5 ms·

>it's mostly a political decision, not a technical one. Is there a good reason to trust the NSA's motivations? The NSA's stated motivation from the article:

>it's mostly a political decision, not a technical one. Is there a good reason to trust the NSA's motivations? The NSA's stated motivation from the article: >encryption tools [...] without requiring a lot of computer processing power. But it was noted that: >“There are probably some legitimate questions around whether these ciphers are actually needed,” said Curtis Dukes, who retired earlier this year. Similar encryption techniques already exist, and the need for new ones is theoretical, he said. The NSA's purpose is as a spy agency. No matter how effective that clear coat they're selling you might actually be, they're probably selling you on something you really don't need because it has a benefit to their purpose.

ethbro 9y ago
The NSA is dual purpose. Both as a signals spy agency and a signals counterintelligence agency. And ultimately, what's the difference between a publicly vetted algorithm proposed by the NSA and a publicly vetted algorithm proposed by someone else? Everyone points at the Dual EC fiasco, but if vulnerabilities are possible either way it seems like throwing the baby out with the bathwater.
- gnode 9y ago
  Any food could be poisonous, possibly with a poison you don't know how to detect. Would you rather eat food prepared by someone known to have poisoned you before, with obvious motivation to poison you again, or someone with no history of poisoning people? In no case are you guaranteed to not have poisoned food, but I know which I'd prefer.
  - tptacek 9y ago
    There's a strain of anti-intellectualism here. It's actually not true that any algorithm might be backdoored. Algorithms aren't unknowable. Furthermore, people act like there's a track record of super-sneaky NSA backdoors, and that Dual EC shows we can't trust anything NSA produces. I don't trust the NSA at all. But Dual EC wasn't sneaky. There were only two surprising things about Dual EC: (1) That they actually managed to get anyone to use it, despite how clunky and slow and unreasonable the design was. (2) That having produced a design that stuck out like a sore thumb for clunkiness, slowness, and unreasonableness, that design would be their backdoor; we gave them a lot more credit for tradecraft than that. People knew there was something shady about Dual EC almost from the jump. It is a random number generator that works by encrypting random state with a public key for which the private key is undisclosed. It's obviously weird. That's not the case with SPECK and SIMON. They're mainstream designs, and, more importantly, if you can hide a backdoor in a simple ARX Feistel block cipher that can be implemented in 100 lines of code, we probably have bigger concerns than these algorithms. Should you use SIMON and SPECK? Of course not. You shouldn't go anywhere near lightweight ciphers unless you know exactly what you're doing, and if you know exactly what you're doing, there are less politically controversial lightweight ciphers to use. The problem here isn't that the world is being deprived of SIMON and SPECK; it's that we're getting too practiced at turning our brains off.
    - schoen 9y ago
      Hi Thomas, I have a conceptual question. In the past there was a common idea that NSA's classified research might be a decade or more ahead of the academic world, even in an era when the academic world had gotten interested in crypto in earnest, and that they might know of entire classes of vulnerability that other people didn't. Probably the clearest precedent in support of this concern was differential cryptanalysis. Recently I've heard more of a suggestion that we understand crypto dramatically better than we used to, that cryptanalysis that appears to be hard generally is hard, and that spy agencies have been migrating largely to side-channel attacks and exploitation of vulnerabilities (and maybe also supply-chain attacks). (The weak Diffie-Hellman thing is apparently not a counterexample because there was open literature giving appropriate defensive guidance about that for many years.) Famously Snowden said that "crypto works" and reportedly leaked very little information about novel cryptanalysis, although there's also the counterargument that he might not have access to the relevant compartments to know how crypto doesn't work. I've even heard the claim that most of the unknowns for pure cryptanalytic attacks are in some way now known unknowns. At least, academic understanding of the mathematical problems has really matured significantly. What do you think about this question? If someone said "but what if NSA has the next mathematical breakthrough akin to to differential cryptanalysis, which Nadia Heninger is only going to discover in 2027?", would you say "that's really implausible nowadays given the maturity of our understanding of the math here"? (And I know Nadia mainly works on number theory and algebra rather than block ciphers.)
      - tptacek 9y ago
        This is a carefully written question that deserves a better response than I can give it. My basic answer is, "I don't know". I can give you some hunches, but you should be aware that they're based on the same kinds of first-principles reasoning that I'm so skeptical about in other people's HN comments. So: * I have been very unimpressed with the quality of NSA "TAO's" tooling, and, when I have conversations with people closer to NSA offensive cyber stuff than I am, what shakes out generally is that they people at the tip of that particular spear tend to be super young people in basically their first ever software job. * But Stuxnet was sort of impressive. * But then, what was impressive about Stuxnet was domain knowledge about a particular piece of industrial equipment, not hardcore computer science. The software engineering details of Stuxnet were kind of unimpressive. * But there's Flame, which is impressive in a CS kind of way. * NSA's original advantage in these kinds of systems probably stems largely from the fact that they were a monopsony buyer of cryptographic talent for many decades. You'd expect there to be a period of catching up. * But cryptography is now one of the better known pipelines for applied mathematics research, particularly for people who cross over between math and CS, and there's a lot of those people, so it's hard to see why NSA's advantage would be sustainable over the long term. * But also NSA does have a sustainable advantage in the kinds of cryptanalytic work that can only be done with massive, specialized compute resources, and for all I know when you can casually conduct research on gigantic ASIC clusters as easily as I can fire up Sage and add generate a curve point, you learn a whole bunch of stuff that is broadly applicable. * But academics get to collaborate directly with everyone in their field and NSA not so much, which is a mitigating factor. I think it's very healthy that we assume that NSA has space-alien capabilities. It adds rigor to our security models. And again I don't think we should use things like SIMON and SPECK. I just don't think we have to stop talking about the engineering aspects of SIMON and SPECK simply because they came from the NSA.
  - cortesoft 9y ago
    If we have a fairly robust system for detecting poison in the food, and we successfully detected the poisoned food the last time they tried to poison us, and the food looks really tasty because the chef was pretty good, even if he was a poisoner...... I might eat it.
    - ethbro 9y ago
      I'd eat it for the same reason I prefer more used open source packages: my threat model ranks "not enough smart people looked at this" a lot higher than "only a few people in the world know a secret about this."
tptacek 9y ago
No, there's no reason to trust the NSA's motivations. I'm just not sure what the NSA's motivations have to do with this. If you're asking, "do we actually need lightweight ciphers", well, the NSA isn't the only organization designing them; it's a whole field of research. If you want cryptographic security on machines that don't have multipliers and count their capacity for program text space in single-digit kilobytes, you're probably going to reach for special-purpose designs.
- Programmatic 9y ago
  Running an algorithm chosen by an attacker with extensive resources is foolhardy, because you can never be certain that your resources are sufficient to detect a trap carefully hidden by their resources. We have a history of the NSA performing attacks and standards subversion. Why accept their potential trojan horse when you can have algorithms designed by those without that checkered past, keep up the same amount of scrutiny for potential trojan horses, and have decreased odds of a backdoor being present if the provider is more trustworthy? It seems that taking motivations into account could lead you into a false sense of security, but that if you keep up the same amount of security and distrust known bad actors that you increase it.
  - tptacek 9y ago
    See https://news.ycombinator.com/item?id=15304634 https://news.ycombinator.com/item?id=15304634.
- throwaway2048 9y ago
  The NSA massively violated trust in the technical standards processes, now they get to lay down in their bed. If your response to this is "don't worry about it, its unlikely these ciphers are backdoored", you are missing the point.
  - tptacek 9y ago
    This isn't responsive to anything I wrote on this thread. I am interested in talking about cipher design, or about the technical intersection between trust and cipher design. I've already stipulated the politics of the story, which are deeply boring to me. You're addressing arguments I haven't made.
dfox 9y ago
The use-case for Simon/Speck are things like IoT and other places where you are not only limited by CPU power, but also by message sizes, while on the other hand the amount of traffic is so small that you can live with significantly smaller Ns in various 2^n attack difficulties than normal use cases. For such applications it is certainly better to use Simon/Speck than rolling you own proprietary algorithm (see KeeLog, NXP "Crypto-1" as used on MIFARE Classic and so on). Probably only other algorithm with similar level of scalability which was openly peer reviewed is RC5. In comparison to Speck/Simon, RC5 is significantly more complex (due to it's key schedule) and is not constant time on platforms without barrel shifter. (X)TEA and such things can be similarly tuned for various block and key sizes, but there are no recommended parameters for doing that and thus you get into the "rolling your own crypto" territory very fast.

ethbro 9y ago

The NSA is dual purpose. Both as a signals spy agency and a signals counterintelligence agency. And ultimately, what's the difference between a publicly vetted algorithm proposed by the NSA and a publicly vetted algorithm proposed by someone else? Everyone points at the Dual EC fiasco, but if vulnerabilities are possible either way it seems like throwing the baby out with the bathwater.

gnode 9y ago
Any food could be poisonous, possibly with a poison you don't know how to detect. Would you rather eat food prepared by someone known to have poisoned you before, with obvious motivation to poison you again, or someone with no history of poisoning people? In no case are you guaranteed to not have poisoned food, but I know which I'd prefer.
- tptacek 9y ago
  There's a strain of anti-intellectualism here. It's actually not true that any algorithm might be backdoored. Algorithms aren't unknowable. Furthermore, people act like there's a track record of super-sneaky NSA backdoors, and that Dual EC shows we can't trust anything NSA produces. I don't trust the NSA at all. But Dual EC wasn't sneaky. There were only two surprising things about Dual EC: (1) That they actually managed to get anyone to use it, despite how clunky and slow and unreasonable the design was. (2) That having produced a design that stuck out like a sore thumb for clunkiness, slowness, and unreasonableness, that design would be their backdoor; we gave them a lot more credit for tradecraft than that. People knew there was something shady about Dual EC almost from the jump. It is a random number generator that works by encrypting random state with a public key for which the private key is undisclosed. It's obviously weird. That's not the case with SPECK and SIMON. They're mainstream designs, and, more importantly, if you can hide a backdoor in a simple ARX Feistel block cipher that can be implemented in 100 lines of code, we probably have bigger concerns than these algorithms. Should you use SIMON and SPECK? Of course not. You shouldn't go anywhere near lightweight ciphers unless you know exactly what you're doing, and if you know exactly what you're doing, there are less politically controversial lightweight ciphers to use. The problem here isn't that the world is being deprived of SIMON and SPECK; it's that we're getting too practiced at turning our brains off.
  - schoen 9y ago
    Hi Thomas, I have a conceptual question. In the past there was a common idea that NSA's classified research might be a decade or more ahead of the academic world, even in an era when the academic world had gotten interested in crypto in earnest, and that they might know of entire classes of vulnerability that other people didn't. Probably the clearest precedent in support of this concern was differential cryptanalysis. Recently I've heard more of a suggestion that we understand crypto dramatically better than we used to, that cryptanalysis that appears to be hard generally is hard, and that spy agencies have been migrating largely to side-channel attacks and exploitation of vulnerabilities (and maybe also supply-chain attacks). (The weak Diffie-Hellman thing is apparently not a counterexample because there was open literature giving appropriate defensive guidance about that for many years.) Famously Snowden said that "crypto works" and reportedly leaked very little information about novel cryptanalysis, although there's also the counterargument that he might not have access to the relevant compartments to know how crypto doesn't work. I've even heard the claim that most of the unknowns for pure cryptanalytic attacks are in some way now known unknowns. At least, academic understanding of the mathematical problems has really matured significantly. What do you think about this question? If someone said "but what if NSA has the next mathematical breakthrough akin to to differential cryptanalysis, which Nadia Heninger is only going to discover in 2027?", would you say "that's really implausible nowadays given the maturity of our understanding of the math here"? (And I know Nadia mainly works on number theory and algebra rather than block ciphers.)
    - tptacek 9y ago
      This is a carefully written question that deserves a better response than I can give it. My basic answer is, "I don't know". I can give you some hunches, but you should be aware that they're based on the same kinds of first-principles reasoning that I'm so skeptical about in other people's HN comments. So: * I have been very unimpressed with the quality of NSA "TAO's" tooling, and, when I have conversations with people closer to NSA offensive cyber stuff than I am, what shakes out generally is that they people at the tip of that particular spear tend to be super young people in basically their first ever software job. * But Stuxnet was sort of impressive. * But then, what was impressive about Stuxnet was domain knowledge about a particular piece of industrial equipment, not hardcore computer science. The software engineering details of Stuxnet were kind of unimpressive. * But there's Flame, which is impressive in a CS kind of way. * NSA's original advantage in these kinds of systems probably stems largely from the fact that they were a monopsony buyer of cryptographic talent for many decades. You'd expect there to be a period of catching up. * But cryptography is now one of the better known pipelines for applied mathematics research, particularly for people who cross over between math and CS, and there's a lot of those people, so it's hard to see why NSA's advantage would be sustainable over the long term. * But also NSA does have a sustainable advantage in the kinds of cryptanalytic work that can only be done with massive, specialized compute resources, and for all I know when you can casually conduct research on gigantic ASIC clusters as easily as I can fire up Sage and add generate a curve point, you learn a whole bunch of stuff that is broadly applicable. * But academics get to collaborate directly with everyone in their field and NSA not so much, which is a mitigating factor. I think it's very healthy that we assume that NSA has space-alien capabilities. It adds rigor to our security models. And again I don't think we should use things like SIMON and SPECK. I just don't think we have to stop talking about the engineering aspects of SIMON and SPECK simply because they came from the NSA.
- cortesoft 9y ago
  If we have a fairly robust system for detecting poison in the food, and we successfully detected the poisoned food the last time they tried to poison us, and the food looks really tasty because the chef was pretty good, even if he was a poisoner...... I might eat it.
  - ethbro 9y ago
    I'd eat it for the same reason I prefer more used open source packages: my threat model ranks "not enough smart people looked at this" a lot higher than "only a few people in the world know a secret about this."

tptacek 9y ago

No, there's no reason to trust the NSA's motivations. I'm just not sure what the NSA's motivations have to do with this. If you're asking, "do we actually need lightweight ciphers", well, the NSA isn't the only organization designing them; it's a whole field of research. If you want cryptographic security on machines that don't have multipliers and count their capacity for program text space in single-digit kilobytes, you're probably going to reach for special-purpose designs.

Programmatic 9y ago
Running an algorithm chosen by an attacker with extensive resources is foolhardy, because you can never be certain that your resources are sufficient to detect a trap carefully hidden by their resources. We have a history of the NSA performing attacks and standards subversion. Why accept their potential trojan horse when you can have algorithms designed by those without that checkered past, keep up the same amount of scrutiny for potential trojan horses, and have decreased odds of a backdoor being present if the provider is more trustworthy? It seems that taking motivations into account could lead you into a false sense of security, but that if you keep up the same amount of security and distrust known bad actors that you increase it.
- tptacek 9y ago
  See https://news.ycombinator.com/item?id=15304634 https://news.ycombinator.com/item?id=15304634.
throwaway2048 9y ago
The NSA massively violated trust in the technical standards processes, now they get to lay down in their bed. If your response to this is "don't worry about it, its unlikely these ciphers are backdoored", you are missing the point.
- tptacek 9y ago
  This isn't responsive to anything I wrote on this thread. I am interested in talking about cipher design, or about the technical intersection between trust and cipher design. I've already stipulated the politics of the story, which are deeply boring to me. You're addressing arguments I haven't made.

dfox 9y ago

The use-case for Simon/Speck are things like IoT and other places where you are not only limited by CPU power, but also by message sizes, while on the other hand the amount of traffic is so small that you can live with significantly smaller Ns in various 2^n attack difficulties than normal use cases. For such applications it is certainly better to use Simon/Speck than rolling you own proprietary algorithm (see KeeLog, NXP "Crypto-1" as used on MIFARE Classic and so on). Probably only other algorithm with similar level of scalability which was openly peer reviewed is RC5. In comparison to Speck/Simon, RC5 is significantly more complex (due to it's key schedule) and is not constant time on platforms without barrel shifter. (X)TEA and such things can be similarly tuned for various block and key sizes, but there are no recommended parameters for doing that and thus you get into the "rolling your own crypto" territory very fast.