Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mathematician warns US spies may be weakening next-gen encryption

newscientist.com

Post reply on HN
Print view View original

201–210 of 218 posts

Re: Mathematician warns US spies may be weakening next-gen encryption

#201

Post by nonrandomstring »

ethbr1 wrote: post #177
breakwaterlabs wrote: post #149

Earlier quoted context omitted.

It seems wildly shortsighted as well. I think everyone here is pretty clear how they would ethically view such a thing, but view it from NIST's (/ NSA's) perspective for the sake of argument. Maybe there's a specific threat where NIST (or presumably the NSA) believes it has a mandate to insert a backdoor. In order to successfully do this, NIST needs to maintain a very large bank of social capital and industry trust t…

Everyone also discounts the other reason NIST (with NSA behind the scenes) might be shifty -- they know of a mathematical or computational exploit class that no one else does. And therefore want to do things-which-seem-pointless-to-everyone-else to an algorithm to guard against it. Without disclosing what "it" is. Everyone's quick to jump to the "NSA is weakening algorithms" explanation, but there's both historical a…

> They have a dual mission

Which is why I don't buy anything from the apologists for "manageable" backdoors.

> strengthen

This is a good theory and interesting take.

Re: Mathematician warns US spies may be weakening next-gen encryption

#203

Post by vlovich123 »

throw0101c wrote: post #180
vlovich123 wrote: post #152

Earlier quoted context omitted.

SHA-2 is has more reliable HW acceleration from what I’ve seen. SHA-1 SW according to smhasher is 350mib/s as is MD5, so never use MD5 as SHA-1 is always stronger (sha2 supposedly is 150mib/s). Hw accelerated SHA-1 and SHA-2 are both ~1.5 Gib/s and on x86 HW acceleration is always available. Blake3 is the most interesting because it’s competitive with SHA2 even without HW acceleration. I wonder how it would fare with…

> Blake3 is the most interesting […] Not really? SHA-2 was released in 2001: * https://en.wikipedia.org/wiki/SHA-2 Blake3 was released 2020. I'm sure if the folks that created SHA-2 did a hash in 2020 they could do something better/faster as well.

First, each Blake version was written by a totally different authors AFAICT so while each version is faster, making a faster construction was a totally different team. I don't see why you're putting so much confidence that the original SHA-2 team could come up with a faster hash function.

FWIW, SHA-3 is slower than SHA-2 although of course SHA-3 is a totally different construction from SHA-2 by design.

Re: Mathematician warns US spies may be weakening next-gen encryption

#204

Post by diogenes4 »

tptacek wrote: post #191
diogenes4 wrote: post #167

Earlier quoted context omitted.

This is all nice and well, but it doesn't actually address the inherent untrustworthiness of a state-associated (and known to be penetrated) organization.

The entire point of the competition is for the state to select a state standard, so "state-associated" is not the smoking gun people suggest it is. If you don't care about state standards, hey, I'm right there with you. But: they obviously exist.

Right, I guess I'm asking why anyone puts up with the idea of a state standard to begin with when it only benefits the state.

Re: Mathematician warns US spies may be weakening next-gen encryption

#205

Post by mardifoufs »

marcyb5st wrote: post #5
garba_dlm wrote: post #4

Earlier quoted context omitted.

so essentially: "because you only have worse choices"

Except that in one I can say "my president is an idiot. We need a leadership change" without wiping my credit score or being detained.

So I guess the op was right, why does the rest of the world use American standards, since we can't choose your president either

(I don't actually believe that we shouldn't use NIST standards, but my point is that's a pretty weak argument for non Americans. )

Re: Mathematician warns US spies may be weakening next-gen encryption

#206

Post by tptacek »

diogenes4 wrote: post #204
tptacek wrote: post #191

Earlier quoted context omitted.

The entire point of the competition is for the state to select a state standard, so "state-associated" is not the smoking gun people suggest it is. If you don't care about state standards, hey, I'm right there with you. But: they obviously exist.

Right, I guess I'm asking why anyone puts up with the idea of a state standard to begin with when it only benefits the state.

Why not ask Bernstein why he's participating in a program to generate one?

Re: Mathematician warns US spies may be weakening next-gen encryption

#207

Post by Borealid »

heavyset_go wrote: post #196
Borealid wrote: post #83

Earlier quoted context omitted.

If you're worried about nation-state level attackers you are probably best off with a device that is burned in and can't be upgraded/changed.

Not even that, I just assume that in a few years, anyone who has a few thousand dollars to hand to Cellebrite will have access to devices that can crack security keys, just like they can give Cellebrite some money today for devices that can hack phones, tablets and computers nearly instantly.

The applet source code I linked above can be configured to use your PIN (not stored on the device) as the keying material to AES256-encrypt all the credentials stored on the trusted element. The PIN may be up to 63 bytes long, and the derivative used for keying is 128 bits.

If you think some company in the future will have the ability to somehow "steal" the contents of the device's flash, you'd still have to climb the mountain of explaining how they could then break the encryption the open-source software already - before they got hold of the key - applied to the flash contents.

Just to make sure this is clear, the security key at rest is not storing your credentials. It is storing AES256(key=, value=). It is not storing the PIN.

You only need to trust the hardware to implement encryption correctly, which you can - of course - verify yourself. It's not realistic to say that the pre-encrypted values might be secretly stored somewhere else: there just isn't enough space on the device to do that.

Re: Mathematician warns US spies may be weakening next-gen encryption

#208

Post by conradludgate »

AlexandrB wrote: post #135
throw0101c wrote: post #131

Earlier quoted context omitted.

And SHA-1 is faster than SHA-2, with MD5 faster than both. But speed isn't the only reason to choose an algorithm.

As a non cryptographer this whole conversation chain has me confused. I though it was desirable for a good hashing algorithm to be slow to make brute force difficult.

Yeah SHA3 isn't directly for password hashing. You should use a memory strong PBKDF (password based key derivation function) like Argon2, bcrypt, or scrypt. These functions are all constructions that run the hash many times, so the underlying hash speed is irrelevant

For high entropy inputs, like for a HMAC signature, you want the hash to be fast because its practically impossible to brute force the 256bit input key, and you often apply this to large inputs.

Re: Mathematician warns US spies may be weakening next-gen encryption

#209

Post by d-z-m »

marcosdumay wrote: post #179
d-z-m wrote: post #59

Ironically, the style and substance of DJB's engagement with his peers and with NIST is likely to sour both against his claims[0], credible though they(might) be. DJB's impression of NIST "stonewalling" could very well be their reluctance in engaging with an adversarial and increasingly deranged private citizen. > We disagree with his analysis,” says Dustin Moody at NIST. “It’s a question for which there isn’t scient…

> It’s a question for which there isn’t scientific certainty and intelligent people can have different views. WTF is that? No, it's not a question where intelligent people can have different views. DJB is literally claiming the NSA is claiming something similar to "3 + 3 = 9". That claim is either correct or not. There's a paywall in front of the article that I have no intention to deal with after seeing what's on th…

> DJB is literally claiming the NSA is claiming something similar to "3 + 3 = 9".

Nit: DJB is claiming that NIST is doing that, not NSA.

> There's a paywall in front of the article

turning javascript off gets around the paywall.

Re: Mathematician warns US spies may be weakening next-gen encryption

#210

Post by myrion »

nmadden wrote: post #188
myrion wrote: post #100

Earlier quoted context omitted.

The last part I agree with - clearly KYBER isn't trivially broken if this is the best he can come up with. What doesn't seem clear to me, and I'd appreciate if you could tell me why you think differently, is that KYBER-512 isn't as strong as it was targeted to be. I find djb's argument on this narrow point fairly convincing: KYBER-512 isn't as secure as AES-128 (by the methods used to measure "secure" in this competi…

It’s possible that in the specific sense that NIST defined, KYBER-512 isn’t as strong as AES-128. However, that doesn’t mean that it’s less secure in general. E.g. DJB himself wrote a good article[1] on how even though 128-bit AES and 256-bit elliptic curve crypto are thought of as same “security level”, actually there are attacks against AES that just don’t apply to ECC when you consider multi-target security models…

First off, thanks for the reply. It has since been pointed out to me elsewhere that there are now responses showing his central claim of a maths error to be false, which means all of this is now moot - KYBER is as secure as claimed.

It has also been pointed out to me that djb has been quietly ignoring another metric in which KYBER beats NTRU: implementation complexity.

Even accepting all other arguments about the tradeoffs between NTRU and KYBER (and I do take your point about size of keys being more important than CPU cycles), even then, KYBER is judged to have lower implementation complexity.

Having read about all the crypto libraries who produced broken output because they made a mistake in the implementation, that's something I immediately understand as a big benefit.

Again, thanks for the conversation and helping me understand!

Post reply on HN