3 ms·

While it could be the NSA, I think with things like IPSEC simple over engineering is more likely. Over engineering is an absolute plague in software. In ordina

by api 10y ago

While it could be the NSA, I think with things like IPSEC simple over engineering is more likely. Over engineering is an absolute plague in software. In ordinary cases it just makes things buggy, hard to maintain, and bloated and inefficient. In crypto though the consequences are much more severe since every little ounce of complexity in a cryptosystem exponentially increases the likelihood of exploitable bugs. DJB's boring crypto talk is worth reading: http://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf http://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf

tptacek 10y ago
It was a combination of over-engineering, a lack at the time of understanding of the field of cryptography and a pervasive belief among IETF types that the field could be understood from first principles by anyone who was good at Unix, and standard-issue bloody-mindedness. Phil Rogaway is one of the world's great cryptographers; it's from him that we get OCB, OAEP, PSS, UMAC, XTS, SIV, and many others. Even non-cryptographers might be familiar with him for his "Moral Character of Cryptography" paper†. I finagled a spot next to him at a dinner in Chicago once and asked him why he doesn't participate in IETF crypto standards (even with a recent renaissance of CFRG with Kenny Paterson at the helm, more expertise is badly needed). The impression I got from his answer is that he'd foresworn that kind of work. If you look at his experience trying to contribute to the IPSEC standard, you can see why: he enters mailing list threads making clear, obvious statements about cryptographic soundness --- for instance, "it's a bad idea to chain CBC IVs". He's immediately attacked --- and attacked personally, for instance by being referred to as a "so-called" cryptographer (or something like that; I'm going from memory) by a clique of standards nerds. Rogaway goes so far as to circulate a petition/critique from other cryptographers --- people like Ron Rivest --- and that's shot down as well. The standard is finalized with things like chained IVs in it. That's not enemy action. Or, if it is, the enemy is the standards process, not the NSA. † http://web.cs.ucdavis.edu/~rogaway/papers/moral.html* http://web.cs.ucdavis.edu/~rogaway/papers/moral.html*
- Ar-Curunir 10y ago
  > "so-called" cryptographer That would be an astoundingly stupid thing to say about Phil Rogaway...
  - tptacek 10y ago
    I'll find the actual mailing list post, but to get a flavor for what Rogaway dealt with at IPSEC, here's a snippet from a post Pinboard coughed up for a simple [rogaway ipsec] search. This is Perry Metzger, who is just my favorite. It appears that by failing to be as vicious as possible about Phil Rogaway's lack of understanding of the architecture of IPSP that I have inspired people to take him seriously. It also appears that Phil has been lobbying people to have them comment. I can understand how even an intelligent reader, going through his comments, could become confused about the architectural issues here. However, let me say that I found his comments to be almost completely without merit. Other than a few comments about places where the text used ambiguous language (i.e. textual ambiguity) I found almost nothing of value in what he had to say. Later: Found it. It's Bill Simpson: > You do not facilitate analysis > by saying that Photuris is only required to work when its > primitives are drawn from a certain concrete set of possibilities; > exactly the opposite-- you render cryptographic analysis impossible. > Thank you, thank you! It gladdens my heart to hear that *self-described cryptographers* find that analysis is impossible! I was worried that there would be some subtle flaw that would facilitate cryptanalysis. Now that you have assured us that it is not possible, that makes Photuris the only protocol that has ever come to perfection! Emphasis mine.
    - Ar-Curunir 10y ago
      Wow, this Bill Simpson person does not sound like a nice person, nor a smart one...
      - tptacek 10y ago
        Here is the problem: Bill Simpson is actually very smart, and well-respected. But IETF-land is an alternative universe that strongly prefers its own norms and processes above any other influences. People get involved in standards work and build social capital within IETF working groups, and feel threatened by and dismissive of outsiders. This happens with, I think, all standards groups. The irony is that the IETF was created in part as a reaction to these standards group pathologies. But they're too powerful to resist.
- api 10y ago
  Yes, I've seen standards committees and this is very typical. For most committees take the average IQ of all members and divide by member count. The only exceptions are those that are very well run by people with social skills and a good understanding of communication and where that kind of behavior and character assassination is banned. It's just that the consequences of stupidity in crypto are higher, as I said.

by api 10y ago

tptacek 10y ago

It was a combination of over-engineering, a lack at the time of understanding of the field of cryptography and a pervasive belief among IETF types that the field could be understood from first principles by anyone who was good at Unix, and standard-issue bloody-mindedness. Phil Rogaway is one of the world's great cryptographers; it's from him that we get OCB, OAEP, PSS, UMAC, XTS, SIV, and many others. Even non-cryptographers might be familiar with him for his "Moral Character of Cryptography" paper†. I finagled a spot next to him at a dinner in Chicago once and asked him why he doesn't participate in IETF crypto standards (even with a recent renaissance of CFRG with Kenny Paterson at the helm, more expertise is badly needed). The impression I got from his answer is that he'd foresworn that kind of work. If you look at his experience trying to contribute to the IPSEC standard, you can see why: he enters mailing list threads making clear, obvious statements about cryptographic soundness --- for instance, "it's a bad idea to chain CBC IVs". He's immediately attacked --- and attacked personally, for instance by being referred to as a "so-called" cryptographer (or something like that; I'm going from memory) by a clique of standards nerds. Rogaway goes so far as to circulate a petition/critique from other cryptographers --- people like Ron Rivest --- and that's shot down as well. The standard is finalized with things like chained IVs in it. That's not enemy action. Or, if it is, the enemy is the standards process, not the NSA. † http://web.cs.ucdavis.edu/~rogaway/papers/moral.html* http://web.cs.ucdavis.edu/~rogaway/papers/moral.html*

Ar-Curunir 10y ago
> "so-called" cryptographer That would be an astoundingly stupid thing to say about Phil Rogaway...
- tptacek 10y ago
  I'll find the actual mailing list post, but to get a flavor for what Rogaway dealt with at IPSEC, here's a snippet from a post Pinboard coughed up for a simple [rogaway ipsec] search. This is Perry Metzger, who is just my favorite. It appears that by failing to be as vicious as possible about Phil Rogaway's lack of understanding of the architecture of IPSP that I have inspired people to take him seriously. It also appears that Phil has been lobbying people to have them comment. I can understand how even an intelligent reader, going through his comments, could become confused about the architectural issues here. However, let me say that I found his comments to be almost completely without merit. Other than a few comments about places where the text used ambiguous language (i.e. textual ambiguity) I found almost nothing of value in what he had to say. Later: Found it. It's Bill Simpson: > You do not facilitate analysis > by saying that Photuris is only required to work when its > primitives are drawn from a certain concrete set of possibilities; > exactly the opposite-- you render cryptographic analysis impossible. > Thank you, thank you! It gladdens my heart to hear that *self-described cryptographers* find that analysis is impossible! I was worried that there would be some subtle flaw that would facilitate cryptanalysis. Now that you have assured us that it is not possible, that makes Photuris the only protocol that has ever come to perfection! Emphasis mine.
  - Ar-Curunir 10y ago
    Wow, this Bill Simpson person does not sound like a nice person, nor a smart one...
    - tptacek 10y ago
      Here is the problem: Bill Simpson is actually very smart, and well-respected. But IETF-land is an alternative universe that strongly prefers its own norms and processes above any other influences. People get involved in standards work and build social capital within IETF working groups, and feel threatened by and dismissive of outsiders. This happens with, I think, all standards groups. The irony is that the IETF was created in part as a reaction to these standards group pathologies. But they're too powerful to resist.
api 10y ago
Yes, I've seen standards committees and this is very typical. For most committees take the average IQ of all members and divide by member count. The only exceptions are those that are very well run by people with social skills and a good understanding of communication and where that kind of behavior and character assassination is banned. It's just that the consequences of stupidity in crypto are higher, as I said.