41–50 of 126 posts
Earlier quoted context omitted.
the question/conclusion phrasing at the end is a suspicious red flag to me, quick click on their comment history is confirmation
The pattern of a top level comment on each post and no replies gives it away for me. Surprised to see a bot here.
Earlier quoted context omitted.
I trusted them to at least pick an encryption that only they could break...rather than one that other nation states may be able to crack as well.
If it's breakable by them, it's breakable by anyone. Full stop. It is not possible to create an encryption scheme only breakable by NIST (or NSA, or whatever 3-4 letter agency).
Earlier quoted context omitted.
I trusted them to at least pick an encryption that only they could break...rather than one that other nation states may be able to crack as well.
If it's breakable by them, it's breakable by anyone. Full stop. It is not possible to create an encryption scheme only breakable by NIST (or NSA, or whatever 3-4 letter agency).
https://en.wikipedia.org/wiki/Dual_EC_DRBG
It's not at all impossible to put a backdoor in a protocol which requires knowledge of a key in order to exploit. This isn't even the only example where this is thought to have occured.
Earlier quoted context omitted.
can we not turn every thread into a politics one? i doubt the Trump admin has strongly vested interest in which post-quantum scheme is selected e: and yes, i am aware of the history around nist and crypto
That's a good question, the answer is no. That's the thing about politics... they touch everything. There's a popular youtuber that I like, he's got a funny saying "You might not fuck with politics, but politics will fuck with you!" Fits well here. You might wanna ignore politics when talking about something that should be pure math, but now that we're talking about why crypto is going to be the standards that all co…
No. They don't. The level at which politics has actually intersected with my life in the past year is zero. I suspect the same is true for the majority of people in the US.
Your politics are mostly a fashion choice. You don't need to put them on display in literally ever conversation. You also cannot possibly change the world around you with this behavior so I can't understand why so many people feel the need to engage in it.
> Suddenly we now need to consider
The government is massive. You always need to consider this. Pretending that a choice of a single federal official is the difference maker here takes bizarre fashion choices into the completely absurd. The only thing you're doing is alienating half the audience with churlish behavior.
Earlier quoted context omitted.
I recommend this video by Computerphile - He talks about how NIST may have been pressured into enforcing compromised (backdoored?) cryptography methods as a standard - Dual_EC_DRBG to be exact. He also gives a super cool/intuitive breakdown on how this came to be. It will definitely grow some food for thought. https://www.youtube.com/watch?v=nybVFJVXbww
Dual EC was not the product of a contest. The NIST PQC algorithms are all designed by academic cryptographers, many of them not US nationals.
The NIST report that explains the decision: https://nvlpubs.nist.gov/nistpubs/ir/2025/NIST.IR.8545.pdf#p...
Earlier quoted context omitted.
If it's breakable by them, it's breakable by anyone. Full stop. It is not possible to create an encryption scheme only breakable by NIST (or NSA, or whatever 3-4 letter agency).
Have people forgotten about this already? https://en.wikipedia.org/wiki/Dual_EC_DRBG It's not at all impossible to put a backdoor in a protocol which requires knowledge of a key in order to exploit. This isn't even the only example where this is thought to have occured.
If you introduce a deliberate weakness to your encryption, the overall security is reduced to the security level of that weakness.
Relying on NOBUS ("nobody but us") is hubris (see shadow brokers, snowden, etc.).
[flagged]
Claiming loyalty is a litmus test for layoffs is a bit incendiary and a needless introduction of a strongly biased view of politics into the conversation. No doubt for leadership levels an active disinterest in helping enable open inquiry into the state of things would be fireable, but calling this a loyalty test is a strong spin. One that’s been normalized lately to be sure, but there’s no need to further it. I’d be…
It's more than a concern that the US government will select algorithms that their top spook agency can crack. One must assume it is the case.
What is your favorite post-quantum encryption approach? I think Lattice-based ones will eventually be broken by a quantum algorithm. I am fully on board with lamport signatures and SPHINCS+
For signing, I treat Dilithium (lattice-based) as "standard security" and SPHINCS+ (hash-based) as "high security". In particular, the former is used for end user public keys and certificates, while the latter is used for code signing where the larger public key and signature sizes are less of an issue.
In all cases, I wouldn't use PQC without combining it with classical crypto, in Cyph's case X25519/Ed25519. Otherwise you run the risk of a situation like SIDH/SIKE where future cryptanalysis of a particular PQC algorithm finds that it isn't even classically secure, and then you're hosed in the present.
Earlier quoted context omitted.
if it's any consolation, decisions like these (normally) have a very long lead time measured in years. now, these are not normal times, but even so I'd be more concerned about NIST decisions coming out nearer to the end of this administration rather than just now at the beginning.
More telling would be any reversals in the next couple of years