NSA, NIST, and post-quantum crypto: my second lawsuit against the US government • Hacker News Board

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#491

Post by blueprint » Wed, Aug 10, 2022, 3:12 PM UTC

tptacek wrote: post #480

blueprint wrote: post #479

Earlier quoted context omitted.

Uh, would you take your simple argument and give me even a single sentence pointing out proof or clear indication it's horseshit. So far I only saw you arguing over words mostly

I'm comfortable that, in the zillion words I've self-indulgently written on this thread, I've established both my bona fides and where I'm coming from with respect to the issues at play here, so in the interests of not repeating myself, I'm not going to repeat myself.

You mean you're not going to engage in argument of substance because you're just that much of an expert. Oh. I'm not dubious at all.

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#492

Post by CRConrad » Thu, Aug 11, 2022, 7:30 AM UTC

tptacek wrote: post #428

thalassophobia wrote: post #426

Earlier quoted context omitted.

I think the fact that NIST refuses yo give any information on that is enough evidence in of itself.

The town I live in just outside of Chicago refused to disclose their police General Orders to me; I had to engage the same attorneys Bernstein did to get them. What can I infer from their refusal? That the General Orders include their instructions from the Lizard People overlords?

> The town I live in just outside of Chicago refused to disclose their police General Orders to me; I had to engage the same attorneys Bernstein did to get them. What can I infer from their refusal? That the General Orders include their instructions from the Lizard People overlords?

Naah, probably just that they include some pretty shitty stuff in general.

The fact (AFAWK) that the town came up with this shitty stuff even without any Lizard People Overlords having ordered them to do so of course makes it even worse for the powers that be of the town; now they can't even put the blame for the shitty stuff on the LPO.

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#493

Post by effie » Mon, Aug 15, 2022, 11:27 PM UTC

oittaa wrote: post #478

effie wrote: post #385

Earlier quoted context omitted.

Troy Hunt points out that HTTP traffic is sometimes MITMed in a way that clients and servers do not like, and HTTPS sometimes prevents that. I never said otherwise. I am saying for certain kinds of pages, it's not a major concern. Like for djb website. Why not use HTTPS for everything? Because it also has costs, not just benefits.

> Because it also has costs, not just benefits. That's not really true. Certificates have been free for a long time and every CPU made within the last 10 years has AES acceleration. You can google white papers from companies like Cloudflare and Google, which actually show speedups with HTTP 2 or 3.

There are other costs, with deployment and maintenance. Well built HTTP site works on its own until browsers intentionally stop accepting it. HTTPS site works for few months and then a new certificate needs to be obtained and deployed. This has real cost in additional risk of outages, support requests, and not the least, becoming dependent on the goodwill of the certificate issuer.

Re: NSA, NIST, and post-quantum crypto: my second lawsuit against the US government

#494

Post by InitialBP » Thu, Aug 18, 2022, 3:10 PM UTC

tptacek wrote: post #278

zaik wrote: post #275

Earlier quoted context omitted.

Standards are also essential for the interoperability of systems.

Formal standards aren't essential for interoperability.

Maybe not "essential" but I'm willing to guess that a huge percentage of the modern web communicates over HTTP or HTTPS.

"Essential" is interesting because you could definitely argue that HTTP isn't essential, but I don't think there is any feasible way of denying that the formalization and acceptance of early internet protocols (UDP, TCP, HTTP, FTP, etc) have played a significant role in shaping our modern technology world.

In a similar way, having reasonable standards makes it easier for everyone that isn't an expert in a particular field to just use something that is likely to work reasonably well while they worry about some other special part of their idea.