Live data from Hacker News

Debunking NIST's calculation of the Kyber-512 security level (2023)

blog.cr.yp.to

11–20 of 22 posts

Re: Debunking NIST's calculation of the Kyber-512 security level (2023)

#11
I can see they say many problems with what NIST is doing. One question is: Does someone bribe (or otherwise coerce) them? If so, is that why they are being deceptive, and why they would not respond to (or explain) some things?

If a system has parameters, another issue is whether or not a different implementation is required due to the parameters being different. There are some reasons why a separate implementation might be desirable anyways in some cases, but sometimes it would be possible to change the parameters at run time.

Another consideration is patents; they should not recommend patented or secret algorithms. Cryptanalysis will be difficult if the specification is not freely available to anyone who wants to read it, and implementation can be a problem if patent licensing is required. Wikipedia says that NTRU is patented but "Security Innovation exempted open-source projects from having to get a patent license"; that might be good enough.

Wikipedia also says that Kyber is a key encapsulation mechanism but NTRU is a public key cryptosystem, so they would not be the same kind of things, anyways. However, you could also use a public key cryptosystem like a key encapsulation mechanism if you have another method of making up a key securely at random. But, Wikipedia says "it is easier to design and analyze a secure KEM than to design a secure public-key encryption scheme as a basis" (I do not know the details of the quoted part to judge this, but the unquoted part seems obvious to me).

Another alternative might be using multiple algorithms with independent keys (to be secure, the keys will have to be independent; however, you might have to be careful that they really will be independent), e.g. by using Kyber first and then encrypting the result with NTRU. But, that depends on what your requirements are.

As another comments (https://news.ycombinator.com/item?id=37756656) had mention, they may have different requirements than yours, such as hardware, so that is another issue.

None of that is an excuse for what NIST seems to be doing though (according to the article); they are additional concerns than those ones.

Re: Debunking NIST's calculation of the Kyber-512 security level (2023)

#12
post #10

Earlier quoted context omitted.

Not only messed up, but I am guessing that there are either politics involved (personal gain, friends of friends, etc), or somebody paid somebody to push Kyber over NTRU. Which is difficult or impossible to prove, ESPECIALLY if that "person" is senator or "other". (Since I failed civics, I have no idea what forces are involved in something like this, but it all sounds really fishy).

Historically the NSA has sabotaged public cryptography standards so that it could crack them, while adversaries hopefully couldn't. It pays its employees to do this. It seems plausible that that's what's going on here, but even if so, whether that's because they know of a fatal weakness in NTRU they fear adversaries will exploit, or know of one in Kyber that they hope to exploit themselves, is anybody's guess.

NSA makes public their own policy for national security systems.

https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA...

If the U.S. Government is willing to bet the SECRET-and-above farm on particular cryptography standards and implementations, it’s probably safe for you to use them too.

Re: Debunking NIST's calculation of the Kyber-512 security level (2023)

#13
post #9
post #4

This stood out to me: > For comparison, Bitcoin mining did only about 2^111 bit operations in 2022. ("Only"!) Anyone have a source for this? Google results suggest in 2022 Bitcoin miners reached ~209 quintillion hashes (209 exahashes) per second. I don't know how many bit operations SHA-1 takes, but dividing 2^111 by 209 * 10^18 * 86400 * 365 gives 393891, which doesn't sound unreasonable for number of bit operations…

This circuit [1] puts it at [1] https://nigelsmart.github.io/MPC-Circuits/sha256.txt

Bitcoin's proof of work uses SHA-256(SHA-256(x)). Combining that with your figures reduces the differences to well within minutia of how you count bit operations and exactly which tradeoff the circuits make.

Re: Debunking NIST's calculation of the Kyber-512 security level (2023)

#14
post #10

Earlier quoted context omitted.

Historically the NSA has sabotaged public cryptography standards so that it could crack them, while adversaries hopefully couldn't. It pays its employees to do this. It seems plausible that that's what's going on here, but even if so, whether that's because they know of a fatal weakness in NTRU they fear adversaries will exploit, or know of one in Kyber that they hope to exploit themselves, is anybody's guess.

NSA makes public their own policy for national security systems. https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA... If the U.S. Government is willing to bet the SECRET-and-above farm on particular cryptography standards and implementations, it’s probably safe for you to use them too.

If NSA and only NSA can crack a particular system, they probably wouldn't mind using it for their own secrets.

And anyway why is there any reason to believe they really do use the system they say they use?

Re: Debunking NIST's calculation of the Kyber-512 security level (2023)

#15

I can see they say many problems with what NIST is doing. One question is: Does someone bribe (or otherwise coerce) them? If so, is that why they are being deceptive, and why they would not respond to (or explain) some things? If a system has parameters, another issue is whether or not a different implementation is required due to the parameters being different. There are some reasons why a separate implementation mi…

NIST is basically NSA and CIA. I wouldn't trust them a single bit.

Re: Debunking NIST's calculation of the Kyber-512 security level (2023)

#16
post #10

Earlier quoted context omitted.

Historically the NSA has sabotaged public cryptography standards so that it could crack them, while adversaries hopefully couldn't. It pays its employees to do this. It seems plausible that that's what's going on here, but even if so, whether that's because they know of a fatal weakness in NTRU they fear adversaries will exploit, or know of one in Kyber that they hope to exploit themselves, is anybody's guess.

NSA makes public their own policy for national security systems. https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA... If the U.S. Government is willing to bet the SECRET-and-above farm on particular cryptography standards and implementations, it’s probably safe for you to use them too.

What they've been doing consistently for the last 50 years counts for more than what they say today.

Re: Debunking NIST's calculation of the Kyber-512 security level (2023)

#17
post #7
post #4

This stood out to me: > For comparison, Bitcoin mining did only about 2^111 bit operations in 2022. ("Only"!) Anyone have a source for this? Google results suggest in 2022 Bitcoin miners reached ~209 quintillion hashes (209 exahashes) per second. I don't know how many bit operations SHA-1 takes, but dividing 2^111 by 209 * 10^18 * 86400 * 365 gives 393891, which doesn't sound unreasonable for number of bit operations…

It's hard to know what to count as "global compute". How many bit operations do we count for the clock propagation across your CPU? Two for each clock cycle per buffer? Even though the bit operation is just identity, or do we omit that? Does it change if you use inverting buffers, since NOT is a nontrivial operation? Did you know that in CMOS a normal buffer is made out of two inverters? Can you do twice as many bit…

Presumably "global compute" in this context refers to activities of similar complexity carried out with digital electronic devices that produce a similarly useful output. Obviously bitcoin is some fraction of global compute; it's interesting to wonder what the (approximate) total might be.

Re: Debunking NIST's calculation of the Kyber-512 security level (2023)

#18
post #14

Earlier quoted context omitted.

NSA makes public their own policy for national security systems. https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA... If the U.S. Government is willing to bet the SECRET-and-above farm on particular cryptography standards and implementations, it’s probably safe for you to use them too.

If NSA and only NSA can crack a particular system, they probably wouldn't mind using it for their own secrets. And anyway why is there any reason to believe they really do use the system they say they use?

> If NSA and only NSA can crack a particular system, they probably wouldn't mind using it for their own secrets.

How do you think they could assess that they, and only they will ever be able to exploit a particular cryptographic vulnerability at any time over the next few decades?

They can’t, they would be well aware of that, and they are extremely risk averse.

> And anyway why is there any reason to believe they really do use the system they say they use?

Because these systems exist widely throughout government today.

https://www.nsa.gov/Resources/Commercial-Solutions-for-Class...

https://www.disa.mil/-/media/files/disa/fact-sheets/dmcc-s-f...

Re: Debunking NIST's calculation of the Kyber-512 security level (2023)

#19
post #16

Earlier quoted context omitted.

NSA makes public their own policy for national security systems. https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA... If the U.S. Government is willing to bet the SECRET-and-above farm on particular cryptography standards and implementations, it’s probably safe for you to use them too.

What they've been doing consistently for the last 50 years counts for more than what they say today.

They haven’t been using commercial cryptography to protect classified information for 50 years.

The fact they are now is a relatively recent development, and it’s significant because they now have their own skin in the game whereas they previously did not.

Re: Debunking NIST's calculation of the Kyber-512 security level (2023)

#20

That's pretty messed up, guess that's another sombering fact to the pile. I'd have expected that serious security stuff always involves mechanized math proofs every step of the way, making such silly mischaracterizations impossible. Not a fun thing to learn that this is not what happens.

This has been discussed before on HN when it was first published. I don’t remember the resolution years later, but it was discussed on the PQC mailing lists. The missing context here is that many people had submissions and academic rivalries can be very bitter.
Post reply on HN