Although NIST must work with NSA by law, the agency maintains a public vetting process for all encryption standards The U.S. National Institute of Standards and Technology (NIST) has vigorously denied that the U.S. National Security Agency (NSA) tampered with NIST’s process of vetting and choosing encryption algorithms.“NIST would not deliberately weaken a cryptographic standard,” NIST said in a statement Tuesday. “We will continue in our mission to work with the cryptographic community to create the strongest possible encryption standards for the U.S. government and industry at large.”The statement was issued five days after The New York Times accused the NSA of circumnavigating the NIST-approved encryption algorithms used to secure electronic communications, either by introducing virtually undetectable back doors in the algorithms or by subverting the public development process to weaken new encryption algorithms and supporting technologies.NIST led development of many of the algorithms used to encrypt data on the Internet, such as AES (Advanced Encryption Standard) and the now largely defunct DES (Digital Encryption Standard). Both AES and DES are used in SSL (Secure Socket Layer), the protocol used by browsers to secure sensitive data. In addition to issuing the statement, NIST has also reopened public comments for a number of proposed encryption related standards, namely Special Publication 800-90A and draft Special Publications 800-90B and 800-90C, which cover the random bit generators that provide random numbers to seed encryption keys.NIST noted that it has worked closely with the NSA to help develop encryption standards, due to the NSA’s expertise in this area. NIST is also required to consult with the NSA by U.S. legal statute. But the agency noted that its process for vetting encryption algorithms is an open one, in which anyone can review and comment on the work being done. “If vulnerabilities are found in these or any other NIST standards, we will work with the cryptographic community to address them as quickly as possible,” the statement read.Joab Jackson covers enterprise software and general technology breaking news for The IDG News Service. Follow Joab on Twitter at @Joab_Jackson. Joab’s e-mail address is Joab_Jackson@idg.com Related content news UK government plans 2,500 new tech recruits by 2025 with focus on cybersecurity New apprenticeships and talent programmes will support recruitment for in-demand roles such as cybersecurity technologists and software developers By Michael Hill Sep 29, 2023 4 mins Education Industry Education Industry Education Industry news UK data regulator orders end to spreadsheet FOI requests after serious data breaches The Information Commissioner’s Office says alternative approaches should be used to publish freedom of information data to mitigate risks to personal information By Michael Hill Sep 29, 2023 3 mins Government Cybercrime Data and Information Security feature Cybersecurity startups to watch for in 2023 These startups are jumping in where most established security vendors have yet to go. By CSO Staff Sep 29, 2023 19 mins CSO and CISO Security news analysis Companies are already feeling the pressure from upcoming US SEC cyber rules New Securities and Exchange Commission cyber incident reporting rules don't kick in until December, but experts say they highlight the need for greater collaboration between CISOs and the C-suite By Cynthia Brumfield Sep 28, 2023 6 mins Regulation Data Breach Financial Services Industry Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe