Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Debunking NIST's calculation of the Kyber-512 security level

blog.cr.yp.to

Post reply on HN
Print view View original

91–100 of 219 posts

Re: Debunking NIST's calculation of the Kyber-512 security level

#91

Post by nvy »

tux3 wrote: post #45
wnevets wrote: post #36

Earlier quoted context omitted.

Correct me if I'm wrong, everything is also being done out in the open for everyone to see. The NIST aren't using some secret analysis to make any recommendations.

Teams of cryptographers submit several proposals (and break each other's proposals). These people are well respected, largely independent, and assumed honest. Some of the mailing lists provided by NIST where cryptographers collaborated to review each other's work are public NIST may or may not consort with your friendly local neighborhood NSA people, who are bright and talented contributors in their own right. That's…

I was under the impression that only fools trust NIST after DUAL_EC_whatsit.

Is that not the case?

Re: Debunking NIST's calculation of the Kyber-512 security level

#92

Post by kpdemetriou »

zahllos wrote: post #85
kpdemetriou wrote: post #75

Earlier quoted context omitted.

Absolutely, but NIST ultimately choose the winners, giving them the option to pick (non-obviously) weak/weaker algorithms. Historically only the winners are adopted. Look at the AES competition - how often do you see Serpent being mentioned, despite it having a larger security margin than Rijndael by most accounts?

I fully admit to having a weak spot for Serpent - it is self-bitslicing (see the submission package or the linux kernel tree), which in hindsight makes constant time software easier to write, and it was faster in hardware even when measured at the time, which is where we have ended up putting AES anyway (e.g. AES-NI etc). BUT. On security margins, you could argue the Serpent designers were too conservative: https://e…

Implemented correctly, I agree the difference in security margin may not be too important. Otherwise, Serpent is more resistant to timing attacks. Weaknesses in implementation are as important as weaknesses in design.

Regardless, the comparison wasn't intended to argue for a meaningful difference in security margin, but to show that that the winner of the competition, well, wins (in adoption).

Re: Debunking NIST's calculation of the Kyber-512 security level

#94

Post by akira2501 »

throw0101a wrote: post #56
fefe23 wrote: post #15

If you have never heard of Bernstein, this may look like mad ramblings of a proto-Unabomber railing against THE MAN trying to oppress us. However, this man is one of the foremost cryptographers in the world, he has basically single-handedly killed US government crypto export restrictions back in the days, and (not least of all because of Snowden) we know that the NSA really is trying to sabotage cryptography. Also, h…

> If you have never heard of Bernstein, this may look like mad ramblings of a proto-Unabomber railing against THE MAN trying to oppress us. > However, this man is one of the foremost cryptographers in the world […] It's possible to be both (not saying Bernstein is). Plenty of smart folks have 'jumped the shark' intellectually: Ted Kaczynski, the Unabomber, was very talented in mathematics before he went off the deep…

> Plenty of smart folks have 'jumped the shark' intellectually: Ted Kaczynski, the Unabomber, was very talented in mathematics before he went off the deep end.

Kaczynski dropped out of society to live in a cabin alone at 29. He delivered his first bomb at 35. I'm not sure this is a reasonable comparison to invoke in any way whatsoever.

When DJB starts posting about the downfall of modern society from his remote cabin in Montana, perhaps, but as far as I know he's still an active professor working from within the University system.

Re: Debunking NIST's calculation of the Kyber-512 security level

#96

Post by [deleted] »

tptacek wrote: post #74
garba_dlm wrote: post #71

Earlier quoted context omitted.

i'm still working on understanding lattices better but i can imagine, based on my own ignorance, creativity, and lack of correct understanding, would be some kind of factorization. as I think while trying to better know what's a lattice, I imagine a lattice like a coordinate pair, but instead of each coordinate existing on a line, they exist on a binary tree (or some other directed graph explored from a root outwards…

A lattice is like a vector space, but with exclusively integer coefficients. It's not a coordinate pair. If you think of vectors as coordinate pairs, a vector space is a (possibly unbounded) set of coordinate pairs. If you haven't done any linear algebra, a decent intuition would be mathematical objects like "the even numbers" or "the odd numbers", but substituting vectors (fixed-sized tuples of numbers) for scalars.

[deleted]

Re: Debunking NIST's calculation of the Kyber-512 security level

#97

Post by kpdemetriou »

lucb1e wrote: post #89
kpdemetriou wrote: post #75

Earlier quoted context omitted.

Absolutely, but NIST ultimately choose the winners, giving them the option to pick (non-obviously) weak/weaker algorithms. Historically only the winners are adopted. Look at the AES competition - how often do you see Serpent being mentioned, despite it having a larger security margin than Rijndael by most accounts?

> Historically only the winners are adopted. Look at the AES competition Often, yes. But also consider the SHA-3 competition. BLAKE2 seems more widely used than what was chosen for SHA-3 (Keccak). What was submitted for the SHA-3 competition was BLAKE1 (it didn't have a number back then but I think this is clearer) so it's not like NIST said that Keccak is better than BLAKE2, they only said it's better than BLAKE1 (p…

Re: BLAKE2, I'm not sure it's fair to say that BLAKE2 is more widely used overall. But I do agree BLAKE2 is a bit of an outlier in terms of adoption. I think part of the reason is that SHA2 remains the go-to option, else I'd expect the ecosystem to consolidate around SHA3.

Re: Serpent, there are many things to unpack here but, in summary, you don't know a priori how large of a security margin you need (given the primary function of a cipher, you want to pick the conservative option), efficiency concerns become much less relevant with hardware-accelerated implementations and years of Moore's law performance uplifts, low-power devices can take advantage of much lighter algorithms than Rijndael OR Serpent, ease of implementation does not equal ease of correct/secure implementation vis-a-vis side channel attacks, and certainly if Serpent was chosen you wouldn't see Rijndael talked about much.

Re: Debunking NIST's calculation of the Kyber-512 security level

#98

Post by thadt »

mort96 wrote: post #65
tptacek wrote: post #58

Earlier quoted context omitted.

That's an argument that would prove too much. If you believe NSA can corrupt academic cryptographers, then you might as well give up on all of cryptography; whatever construction you settle on as trustworthy, they could have sabotaged through the authors. Who's to say they didn't do that to Bernstein directly? If I'd been suborned by NSA, I'd be writing posts like this too!

You're still not recognizing the difference between corrupting a single academic cryptographer and corrupting a whole bunch of academic cryptographers. This isn't so black and white. For what it's worth, I do think the US government could corrupt academic cryptographers. If I was an academic cryptographer, and someone from the US government told me to do something immoral or else they would, say, kill my family, and…

It's an interesting thought, but then you would need those cryptographers to not only stay quiet about it, but also spend a good chunk of the next part of their lives selling the lie.

Secrets are hard to keep at scale. Trying to do it with coercion, to a group of people who's entire field of study is covert communication, seems like an unenviable prospect.

Re: Debunking NIST's calculation of the Kyber-512 security level

#99

Post by 10g1k »

Related note: Government employees (including military, intel) are just people, and worse, bureaucrats. They aren't magical wizards who can all do amazing things with mathematics and witchcraft. If they were good at what they do, they wouldn't need ever increasing funding and projects to fix things.

Re: Debunking NIST's calculation of the Kyber-512 security level

#100

Post by zahllos »

ziddoap wrote: post #55
zahllos wrote: post #51

Earlier quoted context omitted.

DualEC: agree. Wanted to point out that it was a poor PRNG _anyway_ and point out that the NSA's attempt at backdooring the RNG wasn't that great - as you say, RSA BSAFE used it and it made no sense. We could also point out they went after the RNG rather than the algorithm directly, which is a less obvious strategy. I'll believe he invented the term - I have a 2009 book so-named for which he was an editor surveying n…

While I agree with a lot of what you have said, > Still, the idea that he's "the only one who can produce the good algorithms" The parent post did not, at all, make the claim that Bernstein is the only one .

No, true, the post did not explicitly state this. However the post did suggest that NIST is specifically out to get him and take a swipe at the other candidates:

> Is NIST trying to derail his work by standardizing crappy algorithms with the help of the NSA? Who knows. But to me it does smell like that.

"Crappy" algorithms that were designed by well-regarded cryptographers, none of whom work for NIST or the NSA, many of whom are not US nationals.

Post reply on HN