Skip to content
POTKAY
BARANSKI
Contact Us
← All updates
Security Control Assessment

NIST seeks input on key-derivation revision for security assessment planning

NIST’s November 4 pre-draft request seeks feedback on cryptographic key-derivation changes by December 18, with implications for federal security assessment planning.

First published on source website · Source website

Source: Cyber Defense Group. Original reporting and dates are preserved.

Exterior of NIST’s Advanced Measurement Laboratory.

NIST Advanced Measurement Laboratory, December 2004. Archival agency context for the pre-draft comment request; not a cryptographic device or a photograph of the announcement. No endorsement implied.

Gail Porter/NIST · NIST public information; reuse with credit · License

The photograph above has its own source and credit. Image references in the original reporting below may describe a different image on the source publication.

Cyber Defense Group update

NIST opened a pre-draft comment period on November 4, 2026 for a planned revision of SP 800-108, its recommendation for deriving cryptographic keys using pseudorandom functions. Comments are due December 18, 2026. The announcement is preparation for Revision 2, not a final replacement standard.

NIST points to research concerns involving output indistinguishability and key-control security in certain constructions. It seeks feedback on possible changes to CMAC-based approaches, whether to retain one or both Double-Pipeline constructions, and effects on implementation, validation and interoperability.

For contractors providing ISSO, RMF and security assessment support to federal systems, this is a planning signal: identify where system documentation or supplier evidence relies on SP 800-108 and ask the responsible cryptographic specialists about affected constructions. That is an assessment-planning recommendation, not a finding that a specific product is vulnerable or noncompliant.

The current final publication remains SP 800-108 Revision 1, including the February 2024 update. This pre-draft request does not itself announce changes to module-validation status, a blanket replacement deadline or a procurement opportunity. Teams should follow applicable agency requirements and validation guidance while the revision develops.

Sources and references

Official sourceNational Institute of Standards and Technology
NIST November 4 announcementNational Institute of Standards and Technology
Current final SP 800-108 Rev. 1, updated February 2024National Institute of Standards and Technology

Source publication notes

Pre-draft comment request, not a final Revision 2 standard or a solicitation.
The comment deadline states a date only; no closing time or timezone is provided.
Assessment-planning implications are editorial analysis, not a product-specific vulnerability or compliance finding.

Educational information, not legal advice. Current official program guidance and the instructions for your application control. Registration, certification, or consulting does not guarantee an award.