16 ms·

NSA encryption plan for ‘internet of things’ rejected by ISO

405 points by Jerry2 8y ago

jstanley 8y ago
> concerns that the U.S. agency could be promoting encryption technology it knew how to break, rather than the most secure. If they were going to do this, wouldn't they submit it under a pseudonym?
- maze-le 8y ago
  Nope, see: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
- OscarCunningham 8y ago
  Pseudonymous submission would also be a reason for suspicion.
- kennywinker 8y ago
  Why would they? A national security organization should be concerned with keeping their citizen’s traffic from being snooped - not snooping their citizen’s traffic.
  - risotto_groupon 8y ago
    If the glass is half full of citizen traffic and half full of non-citizen traffic and the NSA drinks ALL of it and I don't think they should be drinking ANY of it does that make me an optimist or a pessimist?
    - gnode 8y ago
      It makes you a cynic, but rightly so.
      - fjsolwmv 8y ago
        Considering the nature of comms that happen on line these days, it might make you a septic.
    - stevew20 8y ago
      Optimized pessimist. You are part of the majority!
  - notheguyouthink 8y ago
    Eh, I mean, it's complicated - isn't it? If anyone inside US borders is off limits, wouldn't it be a great place for terrorists to set up shop? Completely no surveillance in US borders, win win! I agree completely that our rights shouldn't be trampled on by governing agencies. Yet, I don't know how they're going to work in the old fashioned way. Perhaps it's not required, but I can't blame them for seeking that option, even if well meaning. (By old fashioned, I mean back in the days of easily monitoring everyones phones and calling it good enough. Things are becoming increasingly difficult to monitor for a even a well meaning government) edit: Not sure why I'm being downvotes, so let me elaborate. We all know it's stupidly common for the government to monitor it's civilians. Those days are being altered heavily due to cryptography. In some ways it still be easier to track people, in other ways it will be harder. Is this news to any of you? I don't get the push back lol.
    - jstanley 8y ago
      There were never days of "easily monitoring everyone's phones". If they wanted to monitor somebody's phone they had to go to great effort to do so. It's easier today than it has ever been for surveillance services to monitor large amounts of people. Not just because they have the access and computational ability to automatically search the content of messages, but also because more of our communications are long-distance or otherwise digitised than ever before.
      - notheguyouthink 8y ago
        > There were never days of "easily monitoring everyone's phones". If they wanted to monitor somebody's phone they had to go to great effort to do so. Oh, I thought it was far easier to tap a phone than to break modern cryptography. Why was it not? > It's easier today than it has ever been for surveillance services to monitor large amounts of people. Not just because they have the access and computational ability to automatically search the content of messages, but also because more of our communications are long-distance or otherwise digitised than ever before. I would argue that this is changing though, hence the entire point of this Post. In the 90s no one encrypted anything, even https was laughable. More and more things are being encrypted. That's what this post is effectively about, no? The government is trying to stay ahead of the ball on cryptography and hoping to keep their ability to monitor everyone. Do you somehow disagree? I'm confused.
  - ENOTTY 8y ago
    Please look past the name of the Agency to understand its mission. If you think the security of US citizens' communications should be a mission of the NSA, go advocate with your representatives to make it so. As it currently stands, the IA mission of the NSA is solely to secure National Security Systems, which are systems that handle classified information or are critical to military or intelligence activities. "National Security Directive (NSD) 42 authorizes NSA to secure National Security Systems, which includes systems that handle classified information or are otherwise critical to military or intelligence activities." https://www.nsa.gov/what-we-do/information-assurance/ https://www.nsa.gov/what-we-do/information-assurance/
- tptacek 8y ago
  How would that even work? Cryptography is a small world. A submission from someone nobody's heard of would have no chance.
  - antonvs 8y ago
    Satoshi Nakamoto sympathizes.
    - tptacek 8y ago
      In serious academic crypto circles, "Satoshi Nakamoto" is a clown. I don't think a "Satoshi" algorithm would stand much of a chance either.
      - kaoD 8y ago
        Can you elaborate? In what way is he a clown? (honest question) As I understand it he applied a bunch of well known algorithms to solve a long-standing problem. He's not a cryptologist but, as far as I can tell, he never claimed so.
  - jessaustin 8y ago
    Because no one would consider it, or because careful expert analysis isn't enough and no one would trust it? In the latter case, how does one get on the trusted list, and if NSA is on it how on earth does one get off?
    - tptacek 8y ago
      Probably nobody would even consider it. It would be like standardizing a cipher proposed on reddit r/crypto.
      - jessaustin 8y ago
        In that case they could just pay some reputable experts to consider it. They would pay anonymously, of course.
shawn 8y ago
Snowden caused this. That's pretty interesting, one way or the other.
- whatshisface 8y ago
  This is hardly the first time suspicion has fallen on NSA proposals. As linked elsewhere in this thread, https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
  - shawn 8y ago
    True, but it's one of the first with hard evidence to use against the NSA.
  - baby 8y ago
    Trevor Perrin also asked to kick some NSA chair from the IETF board. On my phone can't find the thread.
    - tptacek 8y ago
      https://news.ycombinator.com/item?id=6942145 https://news.ycombinator.com/item?id=6942145
- Tyrannosaur 8y ago
  Interesting way to put the blame on someone exposing the crimes, instead of those actually doing the crimes.
  - revscat 8y ago
    Your rush to judgement here is unwarranted. OP said nothing about whether what Snowden did was good or bad, just that it was a factor in the ISO's decision.
    - SlowRobotAhead 8y ago
subcosmos 8y ago
Telnet passwords ought to be good enough, right?
- akerro 8y ago
  No one expects anyone to pass sensitive information in plaintext!
  - fjsolwmv 8y ago
    Hiding in plain sight.
  - bgongfu 8y ago
    Jedi encryption :) One of the ideas I've tinkered with along the way is hiding encrypted emails in content that's markov generated from unencrypted communications with the same peer. It doesn't have to be perfect, just good enough to not get caught in the slime squad's algorithms.
    - jancsika 8y ago
      Or you could send encrypted texts with a subject line that tells how many leading zero bits are in your GPG private key. Perhaps start with keysize - 1. Then for each new message subtract 1 from the number of leading zeros. Now at some point Eve has to decide for herself when it's no longer worth it to brute force your messages. Edit: clarification
vcpnt51 8y ago
This is clear manipulation to starve the NSA (and therefore the United States government) of good brains. What are the names of those who voted against this? Edit: >Israeli delegate Orr Dunkelman told Reuters he did not trust the U.S. designers following the September meetings.
- roywiggins 8y ago
  > Two delegates told WikiTribune that the opposition to adding these algorithms was led by Dr. Tomer Ashur from KU Leuven University, representing the Belgian delegation and it was supported by a large group of countries. Those pesky Belgians!
  - vcpnt51 8y ago
    https://en.wikipedia.org/wiki/Ashur https://en.wikipedia.org/wiki/Ashur He's also been working against the US national interests before: http://www.cs.technion.ac.il/~biham/Workshops/Cryptoday/2015/Slides/ashur-presentation.pdf http://www.cs.technion.ac.il/~biham/Workshops/Cryptoday/2015...
    - klez 8y ago
      Linking to a Wikipedia article about a biblical figure helps how, in this context?
      - icebraining 8y ago
        He points out that one is Israeli and the other has a surname of Hebrew origins. I'm no dog, but even I can hear that whistling.
        klez 8y ago
        I didn't want to imply anything, but I too thought that was the point. Also, seeing the overall good treatment the US reserve for Israel I'm always surprised when someone implies that Israel wants to damage the US.
phigcch 8y ago
Better article from April when this story first broke. https://www.theregister.co.uk/2018/04/25/nsa_iot_encryption/ https://www.theregister.co.uk/2018/04/25/nsa_iot_encryption/ The standardization of Simon and Speck has been an ongoing fight within ISO/IEC JTC1 SC27 WG2 since 2014 or so, but looks like it's finally game over for now.
- tptacek 8y ago
  That's not a great article. In reality, nobody thinks Speck and Simon are backdoored --- they're extremely straightforward block cipher designs with well-understood components. Unless the NSA knows something that breaks all modern block cipher designs --- in which case, why tip your hand? --- there's no place to hide a backdoor in either of these standards. What happened here seems like a combination of two things: first, a general statement that the community is skeptical of NSA-related standards after the Dual EC fiasco, just on principles, and, second, process concerns about the way NSA interacts with standards bodies --- their work is considered poorly documented and their engagement with the academic research community (for instance, to answer concerns about flaws in their designs) is poor.
  - baby 8y ago
    I don't see why would any Non-American company would accept any of their thoughts/designs after their sneaky backdoor prng.
    - CiPHPerCoder 8y ago
      They shouldn't, but at the same time, these non-American companies should at least be honest about why they're rejecting the NSA's thoughts/designs rather than hype up some vapid fear of a backdoor. Slap NSA's hand for being abusive to the privacy of everyone, including their own citizens? We need more of that.
    - tedunangst 8y ago
      The back door prng wasn't all that sneaky? I would assess "don't look behind the curtain" and "nothing up my sleeves because I'm not wearing sleeves" quite differently.
AdmiralAsshat 8y ago
Key point: >According to WikiTribune’s source, experts in the delegations have clashed over recent weeks and the NSA has not provided the technical detail on the algorithms that is usual for these processes. The U.S. delegation’s refusal to provide a “convincing design rationale is a main concern for many countries,” the source said. So it's not just "We don't trust anything the NSA puts out." It's "The NSA is refusing to explain their algorithms in lieu of saying 'Trust us,' and we don't."
- vertexFarm 8y ago
  It's like a burglar offering to change your locks. And promising he doesn't have a copy of the key. But you aren't allowed to check. Just trust him.
  - akvadrako 8y ago
    On the other hand, an honest burglar is probably the most reliable source for all the known exploits and can judge a good lock when they see it.
    - executesorder66 8y ago
      Yes, but the NSA is hardly honest.
- imglorp 8y ago
  They brought this on themselves. The root problem is they have two conflicting missions: one is to help USA secure itself and the other is to read all comms worldwide.
  - fjsolwmv 8y ago
    The way it's supposed to work is that they try to have the best code cracking, and then they want everyone to use the second best codes so no one else can crack code. If they aren't the best the plan can't work and you get junk like clipper chip or whatever it was called.
olfactory 8y ago
When we think about what actually matters when it comes to institutions (public or private) one very important thing is trust. The NSA has eroded much of the trust it once had. This reduces its effectiveness as an organization and puts all Americans and American companies at increased risk. Those who committed the crimes revealed by Snowden should be brought to justice, the program dismantled, the hardware auctioned off, and the money returned to taxpayers. One does not have to be a privacy zealot or an anarchist to believe that the NSA should act within the law.
- pdimitar 8y ago
  > puts all Americans and American companies at increased risk. Both yes and no. No, because many startups are just looking for the shortest path to market and that means they absolutely will go for US cloud storage and computing if it best serves their initial business plans. Yes, because there are many ethical businesses (albeit smaller) -- and also in light with the GDPR -- who have a clear business model that doesn't involve selling personally identifiable information. And they now would go an extra mile to ensure they don't use USA-hosted services. I know business owners who did this and I'd do it as well if I was one. Post Snowden there were a lot of companies offering secure email hosting in Europe. Not sure if that really amounted to a big loss for the USA email hosting market though. Many people are too dependent on Gmail to ever replace it, for example.
trisimix 8y ago
The NSA has lost an insane amount of credibility for acting like a three letter agency instead of a security administration. Turns out its pretty hard to be both.
jaboutboul 8y ago
I see the tin foil hats are out in full swing, but the reality is, far from what people assume. From someone who has been following this saga, this is more a fight about how the NSA cooperates (or lack thereof) with ISO and other standards orgs. Most likely due to their own internal self-conflict. As others have mentioned Simon and Speck very straightforward. There really isn't much room for obscuring anything there. On the other hand, when any group that's a part of a standards org begins to feel so privileged that they can operate under their own rules and without truly cooperating with the others and share information in the way that people are asking for it, it's going to breed further mistrust given the already tense environment due to the history there.
- nebulous1 8y ago
  I don't know anything of the technical details of Simon and Speck, but distrusting the NSA hardly entails a tinfoil hat.
  - tptacek 8y ago
    "Distrusting" one of the simplest "mainstream" ARX ciphers entails a little bit of tin foil. That's not really why ISO isn't moving forward with them.
    - xansi 8y ago
      That seems to be exactly why ISO isn't moving forward, or at least has been in the past. https://www.reuters.com/article/us-cyber-standards-insight/distrustful-u-s-allies-force-spy-agency-to-back-down-in-encryption-fight-idUSKCN1BW0GV https://www.reuters.com/article/us-cyber-standards-insight/d...
      - tptacek 8y ago
        Distrust of the NSA has cost it the deference it was given by academic cryptographers to basically ignore the process norms of public crypto standards. That's not the same as saying the academic cryptography community distrusts a simple ARX design.
peterwwillis 8y ago
Unrelated: Has anyone ever not clicked on the "this site uses cookies" button on any website since they started being introduced? Does anyone even look at them before clicking them?
- deleted 8y ago
  [deleted]
- matheusmoreira 8y ago
  That button is just a CYA measure. The idea seems to prevent users from claiming they didn't know they were being monitored. It solves nothing and gives users absolutely no control over tracking behavior. I doubt web sites wait for the user's decision to "accept" the use of cookies: since they normally travel via HTTP headers, they would already be in the browser's cookie jar before the page even rendered.
spadros 8y ago
The NSA trying to propose an encryption plan is like letting wolves decide how to secure sheep. Total conflict of interest, especially after Snowden.
- segmondy 8y ago
  But isn't it the same argument that if you wish to secure your system you really need to get a whitehat hacker. NSA looks at herself in the same light as a whitehat.
  - colordrops 8y ago
    No one else but the NSA sees the NSA as whitehats.
    - stochastic_monk 8y ago
      Nation-State Adversary is my favorite backronym for NSA.
  - spadros 8y ago
    Yeah, the NSA's trust is down the drain. I wouldn't call them whitehat. Huge conflict of interest to accept anything they propose.
  - dragonwriter 8y ago
    The NSA are overtly, by a central part of their official mission, black hats, not white hats. If US federal defensive cybersecurity (especially on cryptographic matters) is going to have credibility in its recommendations outside of the US government, especially given the long history of the NSA compromising defensive recommendations in service of its offensive mission, it needs to be both visibly and effectively distanced from the signals intelligence mission of NSA/CSS.
  - monochromatic 8y ago
    Hiring a whitehat is one thing. The NSA is gray at best.
Jerry2 8y ago
What's also interesting is how the NSA admonished and personally attacked three cryptographers (including Daniel J. Bernstein aka djb) and called them incompetent: >the NSA's behavior was outrageously adversarial to the process. They refused to motivate design choices they made such as the choice of matrices U, V, and W in Simon's key schedule. Instead, they chose to personally attack some of the experts (including @hashbreaker, Orr Dunkelman and myself) as incompetent. >This is yet another example as to how the NSA's surveillance program is bad for global security. If they had been more trustworthy, or at least more cooperative, different alliances would have probably been formed. But instead, they chose to try to bully their way into the standards which almost worked but eventually backfired. Rest: https://twitter.com/TomerAshur/status/988696306674630656 https://twitter.com/TomerAshur/status/988696306674630656
- metalliqaz 8y ago
  I wonder how they personally attacked those experts. Was it public?
  - tptacek 8y ago
    "Personal attack" is a pretty big stretch here. The NSA is generally dismissive of academic cryptographers, and was dismissive here.
    - metalliqaz 8y ago
      Okay that's what the article says but the tweets specifically say that they attacked the credibility of some very well respected security experts
      - tptacek 8y ago
        If they're talking about what I think they're talking about, they're referring to a technical argument in which pretty much everyone was dismissive. It was still more civil than a typical HN thread, which is in turn more civil than a typical Reddit thread, which in turn is... my point being: outrageous personal attack is a bit of a stretch.
DINKDINK 8y ago
Remember, the S in IoT is for security.
- garmaine 8y ago
  IoOPT — the Internet of Other People’s Thjngs.
whois 8y ago
So happy to see a Wiki Tribune link here. I think the project is super cool, I hope it stays around.
mysterypie 8y ago
Does anyone who's been following these IoT encryption standards think that new algorithms are truly needed? Considering that even the most trivial embedded devices these days get powerful microcontrollers and megabytes of RAM -- often running a full operating system! -- is there any perceptible gain with one of these unknown lightweight algorithms compared to using a well-known and standard algorithm like AES? I took a look at the performance tests of AES vs NSA's Simon/Speck done by the CryptoLUX group at the University of Luxembourg[1]. They have so much data comparing different scenarios, processors, and implementation versions that it's difficult to summarize the trade-offs. But my brief look at AES vs Simon/Speck on an 8-bit Atmel AVR processor is that the difference in code size and RAM are in the hundreds of bytes (bytes, not megabytes) and AES performance might be approximately equal (if AES is implemented with large code size and RAM) or up to 10-15 times slower (if implemented with small code size and RAM). Seriously, embedded software these days is so bloated (just like in web development), and processors and RAM are so over-provisioned, and encryption is such a minuscule part of the tasks of a system that I wonder if using a standard algorithm like AES would make a perceptible difference to anybody. [1] https://www.cryptolux.org/index.php/FELICS_Block_Ciphers_Detailed_Results#AVR https://www.cryptolux.org/index.php/FELICS_Block_Ciphers_Det...
- metalliqaz 8y ago
  hundreds of bytes is a lot on AVRs. 1 millisecond is a lot on AVRs. I'd have to go look at their data myself, because AES is slow even compared to ChaCha20, and these algorithms are significantly more lightweight than that.
  - setquk 8y ago
    Why the hell would you use an AVR when there are better resourced and faster ARM cores for the same power drain.
    - metalliqaz 8y ago
      Perhaps there are now, but these algorithms were developed several years ago. Also AVRs are cheap and very easy to use due to their simplicity.
BroadcastSunny 8y ago
My problem with this link is that anyone can edit it and it looks like anyone can be an author on the site, so I question the validity of the article.
- pritambaral 8y ago
  Interesting. Do you also mistrust Wikipedia? Besides, it is not like every reputed journalist these days maintains basic journalistic standards or integrity. Case in point, article by Reuters from two days ago: https://news.ycombinator.com/item?id=17057700 https://news.ycombinator.com/item?id=17057700
  - BroadcastSunny 8y ago
    The schools won't allow my kids to use Wikipedia as a source - so yeah. (this is despite the fact that Wikipedia got more strict with allowing people to comment and that they require references) You're just mad I didn't trust your article
    - pritambaral 8y ago
      > The schools won't allow my kids to use Wikipedia as a source Would they allow your kids to use Wikipedia's own sources — as long as they're legitimate — as their sources? I do not trust traditional journalism as a source either (unlike Wikipedia and most schools). I try to find their sources; and when I can't, I regard it with suspicion. > You're just mad I didn't trust your article. This is either incredibly childish or too subtly tongue-in-cheek for me. Neither is the article "mine" in any way, nor was I "mad". I was genuinely curious.
codedokode 8y ago
Encryption scheme choice doesn't mean much if the devices send all the data to US-controlled "clouds". NSA will be able to read everything anyway.
- saagarjha 8y ago
  If your encryption is strong and end-to-end, it doesn't matter where your data goes.
  - codedokode 8y ago
    It does matter. Because there are many people who have access to the servers and they can cooperate with government agencies voluntarily or involuntarily. For example, if you use "voice assistant" from some major company, what prevents it from voluntarily sharing all the records with the government for the sake of national security? What prevents its employee from secretly sharing the data under some legal obligations? The location of the server is really important here.
    - m3rc 8y ago
      The point of E2E is that it doesn't matter who owns the server. "End to End" means end to end, not 'end to middle then decrypted then to end'. If it's ever decrypted anywhere but an endpoint it's not E2E, by definition.
      - mc808 8y ago
        In the voice assistant example, the server is one of the endpoints. The point they're making is that E2E doesn't really help there if you can't be sure who is looking over shoulders on the other end. If the two ends are both under your control or scrutiny, then it doesn't matter who's hiding in the clouds... Except for metadata of course.
      - codedokode 8y ago
        Typical IoT device usually talks to the server where all the received data are often stored for futured use. If they used E2E, server wouldn't be necessary - it would make more sense to connect directly inside home WiFi network for example.
jchook 8y ago
Don’t cryptographers still have concerns about an AES backdoor?
- tptacek 8y ago
  No.
clarkmoody 8y ago
This is the first WikiTribune story I've personally noticed on HN. The story is not as juicy as the headline makes it out to be, but it's good to see WikiTribune as a source of news nonetheless. I'm excited to see more from this site in the future.
- akvadrako 8y ago
  Do you read WikiTribune? I am always hoping to find better sources of news, but it doesn't appeal to me enough to try.
  - clarkmoody 8y ago
    Not at the moment. I'll give it a shot though and see how things go.
- severine 8y ago
  This is the first story that's got traction, apart from the meta-stories: https://news.ycombinator.com/from?site=wikitribune.com https://news.ycombinator.com/from?site=wikitribune.com
slededit 8y ago
This is what a loss of soft power looks like. The US has burned its reputation and is loosing influence in all areas of the world.
Drdrdrq 8y ago
Well, I doubt NSA are stupid. The question is more what their plan is to get the standards they want to be accepted. Maybe by exposing themselves and thus creating a better chance for secret allies? We'll need to wait for the next Snowden to find out I guess, if ever.
mabbo 8y ago
Here's a weird/fun thought: what if the NSA was trying to lose? This is the NSA. They're no fools. And they know that no one is going to trust them, especially if they try to bully their way and not reveal details. What if the next-best competitor for this encryption is actually something they've broken? Could be that they got clever and lucky and figured it out, could be that they planted it with someone secretly working for the NSA. Then it would be in their interest to loudly lose in such a way that the standards committee picks the secretly-broken encryption rather than the one the NSA was pushing. Fun tinfoil hat ideas, naturally, but it would sure make a better story than the NSA trying to backdoor an encryption standard again.
- elago 8y ago
  Why would they do that rather than just not submit anything and let the already broken next-best competitor win?
  - Tepix 8y ago
    Where's the conspiracy theory then?
anfilt 8y ago
I find this kinda sad since both speck and simon are really nice algorithms. The analysis that has been done also shows that seem secure. Moreover, they are simple I have made several implementations, and one that runs simon on a FPGA. It honestly would be hard to sneak a back door in my opinion. Also keep this in mind the US government also wants to use these algorithms. Why would they use a broken symmetric cipher?
sunstone 8y ago
Some more suspicious elliptic curves no doubt.

405 points by Jerry2 8y ago

> concerns that the U.S. agency could be promoting encryption technology it knew how to break, rather than the most secure. If they were going to do this, wouldn't they submit it under a pseudonym?

maze-le 8y ago
Nope, see: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
OscarCunningham 8y ago
Pseudonymous submission would also be a reason for suspicion.
kennywinker 8y ago
Why would they? A national security organization should be concerned with keeping their citizen’s traffic from being snooped - not snooping their citizen’s traffic.
- risotto_groupon 8y ago
  If the glass is half full of citizen traffic and half full of non-citizen traffic and the NSA drinks ALL of it and I don't think they should be drinking ANY of it does that make me an optimist or a pessimist?
  - gnode 8y ago
    It makes you a cynic, but rightly so.
    - fjsolwmv 8y ago
      Considering the nature of comms that happen on line these days, it might make you a septic.
  - stevew20 8y ago
    Optimized pessimist. You are part of the majority!
- notheguyouthink 8y ago
  Eh, I mean, it's complicated - isn't it? If anyone inside US borders is off limits, wouldn't it be a great place for terrorists to set up shop? Completely no surveillance in US borders, win win! I agree completely that our rights shouldn't be trampled on by governing agencies. Yet, I don't know how they're going to work in the old fashioned way. Perhaps it's not required, but I can't blame them for seeking that option, even if well meaning. (By old fashioned, I mean back in the days of easily monitoring everyones phones and calling it good enough. Things are becoming increasingly difficult to monitor for a even a well meaning government) edit: Not sure why I'm being downvotes, so let me elaborate. We all know it's stupidly common for the government to monitor it's civilians. Those days are being altered heavily due to cryptography. In some ways it still be easier to track people, in other ways it will be harder. Is this news to any of you? I don't get the push back lol.
  - jstanley 8y ago
    There were never days of "easily monitoring everyone's phones". If they wanted to monitor somebody's phone they had to go to great effort to do so. It's easier today than it has ever been for surveillance services to monitor large amounts of people. Not just because they have the access and computational ability to automatically search the content of messages, but also because more of our communications are long-distance or otherwise digitised than ever before.
    - notheguyouthink 8y ago
      > There were never days of "easily monitoring everyone's phones". If they wanted to monitor somebody's phone they had to go to great effort to do so. Oh, I thought it was far easier to tap a phone than to break modern cryptography. Why was it not? > It's easier today than it has ever been for surveillance services to monitor large amounts of people. Not just because they have the access and computational ability to automatically search the content of messages, but also because more of our communications are long-distance or otherwise digitised than ever before. I would argue that this is changing though, hence the entire point of this Post. In the 90s no one encrypted anything, even https was laughable. More and more things are being encrypted. That's what this post is effectively about, no? The government is trying to stay ahead of the ball on cryptography and hoping to keep their ability to monitor everyone. Do you somehow disagree? I'm confused.
- ENOTTY 8y ago
  Please look past the name of the Agency to understand its mission. If you think the security of US citizens' communications should be a mission of the NSA, go advocate with your representatives to make it so. As it currently stands, the IA mission of the NSA is solely to secure National Security Systems, which are systems that handle classified information or are critical to military or intelligence activities. "National Security Directive (NSD) 42 authorizes NSA to secure National Security Systems, which includes systems that handle classified information or are otherwise critical to military or intelligence activities." https://www.nsa.gov/what-we-do/information-assurance/ https://www.nsa.gov/what-we-do/information-assurance/
tptacek 8y ago
How would that even work? Cryptography is a small world. A submission from someone nobody's heard of would have no chance.
- antonvs 8y ago
  Satoshi Nakamoto sympathizes.
  - tptacek 8y ago
    In serious academic crypto circles, "Satoshi Nakamoto" is a clown. I don't think a "Satoshi" algorithm would stand much of a chance either.
    - kaoD 8y ago
      Can you elaborate? In what way is he a clown? (honest question) As I understand it he applied a bunch of well known algorithms to solve a long-standing problem. He's not a cryptologist but, as far as I can tell, he never claimed so.
- jessaustin 8y ago
  Because no one would consider it, or because careful expert analysis isn't enough and no one would trust it? In the latter case, how does one get on the trusted list, and if NSA is on it how on earth does one get off?
  - tptacek 8y ago
    Probably nobody would even consider it. It would be like standardizing a cipher proposed on reddit r/crypto.
    - jessaustin 8y ago
      In that case they could just pay some reputable experts to consider it. They would pay anonymously, of course.

shawn 8y ago

Snowden caused this. That's pretty interesting, one way or the other.

whatshisface 8y ago
This is hardly the first time suspicion has fallen on NSA proposals. As linked elsewhere in this thread, https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
- shawn 8y ago
  True, but it's one of the first with hard evidence to use against the NSA.
- baby 8y ago
  Trevor Perrin also asked to kick some NSA chair from the IETF board. On my phone can't find the thread.
  - tptacek 8y ago
    https://news.ycombinator.com/item?id=6942145 https://news.ycombinator.com/item?id=6942145
Tyrannosaur 8y ago
Interesting way to put the blame on someone exposing the crimes, instead of those actually doing the crimes.
- revscat 8y ago
  Your rush to judgement here is unwarranted. OP said nothing about whether what Snowden did was good or bad, just that it was a factor in the ISO's decision.
  - SlowRobotAhead 8y ago

subcosmos 8y ago

Telnet passwords ought to be good enough, right?

akerro 8y ago
No one expects anyone to pass sensitive information in plaintext!
- fjsolwmv 8y ago
  Hiding in plain sight.
- bgongfu 8y ago
  Jedi encryption :) One of the ideas I've tinkered with along the way is hiding encrypted emails in content that's markov generated from unencrypted communications with the same peer. It doesn't have to be perfect, just good enough to not get caught in the slime squad's algorithms.
  - jancsika 8y ago
    Or you could send encrypted texts with a subject line that tells how many leading zero bits are in your GPG private key. Perhaps start with keysize - 1. Then for each new message subtract 1 from the number of leading zeros. Now at some point Eve has to decide for herself when it's no longer worth it to brute force your messages. Edit: clarification

vcpnt51 8y ago

This is clear manipulation to starve the NSA (and therefore the United States government) of good brains. What are the names of those who voted against this? Edit: >Israeli delegate Orr Dunkelman told Reuters he did not trust the U.S. designers following the September meetings.

roywiggins 8y ago
> Two delegates told WikiTribune that the opposition to adding these algorithms was led by Dr. Tomer Ashur from KU Leuven University, representing the Belgian delegation and it was supported by a large group of countries. Those pesky Belgians!
- vcpnt51 8y ago
  https://en.wikipedia.org/wiki/Ashur https://en.wikipedia.org/wiki/Ashur He's also been working against the US national interests before: http://www.cs.technion.ac.il/~biham/Workshops/Cryptoday/2015/Slides/ashur-presentation.pdf http://www.cs.technion.ac.il/~biham/Workshops/Cryptoday/2015...
  - klez 8y ago
    Linking to a Wikipedia article about a biblical figure helps how, in this context?
    - icebraining 8y ago
      He points out that one is Israeli and the other has a surname of Hebrew origins. I'm no dog, but even I can hear that whistling.
      - klez 8y ago
        I didn't want to imply anything, but I too thought that was the point. Also, seeing the overall good treatment the US reserve for Israel I'm always surprised when someone implies that Israel wants to damage the US.

phigcch 8y ago

Better article from April when this story first broke. https://www.theregister.co.uk/2018/04/25/nsa_iot_encryption/ https://www.theregister.co.uk/2018/04/25/nsa_iot_encryption/ The standardization of Simon and Speck has been an ongoing fight within ISO/IEC JTC1 SC27 WG2 since 2014 or so, but looks like it's finally game over for now.

tptacek 8y ago
That's not a great article. In reality, nobody thinks Speck and Simon are backdoored --- they're extremely straightforward block cipher designs with well-understood components. Unless the NSA knows something that breaks all modern block cipher designs --- in which case, why tip your hand? --- there's no place to hide a backdoor in either of these standards. What happened here seems like a combination of two things: first, a general statement that the community is skeptical of NSA-related standards after the Dual EC fiasco, just on principles, and, second, process concerns about the way NSA interacts with standards bodies --- their work is considered poorly documented and their engagement with the academic research community (for instance, to answer concerns about flaws in their designs) is poor.
- baby 8y ago
  I don't see why would any Non-American company would accept any of their thoughts/designs after their sneaky backdoor prng.
  - CiPHPerCoder 8y ago
    They shouldn't, but at the same time, these non-American companies should at least be honest about why they're rejecting the NSA's thoughts/designs rather than hype up some vapid fear of a backdoor. Slap NSA's hand for being abusive to the privacy of everyone, including their own citizens? We need more of that.
  - tedunangst 8y ago
    The back door prng wasn't all that sneaky? I would assess "don't look behind the curtain" and "nothing up my sleeves because I'm not wearing sleeves" quite differently.

AdmiralAsshat 8y ago

Key point: >According to WikiTribune’s source, experts in the delegations have clashed over recent weeks and the NSA has not provided the technical detail on the algorithms that is usual for these processes. The U.S. delegation’s refusal to provide a “convincing design rationale is a main concern for many countries,” the source said. So it's not just "We don't trust anything the NSA puts out." It's "The NSA is refusing to explain their algorithms in lieu of saying 'Trust us,' and we don't."

vertexFarm 8y ago
It's like a burglar offering to change your locks. And promising he doesn't have a copy of the key. But you aren't allowed to check. Just trust him.
- akvadrako 8y ago
  On the other hand, an honest burglar is probably the most reliable source for all the known exploits and can judge a good lock when they see it.
  - executesorder66 8y ago
    Yes, but the NSA is hardly honest.
imglorp 8y ago
They brought this on themselves. The root problem is they have two conflicting missions: one is to help USA secure itself and the other is to read all comms worldwide.
- fjsolwmv 8y ago
  The way it's supposed to work is that they try to have the best code cracking, and then they want everyone to use the second best codes so no one else can crack code. If they aren't the best the plan can't work and you get junk like clipper chip or whatever it was called.

olfactory 8y ago

When we think about what actually matters when it comes to institutions (public or private) one very important thing is trust. The NSA has eroded much of the trust it once had. This reduces its effectiveness as an organization and puts all Americans and American companies at increased risk. Those who committed the crimes revealed by Snowden should be brought to justice, the program dismantled, the hardware auctioned off, and the money returned to taxpayers. One does not have to be a privacy zealot or an anarchist to believe that the NSA should act within the law.

pdimitar 8y ago
> puts all Americans and American companies at increased risk. Both yes and no. No, because many startups are just looking for the shortest path to market and that means they absolutely will go for US cloud storage and computing if it best serves their initial business plans. Yes, because there are many ethical businesses (albeit smaller) -- and also in light with the GDPR -- who have a clear business model that doesn't involve selling personally identifiable information. And they now would go an extra mile to ensure they don't use USA-hosted services. I know business owners who did this and I'd do it as well if I was one. Post Snowden there were a lot of companies offering secure email hosting in Europe. Not sure if that really amounted to a big loss for the USA email hosting market though. Many people are too dependent on Gmail to ever replace it, for example.

trisimix 8y ago

The NSA has lost an insane amount of credibility for acting like a three letter agency instead of a security administration. Turns out its pretty hard to be both.

jaboutboul 8y ago

I see the tin foil hats are out in full swing, but the reality is, far from what people assume. From someone who has been following this saga, this is more a fight about how the NSA cooperates (or lack thereof) with ISO and other standards orgs. Most likely due to their own internal self-conflict. As others have mentioned Simon and Speck very straightforward. There really isn't much room for obscuring anything there. On the other hand, when any group that's a part of a standards org begins to feel so privileged that they can operate under their own rules and without truly cooperating with the others and share information in the way that people are asking for it, it's going to breed further mistrust given the already tense environment due to the history there.

nebulous1 8y ago
I don't know anything of the technical details of Simon and Speck, but distrusting the NSA hardly entails a tinfoil hat.
- tptacek 8y ago
  "Distrusting" one of the simplest "mainstream" ARX ciphers entails a little bit of tin foil. That's not really why ISO isn't moving forward with them.
  - xansi 8y ago
    That seems to be exactly why ISO isn't moving forward, or at least has been in the past. https://www.reuters.com/article/us-cyber-standards-insight/distrustful-u-s-allies-force-spy-agency-to-back-down-in-encryption-fight-idUSKCN1BW0GV https://www.reuters.com/article/us-cyber-standards-insight/d...
    - tptacek 8y ago
      Distrust of the NSA has cost it the deference it was given by academic cryptographers to basically ignore the process norms of public crypto standards. That's not the same as saying the academic cryptography community distrusts a simple ARX design.

peterwwillis 8y ago

Unrelated: Has anyone ever not clicked on the "this site uses cookies" button on any website since they started being introduced? Does anyone even look at them before clicking them?

deleted 8y ago
[deleted]
matheusmoreira 8y ago
That button is just a CYA measure. The idea seems to prevent users from claiming they didn't know they were being monitored. It solves nothing and gives users absolutely no control over tracking behavior. I doubt web sites wait for the user's decision to "accept" the use of cookies: since they normally travel via HTTP headers, they would already be in the browser's cookie jar before the page even rendered.

spadros 8y ago

The NSA trying to propose an encryption plan is like letting wolves decide how to secure sheep. Total conflict of interest, especially after Snowden.

segmondy 8y ago
But isn't it the same argument that if you wish to secure your system you really need to get a whitehat hacker. NSA looks at herself in the same light as a whitehat.
- colordrops 8y ago
  No one else but the NSA sees the NSA as whitehats.
  - stochastic_monk 8y ago
    Nation-State Adversary is my favorite backronym for NSA.
- spadros 8y ago
  Yeah, the NSA's trust is down the drain. I wouldn't call them whitehat. Huge conflict of interest to accept anything they propose.
- dragonwriter 8y ago
  The NSA are overtly, by a central part of their official mission, black hats, not white hats. If US federal defensive cybersecurity (especially on cryptographic matters) is going to have credibility in its recommendations outside of the US government, especially given the long history of the NSA compromising defensive recommendations in service of its offensive mission, it needs to be both visibly and effectively distanced from the signals intelligence mission of NSA/CSS.
- monochromatic 8y ago
  Hiring a whitehat is one thing. The NSA is gray at best.

Jerry2 8y ago

What's also interesting is how the NSA admonished and personally attacked three cryptographers (including Daniel J. Bernstein aka djb) and called them incompetent: >the NSA's behavior was outrageously adversarial to the process. They refused to motivate design choices they made such as the choice of matrices U, V, and W in Simon's key schedule. Instead, they chose to personally attack some of the experts (including @hashbreaker, Orr Dunkelman and myself) as incompetent. >This is yet another example as to how the NSA's surveillance program is bad for global security. If they had been more trustworthy, or at least more cooperative, different alliances would have probably been formed. But instead, they chose to try to bully their way into the standards which almost worked but eventually backfired. Rest: https://twitter.com/TomerAshur/status/988696306674630656 https://twitter.com/TomerAshur/status/988696306674630656

metalliqaz 8y ago
I wonder how they personally attacked those experts. Was it public?
- tptacek 8y ago
  "Personal attack" is a pretty big stretch here. The NSA is generally dismissive of academic cryptographers, and was dismissive here.
  - metalliqaz 8y ago
    Okay that's what the article says but the tweets specifically say that they attacked the credibility of some very well respected security experts
    - tptacek 8y ago
      If they're talking about what I think they're talking about, they're referring to a technical argument in which pretty much everyone was dismissive. It was still more civil than a typical HN thread, which is in turn more civil than a typical Reddit thread, which in turn is... my point being: outrageous personal attack is a bit of a stretch.

DINKDINK 8y ago

Remember, the S in IoT is for security.

garmaine 8y ago
IoOPT — the Internet of Other People’s Thjngs.

whois 8y ago

So happy to see a Wiki Tribune link here. I think the project is super cool, I hope it stays around.

mysterypie 8y ago

Does anyone who's been following these IoT encryption standards think that new algorithms are truly needed? Considering that even the most trivial embedded devices these days get powerful microcontrollers and megabytes of RAM -- often running a full operating system! -- is there any perceptible gain with one of these unknown lightweight algorithms compared to using a well-known and standard algorithm like AES? I took a look at the performance tests of AES vs NSA's Simon/Speck done by the CryptoLUX group at the University of Luxembourg[1]. They have so much data comparing different scenarios, processors, and implementation versions that it's difficult to summarize the trade-offs. But my brief look at AES vs Simon/Speck on an 8-bit Atmel AVR processor is that the difference in code size and RAM are in the hundreds of bytes (bytes, not megabytes) and AES performance might be approximately equal (if AES is implemented with large code size and RAM) or up to 10-15 times slower (if implemented with small code size and RAM). Seriously, embedded software these days is so bloated (just like in web development), and processors and RAM are so over-provisioned, and encryption is such a minuscule part of the tasks of a system that I wonder if using a standard algorithm like AES would make a perceptible difference to anybody. [1] https://www.cryptolux.org/index.php/FELICS_Block_Ciphers_Detailed_Results#AVR https://www.cryptolux.org/index.php/FELICS_Block_Ciphers_Det...

metalliqaz 8y ago
hundreds of bytes is a lot on AVRs. 1 millisecond is a lot on AVRs. I'd have to go look at their data myself, because AES is slow even compared to ChaCha20, and these algorithms are significantly more lightweight than that.
- setquk 8y ago
  Why the hell would you use an AVR when there are better resourced and faster ARM cores for the same power drain.
  - metalliqaz 8y ago
    Perhaps there are now, but these algorithms were developed several years ago. Also AVRs are cheap and very easy to use due to their simplicity.

BroadcastSunny 8y ago

My problem with this link is that anyone can edit it and it looks like anyone can be an author on the site, so I question the validity of the article.

pritambaral 8y ago
Interesting. Do you also mistrust Wikipedia? Besides, it is not like every reputed journalist these days maintains basic journalistic standards or integrity. Case in point, article by Reuters from two days ago: https://news.ycombinator.com/item?id=17057700 https://news.ycombinator.com/item?id=17057700
- BroadcastSunny 8y ago
  The schools won't allow my kids to use Wikipedia as a source - so yeah. (this is despite the fact that Wikipedia got more strict with allowing people to comment and that they require references) You're just mad I didn't trust your article
  - pritambaral 8y ago
    > The schools won't allow my kids to use Wikipedia as a source Would they allow your kids to use Wikipedia's own sources — as long as they're legitimate — as their sources? I do not trust traditional journalism as a source either (unlike Wikipedia and most schools). I try to find their sources; and when I can't, I regard it with suspicion. > You're just mad I didn't trust your article. This is either incredibly childish or too subtly tongue-in-cheek for me. Neither is the article "mine" in any way, nor was I "mad". I was genuinely curious.

codedokode 8y ago

Encryption scheme choice doesn't mean much if the devices send all the data to US-controlled "clouds". NSA will be able to read everything anyway.

saagarjha 8y ago
If your encryption is strong and end-to-end, it doesn't matter where your data goes.
- codedokode 8y ago
  It does matter. Because there are many people who have access to the servers and they can cooperate with government agencies voluntarily or involuntarily. For example, if you use "voice assistant" from some major company, what prevents it from voluntarily sharing all the records with the government for the sake of national security? What prevents its employee from secretly sharing the data under some legal obligations? The location of the server is really important here.
  - m3rc 8y ago
    The point of E2E is that it doesn't matter who owns the server. "End to End" means end to end, not 'end to middle then decrypted then to end'. If it's ever decrypted anywhere but an endpoint it's not E2E, by definition.
    - mc808 8y ago
      In the voice assistant example, the server is one of the endpoints. The point they're making is that E2E doesn't really help there if you can't be sure who is looking over shoulders on the other end. If the two ends are both under your control or scrutiny, then it doesn't matter who's hiding in the clouds... Except for metadata of course.
    - codedokode 8y ago
      Typical IoT device usually talks to the server where all the received data are often stored for futured use. If they used E2E, server wouldn't be necessary - it would make more sense to connect directly inside home WiFi network for example.

jchook 8y ago

Don’t cryptographers still have concerns about an AES backdoor?

tptacek 8y ago
No.

clarkmoody 8y ago

This is the first WikiTribune story I've personally noticed on HN. The story is not as juicy as the headline makes it out to be, but it's good to see WikiTribune as a source of news nonetheless. I'm excited to see more from this site in the future.

akvadrako 8y ago
Do you read WikiTribune? I am always hoping to find better sources of news, but it doesn't appeal to me enough to try.
- clarkmoody 8y ago
  Not at the moment. I'll give it a shot though and see how things go.
severine 8y ago
This is the first story that's got traction, apart from the meta-stories: https://news.ycombinator.com/from?site=wikitribune.com https://news.ycombinator.com/from?site=wikitribune.com

slededit 8y ago

This is what a loss of soft power looks like. The US has burned its reputation and is loosing influence in all areas of the world.

Drdrdrq 8y ago

Well, I doubt NSA are stupid. The question is more what their plan is to get the standards they want to be accepted. Maybe by exposing themselves and thus creating a better chance for secret allies? We'll need to wait for the next Snowden to find out I guess, if ever.

mabbo 8y ago

Here's a weird/fun thought: what if the NSA was trying to lose? This is the NSA. They're no fools. And they know that no one is going to trust them, especially if they try to bully their way and not reveal details. What if the next-best competitor for this encryption is actually something they've broken? Could be that they got clever and lucky and figured it out, could be that they planted it with someone secretly working for the NSA. Then it would be in their interest to loudly lose in such a way that the standards committee picks the secretly-broken encryption rather than the one the NSA was pushing. Fun tinfoil hat ideas, naturally, but it would sure make a better story than the NSA trying to backdoor an encryption standard again.

elago 8y ago
Why would they do that rather than just not submit anything and let the already broken next-best competitor win?
- Tepix 8y ago
  Where's the conspiracy theory then?

anfilt 8y ago

I find this kinda sad since both speck and simon are really nice algorithms. The analysis that has been done also shows that seem secure. Moreover, they are simple I have made several implementations, and one that runs simon on a FPGA. It honestly would be hard to sneak a back door in my opinion. Also keep this in mind the US government also wants to use these algorithms. Why would they use a broken symmetric cipher?

sunstone 8y ago

Some more suspicious elliptic curves no doubt.