Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mathematician warns US spies may be weakening next-gen encryption

newscientist.com

Post reply on HN
Print view View original

191–200 of 218 posts

Re: Mathematician warns US spies may be weakening next-gen encryption

#191

Post by tptacek »

diogenes4 wrote: post #167
tptacek wrote: post #22

Earlier quoted context omitted.

NIST refereed a competition among the best-regarded academic cryptographers in the world. It didn't design any of these constructions, and practically all of the inputs into the competition, including the critiques of the submissions, came from academics (many of them not American). One of the annoying things about how Bernstein is communicating about this is that he is counting on his audience not knowing this.

This is all nice and well, but it doesn't actually address the inherent untrustworthiness of a state-associated (and known to be penetrated) organization.

The entire point of the competition is for the state to select a state standard, so "state-associated" is not the smoking gun people suggest it is. If you don't care about state standards, hey, I'm right there with you. But: they obviously exist.

Re: Mathematician warns US spies may be weakening next-gen encryption

#192

Post by tptacek »

myrion wrote: post #100
nmadden wrote: post #99

Earlier quoted context omitted.

I’ve not followed the PQC competition very closely, but I don’t think djb’s arguments significantly impact whether you should use KYBER-512. From my reading, as someone with a decent amount of crypto knowledge, all the evidence suggests that it is more than secure enough. The rest of the stuff is at the level of “submit an erratum”, not “omg cancel the whole thing”. If anything, this reinforces my belief that KYBER i…

The last part I agree with - clearly KYBER isn't trivially broken if this is the best he can come up with. What doesn't seem clear to me, and I'd appreciate if you could tell me why you think differently, is that KYBER-512 isn't as strong as it was targeted to be. I find djb's argument on this narrow point fairly convincing: KYBER-512 isn't as secure as AES-128 (by the methods used to measure "secure" in this competi…

There's a valid point to be made about selecting key exchange parameters to match bulk encryption parameters, but before you gear up to make a stink about it, bear in mind that it's generally the case in modern cryptosystems (that aren't specifically designed to do that matching) that key exchange security levels are lower than those of block ciphers. The step functions for key exchange security levels are pretty abrupt, and you pay a pretty high price to select the next one up, so aiming for "roughly the vicinity" of 128 bits is pretty normal.

Re: Mathematician warns US spies may be weakening next-gen encryption

#193

Post by greggsy »

RandomLensman wrote: post #112
greggsy wrote: post #110

Earlier quoted context omitted.

The people are still human beings. The process is still open to FOIA. It’s not perfect, but it’s the right solution.

Sorry, what is the right solution? Total surveillance? The current approach? Some middling thing?

FOI

Re: Mathematician warns US spies may be weakening next-gen encryption

#194

Post by ethbr1 »

willcipriano wrote: post #187
ethbr1 wrote: post #174

Earlier quoted context omitted.

I'd say the haphazard destruction of Blackberries and iPads with hammers is pretty explicit evidence of how bad State Dept IT policy and execution was. Maybe I've worked in large corporations too much, but my first question when I see policy violations is not "How is this person conspiring?" but rather "What made following the official policy difficult? And how can we fix that?" Also, the State Dept seems like exactl…

She must've been unaware of her legal requirements under FOIA, that her husband signed into law, when she ordered the people's emails destroyed.

Or, she didn't even think about records retention or device security, in the same way that most politicians/executives don't, assuming it was handled by someone.

And it was in fact not, because there was no functioning policy enforcement at State.

Re: Mathematician warns US spies may be weakening next-gen encryption

#195

Post by denton-scratch »

jcranmer wrote: post #170
denton-scratch wrote: post #89

Earlier quoted context omitted.

> historically the best crypto has been invented in the US ENIGMA?

The Enigma machine was probably the weakest of its kind of machines. It had a critical security flaw in that it could never encipher a letter to itself, and most of its security came from the IV settings, which were communicated in such poor fashion that the Poles cracked it long before WW2 even started. By contrast, the US and British rotor machines were never cracked by the Axis powers in WW2, and the other two Ger…

According to Wikipedia, rotor cyphers were probably invented in the Netherlands, not the US. It says an american tried to commercialize the idea, but went bust. The only patents they mention were issued to Europeans.

They don't seem to mention these spiffy US and UK rotor cyphers; any pointers?

Re: Mathematician warns US spies may be weakening next-gen encryption

#196

Post by heavyset_go »

Borealid wrote: post #83
heavyset_go wrote: post #76

Earlier quoted context omitted.

Nice, last time I looked the Solo Hacker Edition was completely out of stock. Looks like the Solo HE lets you load your own firmware on to it, but it doesn't let you load your own signing or encryption key to ensure firmware updates are trusted. Apparently the Solo HE can be flashed once permanently by overwriting the bootloader, though. The non-HE versions of the Solo 1 and 2 will load new firmware signed by Solokey…

If you're worried about nation-state level attackers you are probably best off with a device that is burned in and can't be upgraded/changed.

Not even that, I just assume that in a few years, anyone who has a few thousand dollars to hand to Cellebrite will have access to devices that can crack security keys, just like they can give Cellebrite some money today for devices that can hack phones, tablets and computers nearly instantly.

Re: Mathematician warns US spies may be weakening next-gen encryption

#197

Post by nonrandomstring »

api wrote: post #154
nonrandomstring wrote: post #10

"All we can do is tell people that NIST are the ones in the room making the decisions, but if you don't believe us, there's no way you could verify that without being inside NIST" says Moody. There's our problem - right there! If a body as important as NIST is not so utterly transparent that any random interested person cannot comb through every meeting, memo, and coffee break conversation then it needs disbanding an…

Modern panopticon level surveillance is not deployed through weakening encryption. It's just built right into platforms and apps and people willfully install it because it gives them free services and addictive social media feeds. You don't need to weaken encryption to spy on people. You just have to give them a dancing bunny and to see the dancing bunny they must say yes to "allow access to contacts" and "allow acce…

> In addition the more we adopt and make use of cloud command and control architectures the more surveilled we become, because it becomes trivial for anyone with access to the cloud provider's internals to tap everyone's behavior.

Spoke about this last night in London

https://www.youtube.com/watch?v=mcWIQALtOtg

Re: Mathematician warns US spies may be weakening next-gen encryption

#198

Post by tptacek »

sidewndr46 wrote: post #123
tptacek wrote: post #23

Earlier quoted context omitted.

This is a comment that only makes sense if you believe NIST designed CRYSTALS-Kyber, or had a significant hand in its design. But nothing of the sort happened. The CRYSTALS team is overwhelmingly academic and overwhelmingly European. It's frustrating that Bernstein has communicated about this without making that clear, because it's obvious that lots of people believe NIST went off in a room and came up with a scheme,…

is there some prohibition at the NSA on bribing Europeans?

Here you're making a claim even Bernstein isn't making; of course, he couldn't, because he is openly advocating for NIST to endorse NTRUprime, which would leave open the question of how much NIST paid him to co-submit NTRUprime.

Re: Mathematician warns US spies may be weakening next-gen encryption

#199

Post by [deleted] »

throw0101c wrote: post #180
vlovich123 wrote: post #152

Earlier quoted context omitted.

SHA-2 is has more reliable HW acceleration from what I’ve seen. SHA-1 SW according to smhasher is 350mib/s as is MD5, so never use MD5 as SHA-1 is always stronger (sha2 supposedly is 150mib/s). Hw accelerated SHA-1 and SHA-2 are both ~1.5 Gib/s and on x86 HW acceleration is always available. Blake3 is the most interesting because it’s competitive with SHA2 even without HW acceleration. I wonder how it would fare with…

> Blake3 is the most interesting […] Not really? SHA-2 was released in 2001: * https://en.wikipedia.org/wiki/SHA-2 Blake3 was released 2020. I'm sure if the folks that created SHA-2 did a hash in 2020 they could do something better/faster as well.

[deleted]

Re: Mathematician warns US spies may be weakening next-gen encryption

#200

Post by oconnor663 »

AlexandrB wrote: post #135
throw0101c wrote: post #131

Earlier quoted context omitted.

And SHA-1 is faster than SHA-2, with MD5 faster than both. But speed isn't the only reason to choose an algorithm.

As a non cryptographer this whole conversation chain has me confused. I though it was desirable for a good hashing algorithm to be slow to make brute force difficult.

Yeah this is a super common point of confusion. You need to worry about slowing down a brute force attacker when you're trying to protect a low-entropy secret, which basically always means user passwords. But when your secrets are big enough, like 128 bits, brute force becomes impossible just by virtue of the size of the search space. So for most cryptographic applications, it's the size of your key (and the fact that your hash or cipher doesn't _leak_ the key) that's protecting you from brute force, not the amount of time a single attempt takes.
Post reply on HN