Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Debunking NIST's calculation of the Kyber-512 security level

blog.cr.yp.to

Post reply on HN
Print view View original

181–190 of 219 posts

Re: Debunking NIST's calculation of the Kyber-512 security level

#181

Post by denton-scratch »

hn_throwaway_99 wrote: post #106
thadt wrote: post #67

The unfortunate reality of this is that while he may be right , it is difficult to classify the responses (or non-response) from the NIST people as deceptive vs just not wanting to engage with someone coming from such an adversarial position. NIST is staffed by normal people who probably view aggressively worded requests for clarification in the same way that most of us have probably fielded aggressively worded bug r…

Edit: Just realized the author is djb, Daniel Bernstein, which I guess is semi-ironic for me because I was recently praising him on HN for an old, well-read blog post on ipv6. Thus, I guess I may take back a bit of what I said below, or least perhaps it would be better to say that I can better understand the adversarial tone given djb's history with NIST recommendations (more info at https://en.wikipedia.org/wiki/Dan…

> Did anyone actually read this whole thing?

Yup. I'm not a cryptographer, so I didn't understand most of the detail. I realized it ws DJB after a couple of paragraphs.

> the relevant details and "executive summary" if you will should be in the first couple paragraphs

It wasn't written for "executives".

Re: Debunking NIST's calculation of the Kyber-512 security level

#182

Post by denton-scratch »

aidenn0 wrote: post #157
viraptor wrote: post #124

Earlier quoted context omitted.

Even worse, I expected to find a part when he reports it and includes the responses/follow-up from that... But this is the first time it's published a far as I understand? Did I miss it in the wall of text? Or is it really a huge initial writeup that may end up with someone responding "oh, we did mess up, didn't we? Let's think how to deal with that."

It's in there. He first raised the issue in April 2022. Then in December 2022 he asked about the evaluation of Kyber's security and they posted this[1], which included a 2^40 multiple that he wasn't sure where it came from; if it came from where he thought it did (bogus math on numbers from a paper DJB himself coauthored), then that was troubling. There was no response, so a few weeks later he posted his assumptions…

> NIST's prior assertions and their interpretation are not relevant [...]

That seems to be an extraordinarily strong claim to make, without detailed explanation, which apparently wasn't provided.

Re: Debunking NIST's calculation of the Kyber-512 security level

#184

Post by denton-scratch »

ignoramous wrote: post #18
fefe23 wrote: post #15

If you have never heard of Bernstein, this may look like mad ramblings of a proto-Unabomber railing against THE MAN trying to oppress us. However, this man is one of the foremost cryptographers in the world, he has basically single-handedly killed US government crypto export restrictions back in the days, and (not least of all because of Snowden) we know that the NSA really is trying to sabotage cryptography. Also, h…

An interesting set of comments (by tptacek) from a thread in 2022 (I wonder if they still hold the same opinion in light of this latest post on NIST-PQC by djb): > The point isn't that NIST is trustworthy. The point is that the PQC finalist teams are comprised of academic cryptographers from around the world with unimpeachable reputations, and it's ludicrous to suggest that NSA could have compromised them. The whole…

> actually a product of the Lizard People

Nobody says that (not that I've seen).

My reading is that he's a combative academic, railing against a standards body that refuses to say how they're working, with a deserved reputation for dishonesty and shenanigans.

Re: Debunking NIST's calculation of the Kyber-512 security level

#185

Post by Ar-Curunir »

pigeonhole123 wrote: post #132
zahllos wrote: post #100

Earlier quoted context omitted.

No, true, the post did not explicitly state this. However the post did suggest that NIST is specifically out to get him and take a swipe at the other candidates: > Is NIST trying to derail his work by standardizing crappy algorithms with the help of the NSA? Who knows. But to me it does smell like that. "Crappy" algorithms that were designed by well-regarded cryptographers, none of whom work for NIST or the NSA, many…

Being incompetent is possible even if you’re not a US national.

And being incompetent is possible even if you’re DJB.

Re: Debunking NIST's calculation of the Kyber-512 security level

#186

Post by bamborde_zaiku »

EGreg wrote: post #163
lucb1e wrote: post #115

Earlier quoted context omitted.

> I'm not sure it's fair to say that BLAKE2 is more widely used overall Ah, maybe my experience is biased then. I keep coming across BLAKE2 implementations, but rarely hear so much as people considering to use SHA-3 somewhere. If anyone has actual numbers on this, that would be interesting. It would be good if SHA-3 is being used because then chip makers have a reason to bake it into their hardware, which is exactly…

I wish chip makers would bake the elliptic curve used in Bitcoin and Ethereum (secp256k) as well, instead of the entire industry coalescing around secp256r, which many suspect was somehow weaker (since its parameters are some weird large number X instead of a hard-to-game number like 15, leading some to believe that the first X-1 candidates were tried and X was found to be weaker). The real reason I would have liked…

[dead]

Re: Debunking NIST's calculation of the Kyber-512 security level

#187

Post by ignoramous »

greggsy wrote: post #162
barsonme wrote: post #131

Earlier quoted context omitted.

Who is Signal Sciences?

Actually, I meant Open Whisper, the company behind Signal. Got my wires crossed.

nit: Open Whisper Systems (who built WhisperCore, an encryption layer; WhisperMonitor, a firewall; TextSecure, a messenger; and RedPhone, a voice call service) exited to Twitter back in the day [1]. Signal is apparently marketed and developed by Signal Messenger LLC [2].

[0] https://archive.is/IRYTQ

[1] https://news.ycombinator.com/item?id=3286530

[2] https://archive.is/ZI7G1

Re: Debunking NIST's calculation of the Kyber-512 security level

#188

Post by Attrecomet »

Ar-Curunir wrote: post #101
nvy wrote: post #91

Earlier quoted context omitted.

I was under the impression that only fools trust NIST after DUAL_EC_whatsit. Is that not the case?

Things have changed quite a bit since then.

How so? Or rather, taking change for a given, what are believable indicators that a secret organization outside normal systems of law and publicity has changed _for the better_? After all, the Snowden relevations lead not to the NSA deciding that creating a global panopticon for a super-surveillance state would be a bad idea, but rather them doing their damnedest that never again the American public would be informed of the true scale of their dystopian actions.

Re: Debunking NIST's calculation of the Kyber-512 security level

#189

Post by jrochkind1 »

cosmojg wrote: post #13
jrochkind1 wrote: post #4

Earlier quoted context omitted.

The NSA also has a mission-based interest in _breaking_ other people's crypto though, which is generally known. Which is generally known, so I'm surprised by your argument. Even if the NSA knows more than they are telling us, this doesn't result in most of us feeling less worried, as their ends may not be strengthening the public's cryptography!

Isn't that what the person you're replying to said?

It's clear to me now that it is! Either I misread it, or maybe they edited it to make it more clear!

Re: Debunking NIST's calculation of the Kyber-512 security level

#190

Post by j16sdiz »

tptacek wrote: post #48
pclmulqdq wrote: post #43

Earlier quoted context omitted.

There is a final standardization step where NIST selects constants, and this is done without always consulting with the research team. Presumably, these are usually random, but the ones chosen for the Dual-EC DRBG algorithm seem to have been compromised. SHA-3 also had some suspicious constants/padding, but that wasn't shown to be vulnerable yet.

The problem with Dual EC isn't the sketchy "constants", but rather the structure of the construction, which is a random number generator that works by doing a public key transformation on its state. Imagine CTR-DRBG, but standardized with a constant AES key. You don't so much wonder about the provenance of the key so much as wonder why the fuck there's a key there at all. I don't know of any cryptographer or cryptogr…

> The problem with Dual EC isn't the sketchy "constants", but rather the structure of the construction

It's both.

It is bad enough even without the constants

https://blog.cryptographyengineering.com/2013/09/18/the-many...

Post reply on HN