11–20 of 126 posts
[flagged]
Also - should we not be switching over to these algorithms starting like... now? Am I wrong that anyone collecting https traffic now will be able to break it in the future?
[flagged]
I recommend this video by Computerphile - He talks about how NIST may have been pressured into enforcing compromised (backdoored?) cryptography methods as a standard - Dual_EC_DRBG to be exact. He also gives a super cool/intuitive breakdown on how this came to be. It will definitely grow some food for thought. https://www.youtube.com/watch?v=nybVFJVXbww
[flagged]
I recommend this video by Computerphile - He talks about how NIST may have been pressured into enforcing compromised (backdoored?) cryptography methods as a standard - Dual_EC_DRBG to be exact. He also gives a super cool/intuitive breakdown on how this came to be. It will definitely grow some food for thought. https://www.youtube.com/watch?v=nybVFJVXbww
> In September 2013, both The Guardian and The New York Times reported that NIST allowed the National Security Agency (NSA) to insert a cryptographically secure pseudorandom number generator called Dual EC DRBG into NIST standard SP 800-90 that had a kleptographic backdoor that the NSA can use to covertly predict the future outputs of this pseudorandom number generator. [...] the NSA worked covertly to get its own version of SP 800-90 approved for worldwide use in 2006. The whistle-blowing document states that "eventually, NSA became the sole editor".
https://en.wikipedia.org/wiki/National_Institute_of_Standard...
Earlier quoted context omitted.
Not to defend the practice, but the layoffs have been for employees with 0-3 years in role, which probably does not include the people selecting post-quantum encryption algorithms.
Perhaps, but what surprised the DOGE folks is that “in role” included some people who were recently promoted or had changed teams.. so many of the laid off employees were actually long-time employees with a ton of institutional knowledge. Perhaps they would have learned as much if they had done literally any due diligence to understand the departments they were tasked with organizing, but I guess we’ll never know.
it's only the next natural step
[flagged]
can we not turn every thread into a politics one? i doubt the Trump admin has strongly vested interest in which post-quantum scheme is selected e: and yes, i am aware of the history around nist and crypto
That's not the argument being made, you're using that as a strawman to distract from the actual position, which is that indiscriminate layoffs (which is what DOGE is doing) reduce institutional competence and increase the likelihood that whatever scheme is selected is not fit for purpose. Address that argument, not the one you've invented in your head.
[flagged]
Earlier quoted context omitted.
can we not turn every thread into a politics one? i doubt the Trump admin has strongly vested interest in which post-quantum scheme is selected e: and yes, i am aware of the history around nist and crypto
> i doubt the Trump admin has strongly vested interest in which post-quantum scheme is selected That's not the argument being made, you're using that as a strawman to distract from the actual position, which is that indiscriminate layoffs (which is what DOGE is doing) reduce institutional competence and increase the likelihood that whatever scheme is selected is not fit for purpose. Address that argument, not the one…
> reduce institutional competence and increase the likelihood
most replies interpreted it the same way I did, likely due to the reference to 'loyalties' & 'trust'.
[0]: https://news.ycombinator.com/item?id=43333834 [1]: https://news.ycombinator.com/item?id=43333698 [2]: https://news.ycombinator.com/item?id=43333643
Give how quickly quantum is potentially coming, I wonder if we should/could find some way of using multiple quantum-resistant algorithms simultaneously as a default, in case a fault is found after the limited time we have to verify that there are no faults. Also - should we not be switching over to these algorithms starting like... now? Am I wrong that anyone collecting https traffic now will be able to break it in t…