4 ms·

you'd expect the NSA to deprecate all of the curves, and not just P-256 You could argue that that is indeed what the announcement was doing. It was unrelated t

by rockdoe 11y ago

you'd expect the NSA to deprecate all of the curves, and not just P-256 You could argue that that is indeed what the announcement was doing. It was unrelated to P-256 being dropped. (P-256 being dropped does point to the whole "it's not as hard as we thought it was" theory)

api 11y ago
Maybe they backdoored P-256 and they think the backdoor may have leaked. That would inspire panic, especially since quite a few financial networks and military systems are protected by it.
- jerf 11y ago
  In some ways, this would be the best possible outcome. If they have it rubbed in their face that a backdoor simply can not be secured even with their full resources (as one imagines this would be the highest top secret possible), then maybe they'd flip from using their resources on trying to backdoor our stuff back around to using their full resources to help us. I suspect this falls into the "too good to be true" category.
  - paulmd 11y ago
    The problem is fundamentally that the most top-security ever possible is an offline piece of paper locked in a Mission Impossible-resistant bankvault that only the President has the capability to open. But then you can't actually use it to do anything and its existence is purely a downside. And you can't put it online - in any fashion - without exposing it to some possibility of compromise. Whether that's by one-or-more sysadmins who take a massive bribe (compromising two decades of SCI-level USG secrets => name a number and we'll pay in Billions), or users who can perform sidechannel attacks, and so on. Everyone knows what happens once you expose real systems to real users/admins (should be read as "attackers"). You cannot design a black box that miraculously requires no administration and is not vulnerable to any sidechannel attack when your threat category is state-level actors. I actually suspect the NSA does fall into the category of "altruistic actors" here. Their number-one concern is making sure that nobody can decrypt the things that nobody should be reading. I don't think they're above pulling a kleptographic backdoor if there's a computationally-strong guarantee that nobody else can break it (perhaps while learning a hard lesson about socially-strong security) but at the end of the day I do trust that they won't be broadcasting State Secrets in something that will be publically accessible within a decade. When dealing with a state actor like the NSA you need to reverse Hanlon's Razor - they may be malicious, but they're not stupid. They know when the jig is up and it's time to cut their losses.

by rockdoe 11y ago

api 11y ago

Maybe they backdoored P-256 and they think the backdoor may have leaked. That would inspire panic, especially since quite a few financial networks and military systems are protected by it.

jerf 11y ago
In some ways, this would be the best possible outcome. If they have it rubbed in their face that a backdoor simply can not be secured even with their full resources (as one imagines this would be the highest top secret possible), then maybe they'd flip from using their resources on trying to backdoor our stuff back around to using their full resources to help us. I suspect this falls into the "too good to be true" category.
- paulmd 11y ago
  The problem is fundamentally that the most top-security ever possible is an offline piece of paper locked in a Mission Impossible-resistant bankvault that only the President has the capability to open. But then you can't actually use it to do anything and its existence is purely a downside. And you can't put it online - in any fashion - without exposing it to some possibility of compromise. Whether that's by one-or-more sysadmins who take a massive bribe (compromising two decades of SCI-level USG secrets => name a number and we'll pay in Billions), or users who can perform sidechannel attacks, and so on. Everyone knows what happens once you expose real systems to real users/admins (should be read as "attackers"). You cannot design a black box that miraculously requires no administration and is not vulnerable to any sidechannel attack when your threat category is state-level actors. I actually suspect the NSA does fall into the category of "altruistic actors" here. Their number-one concern is making sure that nobody can decrypt the things that nobody should be reading. I don't think they're above pulling a kleptographic backdoor if there's a computationally-strong guarantee that nobody else can break it (perhaps while learning a hard lesson about socially-strong security) but at the end of the day I do trust that they won't be broadcasting State Secrets in something that will be publically accessible within a decade. When dealing with a state actor like the NSA you need to reverse Hanlon's Razor - they may be malicious, but they're not stupid. They know when the jig is up and it's time to cut their losses.