Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Debunking NIST's calculation of the Kyber-512 security level

blog.cr.yp.to

Post reply on HN
Print view View original

101–110 of 219 posts

Re: Debunking NIST's calculation of the Kyber-512 security level

#101

Post by Ar-Curunir »

nvy wrote: post #91
tux3 wrote: post #45

Earlier quoted context omitted.

Teams of cryptographers submit several proposals (and break each other's proposals). These people are well respected, largely independent, and assumed honest. Some of the mailing lists provided by NIST where cryptographers collaborated to review each other's work are public NIST may or may not consort with your friendly local neighborhood NSA people, who are bright and talented contributors in their own right. That's…

I was under the impression that only fools trust NIST after DUAL_EC_whatsit. Is that not the case?

Things have changed quite a bit since then.

Re: Debunking NIST's calculation of the Kyber-512 security level

#102

Post by Ar-Curunir »

f33d5173 wrote: post #66
tptacek wrote: post #64

Earlier quoted context omitted.

It's very unlikely the seeds were random, and they weren't even ostensibly generated from a PRNG, as I understand it. Rather, they were passed through SHA1 (remember: this is the 1990s), as a means to destroy any possible structure in the original seed. The actual seeds themselves aren't my story to tell, but are a story that other people are talking about. For my part, I'll just point again to Koblitz and Menenzes o…

A hash function is a (CS)PRNG. It has the key property, namely of being indistinguishable from randomness while being generated deterministically.

That is not true. There is no such requirement for a hash function.

Re: Debunking NIST's calculation of the Kyber-512 security level

#103

Post by zdw »

fefe23 wrote: post #15

If you have never heard of Bernstein, this may look like mad ramblings of a proto-Unabomber railing against THE MAN trying to oppress us. However, this man is one of the foremost cryptographers in the world, he has basically single-handedly killed US government crypto export restrictions back in the days, and (not least of all because of Snowden) we know that the NSA really is trying to sabotage cryptography. Also, h…

This also skips his pioneering work into microservice architecture, as exemplified by the structure of qmail, djbdns, and daemontools.

Re: Debunking NIST's calculation of the Kyber-512 security level

#104

Post by Ar-Curunir »

ziddoap wrote: post #34
jcranmer wrote: post #19

Notwithstanding DJB's importance to cryptography, and the fact that I'm ignorant of a large number of details here, there was a point where he lost a lot of credibility with me. Specifically, when he gets to the graphs, he says "NIST chose to deemphasize the bandwidth graph by using thinner red bars for it." That is just not proven by his evidence, and there is a very plausible explanation for it. The graph that has…

> At this point, it feels quite strongly to me that he is trying to interpret every action in the most malicious way possible. Given the long and detailed history of various governments and government agencies purposefully attempting to limit the public from accessing strong cryptography, I tend to agree with the "assume malice by default" approach here. Assuming anything else, to me at least, seems pretty naive.

DJB has lost a ton of credibility already within the non-government cryptography community for his frankly unhinged rants on the PQC mailing list.

If you read his posts there, it’s hard not to come away with the impression that he’s just upset his favourite scheme wasn’t chosen.

Re: Debunking NIST's calculation of the Kyber-512 security level

#105

Post by Ar-Curunir »

fefe23 wrote: post #15

If you have never heard of Bernstein, this may look like mad ramblings of a proto-Unabomber railing against THE MAN trying to oppress us. However, this man is one of the foremost cryptographers in the world, he has basically single-handedly killed US government crypto export restrictions back in the days, and (not least of all because of Snowden) we know that the NSA really is trying to sabotage cryptography. Also, h…

Bernstein did not “found” the field of PQC. He wasn’t even doing cryptography when this field was founded!

Also, the schemes he’s railing against are also the work of top cryptographers in the space.

Re: Debunking NIST's calculation of the Kyber-512 security level

#106

Post by hn_throwaway_99 »

thadt wrote: post #67

The unfortunate reality of this is that while he may be right , it is difficult to classify the responses (or non-response) from the NIST people as deceptive vs just not wanting to engage with someone coming from such an adversarial position. NIST is staffed by normal people who probably view aggressively worded requests for clarification in the same way that most of us have probably fielded aggressively worded bug r…

Edit: Just realized the author is djb, Daniel Bernstein, which I guess is semi-ironic for me because I was recently praising him on HN for an old, well-read blog post on ipv6. Thus, I guess I may take back a bit of what I said below, or least perhaps it would be better to say that I can better understand the adversarial tone given djb's history with NIST recommendations (more info at https://en.wikipedia.org/wiki/Daniel_J._Bernstein#Cryptograp...).

> The unfortunate reality of this is that while he may be right, it is difficult to classify the responses (or non-response) from the NIST people as deceptive vs just not wanting to engage with someone coming from such an adversarial position.

Couldn't agree with this more. I don't like to harp on form over substance, but in this case the form of this blog post was so bad I had difficulty evaluating whether the substance was worthwhile. I'm not in the field of cryptography, so I'm not qualified to assess on the merits, but my thoughts reading this were:

1. All the unnecessary snark and disparagement made me extremely wary of the message. It seemed like he was making good points, but the overall tone was similar to those YouTube "WhaT ThE ElITe DoN'T WanT YoU TO KnoW!!" videos. Frankly, the author just sounds like kind of an asshole, even if he is right.

2. Did anyone actually read this whole thing?? I know people love to harp on "the Internet has killed our attention spans", and that may be true, but the flip side is we're bombarded with so much info now that I take a very judicious approach to where I'll spend my time. On that point, if you're writing a blog post, the relevant details and "executive summary" if you will should be in the first couple paragraphs, then put the meandering, wandering diary after. Don't expect a full read if important tidbits are hidden like Where's Waldo in your meandering diary.

Re: Debunking NIST's calculation of the Kyber-512 security level

#107

Post by pclmulqdq »

kpdemetriou wrote: post #97
lucb1e wrote: post #89

Earlier quoted context omitted.

> Historically only the winners are adopted. Look at the AES competition Often, yes. But also consider the SHA-3 competition. BLAKE2 seems more widely used than what was chosen for SHA-3 (Keccak). What was submitted for the SHA-3 competition was BLAKE1 (it didn't have a number back then but I think this is clearer) so it's not like NIST said that Keccak is better than BLAKE2, they only said it's better than BLAKE1 (p…

Re: BLAKE2, I'm not sure it's fair to say that BLAKE2 is more widely used overall. But I do agree BLAKE2 is a bit of an outlier in terms of adoption. I think part of the reason is that SHA2 remains the go-to option, else I'd expect the ecosystem to consolidate around SHA3. Re: Serpent, there are many things to unpack here but, in summary, you don't know a priori how large of a security margin you need (given the prim…

Blake2 also uses a very SHA2-like construction (a HAIFA construction, which is based on Merkle-Damgard). I believe this was the main reason SHA3 was chosen to be something completely different (a sponge construction). If SHA2 was found to be insecure, Blake2 would be at more risk of also being broken than Keccak.

Speculatively, if SHA2 is broken without breaking Merkle-Damgard hashes in general, Blake2/3 could well become SHA4.

Re: Debunking NIST's calculation of the Kyber-512 security level

#108

Post by ethbr1 »

nvy wrote: post #91
tux3 wrote: post #45

Earlier quoted context omitted.

Teams of cryptographers submit several proposals (and break each other's proposals). These people are well respected, largely independent, and assumed honest. Some of the mailing lists provided by NIST where cryptographers collaborated to review each other's work are public NIST may or may not consort with your friendly local neighborhood NSA people, who are bright and talented contributors in their own right. That's…

I was under the impression that only fools trust NIST after DUAL_EC_whatsit. Is that not the case?

You mean ANSI/ISO/NIST and Dual_EC_DRBG, that everyone suspected had a backdoor before it was included as one of multiple options? https://en.m.wikipedia.org/wiki/Dual_EC_DRBG#Timeline_of_Dua...

Or the s-boxes in DES, that the NSA suggested to IBM + NIST's predecessor, so as to be resistant to then-not-widely-known differential cryptanalysis? https://web.archive.org/web/20120106042939/http://securespee...

Re: Debunking NIST's calculation of the Kyber-512 security level

#109

Post by adastra22 »

lucb1e wrote: post #89
kpdemetriou wrote: post #75

Earlier quoted context omitted.

Absolutely, but NIST ultimately choose the winners, giving them the option to pick (non-obviously) weak/weaker algorithms. Historically only the winners are adopted. Look at the AES competition - how often do you see Serpent being mentioned, despite it having a larger security margin than Rijndael by most accounts?

> Historically only the winners are adopted. Look at the AES competition Often, yes. But also consider the SHA-3 competition. BLAKE2 seems more widely used than what was chosen for SHA-3 (Keccak). What was submitted for the SHA-3 competition was BLAKE1 (it didn't have a number back then but I think this is clearer) so it's not like NIST said that Keccak is better than BLAKE2, they only said it's better than BLAKE1 (p…

SHA-3 is vastly more widely used than BLAKE.

Re: Debunking NIST's calculation of the Kyber-512 security level

#110

Post by aleph_minus_one »

Exoristos wrote: post #73
codeflo wrote: post #16

That's more of a diary than an article -- jargony, disorganized, running in circles, very hard to follow. But the information might be important regardless. There's a strong implication that NIST with help of the NSA intentionally standardized on a weak algorithm. We all know that's possible. But can someone who follows some of this stuff more closely explain what the play would be? I always assumed that weakening pu…

You're making an assumption that the NSA cares about the efficacy of cryptography for other people. Why would they care about that?

> You're making an assumption that the NSA cares about the efficacy of cryptography for other people. Why would they care about that?

Hypothesis 1: because the NSA sees evidence that more efficient cryptographic algorithms are easier to crack for them.

To give some weak evidence for this: if you need brute force to crack the cipher (or hash function), a more efficient algorithm need less computation power to crack.

Hypothesis 2: A more efficient algorithm is likely to become applied in more areas than a less efficient one (think of smartcards or microcontrollers). So if the NSA finds a weakness or is capable of introducing a backdoor in it, it can decrypt a lot more data from more areas.

Post reply on HN