Click Here! |

Brief Full Advanced Search Search Tips
|  |  | To access the contents, click the chapter and section titles. Applied Cryptography, Second Edition: Protocols, Algorthms, and Source Code in C (cloth) (Publisher: John Wiley & Sons, Inc.) Author(s): Bruce Schneier ISBN: 0471128457 Publication Date: 01/01/96 Search this book:
Previous | Table of Contents | Next
### 25.2 National Computer Security Center (NCSC) The National Computer Security Center, a branch of the NSA, is responsible for the government’s trusted computer program. Currently, the center evaluates commercial security products (both hardware and software), sponsors and publishes research, develops technical guidelines, and generally provides advice, support, and training. The NCSC publishes the infamous “Orange Book” [465]. Its actual title is the Department of Defense Trusted Computer System Evaluation Criteria, but that’s a mouthful to say and the book has an orange cover. The Orange Book attempts to define security requirements, gives computer manufacturers an objective way to measure the security of their systems, and guides them as to what to build into their secure products. It focuses on computer security and doesn’t really say a lot about cryptography. The Orange Book defines four broad divisions of security protection. It also defines classes of protection within some of those divisions. They are summarized in Table 25.2. Table 25.1 CCEP Modules
Application | Type I | Type II
--- | --- | ---
Voice/low-speed data | Winster | Edgeshot
Computer | Tepache | Bulletproof
High-speed data | Foresee | Brushstroke
Next Generation | Countersign I | Countersign II
Sometimes manufacturers say things like “we have C2 security.” This is what they’re talking about. For more information on this, read [1365]. The computer security model used in these criteria is called the Bell-LaPadula model [100,101,102,103]. The NCSC has published a whole series of books on computer security, sometimes called the Rainbow Books (all the covers have different colors). For example, Trusted Network Interpretation of the Trusted Computer System Evaluation Criteria [1146], sometimes called the “Red Book,” interprets the Orange Book for networks and network equipment. The Trusted Database Management System Interpretation of the Trusted Computer System Evaluation Criteria [1147]—I can’t even begin to describe the color of that cover—does the same for databases. There are now over 30 of these books, some with hideously colored covers. For a complete set of the Rainbow Books, write Director, National Security Agency, INFOSEC Awareness, Attention: C81, 9800 Savage Road, Fort George G. Meade, MD 20755-6000; (410) 766-8729. Don’t tell them I sent you. ### 25.3 National Institute of Standards and Technology (NIST) The NIST is the National Institute of Standards and Technology, a division of the U.S. Department of Commerce. Formerly the NBS (National Bureau of Standards), it changed its name in 1988. Through its Computer Systems Laboratory (CSL), NIST promotes open standards and interoperability that it hopes will spur the economic development of computer-based industries. To this end, NIST issues standards and guidelines that it hopes will be adopted by all computer systems in the United States. Official standards are published as FIPS (Federal Information Processing Standards) publications. If you want copies of any FIPS (or any other NIST publication), contact National Technical Information Service (NTIS), U.S. Department of Commerce, 5285 Port Royal Road, Springfield, VA 22161; (703) 487-4650; or visit gopher://csrc.ncsl.nist.gov. When Congress passed the Computer Security Act of 1987, NIST was mandated to define standards for ensuring the security of sensitive but unclassified information in government computer systems. (Classified information and Warner Amendment data are under the jurisdiction of the NSA.) The Act authorizes NIST to work with other government agencies and private industry in evaluating proposed technology standards. Table 25.2 Orange Book Classifications
D: Minimal Security C: Discretionary Protection
| C1: Discretionary Security Protection C2: Controlled Access Protection
B: Mandatory Protection
| B1: Labeled Security Protection B2: Structured Protection B3: Security Domains
A: Verified Protection
| A1: Verified Design
NIST issues standards for cryptographic functions. U.S. government agencies are required to use them for sensitive but unclassified information. Often the private sector adopts these standards as well. NIST issued DES, DSS, SHS, and EES. All these algorithms were developed with some help from the NSA, ranging from analyzing DES to designing DSS, SHS, and the Skipjack algorithm in EES. Some people have criticized NIST for allowing the NSA to have too much control over these standards, since the NSA’s interests may not coincide with those of NIST. It is unclear how much actual influence NSA has on the design and development of the algorithms. Given NIST’s limited staff, budget, and resources, NSA’s involvement is probably considerable. NSA has significant resources to contribute, including a computer facility second-to-none.
Previous | Table of Contents | Next
[an error occurred while processing this directive]

| Products | Contact Us | About Us | Privacy | Ad Info | Home Use of this site is subject to certain Terms & Conditions, Copyright © 1996-1999 EarthWeb Inc. All rights reserved. Reproduction whole or in part in any form or medium without express written permision of EarthWeb is prohibited.