into an encrypted message to delay or prevent its decryption or to complete encrypted groups for transmission or transmission security purposes. SOURCE: CNSSI-4009 Object – A passive entity that contains or receives information. SOURCE: SP 800-27 Passive information system-related entity (e.g., devices, files, records, tables, processes, programs, domains) containing or receiving information. Access to an object implies access to the information it contains. SOURCE: CNSSI-4009 Pg 128

NIST IR 7298 Revision 1, Glossary of Key Information Security Terms Passive information system-related entity (e.g., devices, files, records, tables, processes, programs, domains) containing or receiving information. Access to an object (by a subject) implies access to the information it contains. See Subject. SOURCE: SP 800-53 Object Identifier – A specialized formatted number that is registered with an internationally recognized standards organization. The unique alphanumeric/numeric identifier registered under the ISO registration standard to reference a specific object or object class. In the federal government PKI, they are used to uniquely identify each of the four policies and cryptographic algorithms supported. SOURCE: SP 800-32 Object Reuse – Reassignment and reuse of a storage medium containing one or more objects after ensuring no residual data remains on the storage medium. SOURCE: CNSSI-4009 Off-Card – Refers to data that is not stored within the PIV card or computation that is not done by the Integrated Circuit Chip (ICC) of the PIV card. SOURCE: FIPS 201 Off-line Attack – An attack where the attacker obtains some data (typically by eavesdropping on an authentication protocol run, or by penetrating a system and stealing security files) that he/she is able to analyze in a system of his/her own choosing. SOURCE: SP 800-63 Off-line Cryptosystem – Cryptographic system in which encryption and decryption are performed independently of the transmission and reception functions. SOURCE: CNSSI-4009 Official Information – All information in the custody and control of a U.S. government department or agency that was acquired by U.S. government employees as a part of their official duties or because of their official status and has not been cleared for public release. SOURCE: CNSSI-4009 On-Card – Refers to data that is stored within the PIV card or computation that is done by the ICC of the PIV card. SOURCE: FIPS 201 Pg 129

Page 2 and 3: NIST IR 7298 Revision 1 Glossary of

Page 4 and 5: NIST IR 7298 Revision 1, Glossary o






































































































Page 210 and 211: NIST IR 7298, Glossary of Key Infor

cryptographic

fips

nist

glossary

revision

authentication

comsec

software

controls

entity

nistir

csrc.nist.gov

NISTIR 7298 Revision 1, Glossary of Key Information Security Terms

NISTIR 7298 Revision 1, Glossary of Key Information Security Terms ... View more NISTIR 7298 Revision 1, Glossary of Key Information Security Terms

Delete template?

Save as template ?

NISTIR 7298 Revision 1, Glossary of Key Information Security Terms NISTIR 7298 Revision 1, Glossary of Key Information Security Terms