Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

blog.cr.yp.to

Post reply on HN
Print view View original

321–330 of 494 posts

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#321

Post by efitz »

voz_ wrote: post #317
efitz wrote: post #310

Why don’t we invert FOIA? Why don’t we require that all internal communications and records be public, available within 24 hours on the web, and provide a very painful mechanism involving significant personal effort of high level employees for every single communication or document that is to be redacted in some way? The key is requiring manual, personal (non-delegatable) effort on the part of senior bureaucrats, and…

Quoted post unavailable.

We should rethink the concept of a “secret”. If it’s really a secret, it will still be worth the effort to protect.

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#322

Post by zingplex »

2OEH8eoCRo0 wrote: post #191
morpheuskafka wrote: post #163

Earlier quoted context omitted.

I'm working on a project that involves a customized version of some unclassified, non-intelligence software for a defense customer at my job (not my ideal choice of market, but it wasn't weapons so okay with it). Some of the people on the project come from the deeper end of that industry, with several TS/SCI contract and IC jobs on their resumes. We were looking over some errors on the sshd log and it was saying it c…

While I am skeptical of US domestic surveillance, Snowden leaked this information in the worst possible way. Try internal whistleblower channels first. Not being heard? Mail to members of Congress? Contact congress? Contact the media? Instead he fled to an adversary with classified material. That's not good faith behavior imo. Traitor

Regarding trying internal channels, Snowden says he tried this

> despite the fact that I could not legally go to the official channels that direct NSA employees have available to them, I still made tremendous efforts to report these programs to co-workers, supervisors, and anyone with the proper clearance who would listen. The reactions of those I told about the scale of the constitutional violations ranged from deeply concerned to appalled, but no one was willing to risk their jobs, families, and possibly even freedom

The fleeing to a foreign adversary part would have been completely avoidable if the US had stronger whistleblower protections. It's perfectly reasonable to see what happened to Chelsey Manning and Julian Assange and not want to suffer a similar fate.

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#323

Post by chasil »

tptacek wrote: post #320
chasil wrote: post #316

Earlier quoted context omitted.

The main concern that I have is the NIST refusal to consider a hybrid design as described in the blog, coupled with the fact that OpenSSH has disregarded NIST and standardized on hybrid NTRU-Prime. There had to be substance to accomplish this, and it moves all of UNIX plus Microsoft away from crystals. It would seem hugely damaging to crystals as the winner of the latest round.

I don't think you understand what's going on here. The point of the PQC "contest" is to figure out which PQC constructions to use. It's not to design hybrid classical/PQC schemes: everybody already knows how to do that. The idea that NIST should have recommended CRYSTALS-Kyber+Curve25519 is a little like suggesting that they should have recommended Rijndael+DES-EDE. It's simply not NIST's job to tell tls-wg how to fi…

That would make it seem that the lengthy hybrid discussion in the blog is a misdirection.

I will grant you that this does support your argument.

EDIT: Actually, what you have said does not seem at all correct.

In DJB's Apon complaint, we find this text:

'For example, in email to pqc-forum dated 30 Oct 2019 15:38:10 +0000 (2019), NIST posted technical comments regarding hybrid encryption modes and asked for feedback “either here on the pqc-forum or by contacting us at pqc-comments@nist.gov” (emphasis added).'

If hybrid encryption is entirely beyond the purview of the NIST PQC competition, then why did this discussion and feedback request ever take place?

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#324

Post by [deleted] »

tptacek wrote: post #203
daneel_w wrote: post #174

Earlier quoted context omitted.

> "I may believe almost all of this is overblown and silly, as like a matter of cryptographic research ..." Am I misunderstanding you, or are you saying that you believe almost all of DJB's statements claiming that NIST/NSA is doctoring cryptography is overblown and silly? If that's the case, would you mind elaborating?

I believe the implication that NIST or NSA somehow bribed one of the PQC researchers to weaken a submission is risible. I believe that NIST is obligated to be responsive to FOIA requests, even if the motivation behind those requests is risible.

[deleted]

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#325

Post by Thorrez »

xt00 wrote: post #157
api wrote: post #44

Earlier quoted context omitted.

I don't think it's a bad thing to push back and demand transparency. At the very least the pressure helps keep NIST honest. Keep reminding them over and over and over again about dual-EC and they're less likely to try stupid stuff like that again.

Speaking of dual-EC -- it does seem like 2 questions seem to be often debated, but it can't be neglected that some of the vocal debaters may be NSA shills: 1. does the use of standards actually help people, or make it easier for the NSA to determine which encryption method was used? 2. are there encryption methods that actually do not suffer from reductions in randomness or entropy etc when just simply running the al…

>2. are there encryption methods that actually do not suffer from reductions in randomness or entropy etc when just simply running the algorithm on the encrypted output multiple times?

I think all block ciphers (e.g. AES) meet that definition. For AES, for a specific key, there's a 1-to-1 mapping of plaintexts to ciphertexts. It's impossible that running a plaintext through AES produces a ciphertext with less entropy, because if the ciphertext had less entropy, it would be impossible to decrypt to get back the plaintext, but AES always allows decryption.

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#326

Post by vasco »

voz_ wrote: post #317
efitz wrote: post #310

Why don’t we invert FOIA? Why don’t we require that all internal communications and records be public, available within 24 hours on the web, and provide a very painful mechanism involving significant personal effort of high level employees for every single communication or document that is to be redacted in some way? The key is requiring manual, personal (non-delegatable) effort on the part of senior bureaucrats, and…

Quoted post unavailable.

Do you think it's tough for those regimes to pay someone to do FOIA requests for them? Or to get jobs at government agencies?

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#327

Post by politelemon »

lostcolony wrote: post #37
politelemon wrote: post #27

So, question then, isn't one of the differences between this time's selection, compared to previous selections, that some of the algorithms are open source with their code available. For example, Kyber, one of the finalists, is here: https://github.com/pq-crystals/kyber And where it's not open source, I believe in the first round submissions, everyone included reference implementations. Does the code being available…

Not really. For the same reason that "here's your github login" doesn't equate to you suddenly being able to be effective in a new company. You might be able to look things up in the code and understand how things are being done, but you don't know -why- things are being done that way. A lot of the instances in the post even show the NSA giving a why. It's not a particular convincing why, but it was enough to sow dou…

Thanks for the response, that's making sense. I've also tried following the PQC Google Groups but a lot of the language is beyond my grasp.

Also... I don't understand why I've been downvoted for asking a question, I'm trying to learn but HN can certainly be unwelcoming to the 'curious' (which is why I thought we are here)

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#328

Post by politelemon »

aaaaaaaaaaab wrote: post #50
politelemon wrote: post #27

So, question then, isn't one of the differences between this time's selection, compared to previous selections, that some of the algorithms are open source with their code available. For example, Kyber, one of the finalists, is here: https://github.com/pq-crystals/kyber And where it's not open source, I believe in the first round submissions, everyone included reference implementations. Does the code being available…

What? :D Who cares about a particular piece of source code? Cryptanalysis is about the mathematical structure of the ciphers. When we say the NSA backdoored an algorithm, we don't mean that they included hidden printf statements in "the source code". It means that mathematicians at the NSA have knowledge of weaknesses in the construction, that are not known publicly.

Well, that was why I asked the question. I didn't think asking a question deserved downvotes and ridicule.

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#329

Post by vasco »

tptacek wrote: post #307
_notreallyme_ wrote: post #302

Earlier quoted context omitted.

The actual claim is that NSA may have already spent a lot of time and effort to analyse PQC algorithm underlying problems without making their findings public. DJB seems to suspect that they may influence NIST to select algorithms and parameters within the range of what they already know how to break.

Huh? Of course NSA spent a lot of time and effort analyzing algorithms without making their findings public. That is their literal job. The peer review NIST is refereeing happened in the open. When people broke SIDH, they didn't whisper it anyone's ear: they published a paper. That's how this stuff works. Bernstein doesn't have a paper to show you; all he has is innuendo. How you know his argument is as limp as a coo…

> he actually stoops to suggesting that NSA might have bribed one of the members of the PQC teams

I don't know anyone in the teams to judge their moral fiber, but I'm 100% sure the NSA is not above what is suggested and your weird outrage at the suggestion seems surprising knowing what is public knowledge about how the NSA operates.

There are arguments here about NSA pressure on NIST. You miss the point because apparently you're offended that someone suggested your friends can be bribed. I mean, maybe they can't, but this is about the NSA being corrupt, not the researchers.

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#330

Post by acover »

efitz wrote: post #321
voz_ wrote: post #317

Earlier quoted context omitted.

Quoted post unavailable.

We should rethink the concept of a “secret”. If it’s really a secret, it will still be worth the effort to protect.

They are erroring on the side of caution because people have determined secret information from public information - like the energy in a nuclear bomb (censored) by the blast radius (public).

Another example is they want to protect their means and methods. But those means and methods are how they know most information. Often times it's easy to work backwards from they know x therefore y is compromised.

It's a hard problem similar to how to release anonymized data. See K-anonymity attacks and caveats.

https://en.wikipedia.org/wiki/K-anonymity

Post reply on HN