Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA and IETF: Can an attacker purchase standardization of weakened cryptography?

blog.cr.yp.to

Post reply on HN
Print view View original

111–119 of 119 posts

Re: NSA and IETF: Can an attacker purchase standardization of weakened cryptography?

#111

Post by philodeon »

tptacek wrote: post #110
philodeon wrote: post #108

Earlier quoted context omitted.

You seem blind to the obvious corollary to that fact, which is if cryptosystems based on ring-LWE hardness have been worked on by giants for 30 years, then those same cryptosystems have been cryptanalyzed for 30 years, and a significant chunk of cryptanalytic research stays in NSA’s Classified Mathematics Library. You’ve admitted you were “loudly wrong” when you announced Dual-EC couldn’t be an NSA cryptography backd…

See, this is what I mean; this is the kind of logic Bernstein knows he's engaging with when he writes these things.

When someone discovers the trick necessary to decrypt ML-KEM in an hour and publishes it in the unclassified sphere, I assume your response will be “hey, I may have been wrong yet again, but at least I wasn’t impudent!”

Re: NSA and IETF: Can an attacker purchase standardization of weakened cryptography?

#112

Post by tptacek »

philodeon wrote: post #111
tptacek wrote: post #110

Earlier quoted context omitted.

See, this is what I mean; this is the kind of logic Bernstein knows he's engaging with when he writes these things.

When someone discovers the trick necessary to decrypt ML-KEM in an hour and publishes it in the unclassified sphere, I assume your response will be “hey, I may have been wrong yet again, but at least I wasn’t impudent!”

Again, to my point: you think the subtext of this post is that someone is going to break module-LWE with a Python script, because, I guess, to you these (module-LWE and supersingular isogenies) are equivalently exotic cryptography primitives. It bothers me that the author of this post is banking on you not understanding the difference here.

You saw a similar thing in Bernstein's earlier railing against the NIST contest (which he participated in), happily whipping up a crowd of people who believed Tancrede Lepoint or Chris Peikert or Peter Schwabe might have been corrupted by NSA, because nobody in that crowd have any idea who those three researchers are.

It's really gross.

Re: NSA and IETF: Can an attacker purchase standardization of weakened cryptography?

#113

Post by philodeon »

tptacek wrote: post #112
philodeon wrote: post #111

Earlier quoted context omitted.

When someone discovers the trick necessary to decrypt ML-KEM in an hour and publishes it in the unclassified sphere, I assume your response will be “hey, I may have been wrong yet again, but at least I wasn’t impudent!”

Again, to my point: you think the subtext of this post is that someone is going to break module-LWE with a Python script, because, I guess, to you these (module-LWE and supersingular isogenies) are equivalently exotic cryptography primitives. It bothers me that the author of this post is banking on you not understanding the difference here. You saw a similar thing in Bernstein's earlier railing against the NIST conte…

“Module-LWE is not breakable within a Python script” —-Ptacek, 2025

“Apache chunked encoding is not exploitable” —- Dowd, 2002

Re: NSA and IETF: Can an attacker purchase standardization of weakened cryptography?

#114

Post by tptacek »

philodeon wrote: post #113
tptacek wrote: post #112

Earlier quoted context omitted.

Again, to my point: you think the subtext of this post is that someone is going to break module-LWE with a Python script, because, I guess, to you these (module-LWE and supersingular isogenies) are equivalently exotic cryptography primitives. It bothers me that the author of this post is banking on you not understanding the difference here. You saw a similar thing in Bernstein's earlier railing against the NIST conte…

“Module-LWE is not breakable within a Python script” —-Ptacek, 2025 “Apache chunked encoding is not exploitable” —- Dowd, 2002

I mean, if you're putting me in the same camp as Mark Dowd, I'm flattered.

What I think you're not seeing is that this isn't a SIKE vs. Lattice kind of debate; it's a Curve25519 vs. P-256 kind of debate. P-256 was never broken. Curve25519 made smart engineering decisions that for years foreclosed on some things that were common in-the-real-world implementation pitfalls. P-256 has closed that gap now, but for the whole run of the experience they were both sane choices.

That's a generous interpretation. Another parallel would be Rijndael vs. Serpent, where the Serpent advocates were all "I don't know about this Rijndael stuff seems dicy". Turned out: Rijndael was great.

But Bernstein wants you think that rather than a curve-selection type debate, this is more akin to a "discrete log vs. knapsack" debate. It isn't.

Re: NSA and IETF: Can an attacker purchase standardization of weakened cryptography?

#115

Post by philodeon »

tptacek wrote: post #114
philodeon wrote: post #113

Earlier quoted context omitted.

“Module-LWE is not breakable within a Python script” —-Ptacek, 2025 “Apache chunked encoding is not exploitable” —- Dowd, 2002

I mean, if you're putting me in the same camp as Mark Dowd, I'm flattered. What I think you're not seeing is that this isn't a SIKE vs. Lattice kind of debate; it's a Curve25519 vs. P-256 kind of debate. P-256 was never broken. Curve25519 made smart engineering decisions that for years foreclosed on some things that were common in-the-real-world implementation pitfalls. P-256 has closed that gap now, but for the whol…

I thought the whole point of DJB’s “cache timing attacks in AES” is that Rijndael is not particularly great.

Re: NSA and IETF: Can an attacker purchase standardization of weakened cryptography?

#116

Post by pluto_modadic »

bgwalter wrote: post #80

The chilling part is that a guy named Wouters threatens to ban Bernstein in a characteristically rude CoC message: https://mailarchive.ietf.org/arch/msg/tls/RK1HQB7Y-WFBxQaAve... Trust the process!

I think... that's because.. DJB was... (gasp) disobeying the code of conduct. and has been, for a long, long, loooong time.

Re: NSA and IETF: Can an attacker purchase standardization of weakened cryptography?

#117

Post by 1vuio0pswjnm7 »

We need something better than TLS, a non-standard

Maybe an stunnel for CurveCP, or something like PQConnect

History has shown djb is usually right

He has been far more productive at writing software and developing cryptography that has avoided security vulnerabilities than any of the IETF WG members. The best part about his software IMHO is that it is small with low resource requirements and can primarily serve ordinary individual computer users, as opposed to large, complex, steep learning curve software primarily serving corporations like the ones that publish RFCs and send people to IETF meetings

Anyone reading this comment is probably using djb's cryptography in TLS. His contributions to today's internet are substantial

It really says a lot about "IETF" and other Silicon Valley pseudo-governance that a talented and trustworthy author, who has remained an academic when so many have sold out, gets treated like a nuisance

Re: NSA and IETF: Can an attacker purchase standardization of weakened cryptography?

#118

Post by thomasdeleeuw »

tux3 wrote: post #49
mjg59 wrote: post #42

Earlier quoted context omitted.

Why don't we hybridise all crypto? We'd get more security if we required RSA+ECDSA+ED25519 at all times, right? Or is the answer that the benefits are small compared to the drawbacks? I am unqualified to provide an answer, but I suspect you are also, and the answer we have from a whole bunch of people who are qualified is that they think the benefits aren't worth it. So why is it fundamentally and obviously true for…

>So why is it fundamentally and obviously true for PQC? This isn't actually an engineering hill I'd die on, if more people I trust made clear arguments for why this is dangerous I'd take it very seriously, but right now we basically have djb against the entire world writing a blogpost that makes ludicrous insinuations and fails to actually engage with any of the counterarguments, and look just no. As a response to th…

If anyone is curious about DSI's and ANSSI's positions referred to in this comment:

The german position:

https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publicat...

"The quantum-safe mechanisms recommended in this Technical Guideline are generally not yet trusted to the same extent as the established classical mechanisms, since they have not been as well studied with regard to side-channel resistance and implementation security. To ensure the long-term security of a key agreement, this Technical Guideline therefore recommends the use of a hybrid key agreement mechanism that combines a quantum-safe and a classical mechanism."

The french position, also quoting the German position:

https://cyber.gouv.fr/sites/default/files/document/follow_up...

"As outlined in the previous position paper [1], ANSSI still strongly emphasizes the necessity of hybridation1 wherever post-quantum mitigation is needed both in the short and medium term. Indeed, even if the post-quantum algorithms have gained a lot of attention, they are still not mature enough to solely ensure the security"

Re: NSA and IETF: Can an attacker purchase standardization of weakened cryptography?

#119

Post by kevvok »

londons_explore wrote: post #99
philsnow wrote: post #72

Earlier quoted context omitted.

They also historically have extremely deep access to networks, and even if a given corp doesn't allow them to put a box inside the corp's own network, they control / have access to many or all of the links between most corps' datacenters. From this privileged network position, if both sides support weaker crypto that NSA lobbied for, they can MitM the initial connection and omit the hybrid methods from the client's T…

Pretty sure this isn't possible?? There must be some way to use a hash of the clientHello later in the key exchange process to make sure the connection fails if the hello is tampered with...?

Yeah, the ClientHello message(s) are already part of the transcript signed by the server (and the client in mTLS) during the handshake
Post reply on HN