SHA-0 is another good example. It was withdrawn and replaced with the tweaked SHA-1 for no apparent reason. Years later techniques were discovered that the twea

SHA-0 is another good example. It was withdrawn and replaced with the tweaked SHA-1 for no apparent reason. Years later techniques were discovered that the tweak defended against. DES also defended against a technique that wasn’t developed in the public until two decades later. That technique was originally developed at IBM and NSA merely convinced them to keep it secret, so I’m not sure how that qualifies. Edit: Schneier has written about these before, of course. I wonder if his point here is not that the NSA was always boring, but rather that its lead is way less impressive than it once was.