Keep in mind that the past actions of the NSA also include strengthening DES and strengthening SHA-1. The NSA also designed Skipjack for public use (in the Cli

Keep in mind that the past actions of the NSA also include strengthening DES and strengthening SHA-1. The NSA also designed Skipjack for public use (in the Clipper chip), which was eventually declassified, and which was apparently designed in good faith and remains secure (up to the 80 bit level it was designed for). Also keep in mind that the DUAL_EC backdoor was discovered within a year of its publication; SIMON and SPECK were published years ago and nobody has found or suggested a backdoor (plenty of people have been analyzing the ciphers). ARX designs have been proposed by plenty of other cryptographers, so nothing about the SIMON or SPECK designs would immediately raise eyebrows other than the fact that the NSA proposed them. Personally, I doubt that the effort to subvert standards involves backdoors, which are pretty hard to hide and pretty easy to avoid (DUAL_EC is the only credible candidate for a backdoor, it was discovered quickly, and it was not widely used). It seems more likely that the effort involves (this is all speculation): 1. Making standards more complex than necessary. 2. Making standards more sensitive to bad randomness (e.g. DSA signatures). 3. Making standards where constant-time implementations are harder or slower. In other words, they have pushed for standards that are harder to securely implement and easy to use insecurely. Why bother with backdoors when you can exploit common and easy-to-make mistakes? Given their expertise in spotting and exploiting these kinds of bugs, the NSA can probably satisfy the "information assurance" mission by vetting / correcting implementations used by the government, at least for the most important government secrets (most government communication would just use COTS; of course, most government communication is of limited value to foreign governments).