Sharing Notice: White 3 The National Cryptographic Standards Cryptographic Schemes 3.1 Block Cipher Modes of Operation Accepted block cipher modes of operation: • Counter Mode (CTR) as in NIST SP800-38A. • Cipher Block Chaining (CBC) as in NIST SP800-38A. • XEX Tweakable Block Cipher with Ciphertext Stealing (XTS-AES) as in NIST SP800-38E. • Output Feedback (OFB) as in NIST SP 800-38A. • Cipher Feedback (CFB) as in NIST SP 800-38A. Common notes: • Cipher Block Chaining (CBC) is only accepted for MODERATE. 3.2 Message Authentication Codes (MAC) Accepted message authentication codes: • Cipher-based MAC (CMAC) as in NIST SP 800-38B . The scheme should be used for at most 248 messages. . Used only in applications where no party learns all-0 string enciphering in the block cipher underlying the MAC. . A tag length of at least 96 bit with protected authentication keys. • Hash-based MAC (HMAC) as in FIPS PUB 198-1 . A tag length of at least 96 bit with protected authentication keys. . To be used with SHA-2 and SHA-3 (as mentioned in Sub-Section 2.3). 3.3 Authenticated Encryption with Associated Data (AEAD) Accepted authenticated encryption with associated data: • Galois Counter Mode (GCM) as in NIST SP 800-38D . A nonce generation length of at least 96 bits. . IV to be unique within the key change period. . The use of short authentication tags is not accepted. • Counter with CBC-MAC (CCM) as in NIST SP 800-38C. 3.4 Key Wrap Functions Accepted key wrap functions: • Key Wrap (KW) as in NIST SP 800-38 F. • Key Wrap with Padding (KWP) as in NIST SP 800-38 F. 14 Document Classification: Open