7 ms·

Key point: >According to WikiTribune’s source, experts in the delegations have clashed over recent weeks and the NSA has not provided the technical detail on t

Key point: >According to WikiTribune’s source, experts in the delegations have clashed over recent weeks and the NSA has not provided the technical detail on the algorithms that is usual for these processes. The U.S. delegation’s refusal to provide a “convincing design rationale is a main concern for many countries,” the source said. So it's not just "We don't trust anything the NSA puts out." It's "The NSA is refusing to explain their algorithms in lieu of saying 'Trust us,' and we don't."

vertexFarm 8y ago
It's like a burglar offering to change your locks. And promising he doesn't have a copy of the key. But you aren't allowed to check. Just trust him.
- akvadrako 8y ago
  On the other hand, an honest burglar is probably the most reliable source for all the known exploits and can judge a good lock when they see it.
  - executesorder66 8y ago
    Yes, but the NSA is hardly honest.
imglorp 8y ago
They brought this on themselves. The root problem is they have two conflicting missions: one is to help USA secure itself and the other is to read all comms worldwide.
- fjsolwmv 8y ago
  The way it's supposed to work is that they try to have the best code cracking, and then they want everyone to use the second best codes so no one else can crack code. If they aren't the best the plan can't work and you get junk like clipper chip or whatever it was called.
  - bluGill 8y ago
    IT is a little more complex than that - they need to also figure out what codes the US government uses for classified secrets that we don't won't other countries to find. It is not clear how they resolve the inherent conflict in these goals.
    - rocqua 8y ago
      For these ciphers, it seems less likely that NSA has a backdoor that no-one else could find. Notably in the case of dual-EC there was a recommended curve chosen by the NSA. That was easy to backdoor by knowing how the curve was generated.
      - tptacek 8y ago
        More importantly, pretty much the whole point of a PKRNG is to make the random state recoverable. It's not as if competing RNGs have designs that enable the kind of backdoor Dual EC does. That's what was so weird about it, and why there was some doubt about what it was --- not doubt that people should use Dual EC (of course they shouldn't, and it's been amazing to see companies like RSA and Juniper actually adopt it; the cryptographic incompetence behind those decisions was shocking), but that NSA could really be using such blatantly awful tradecraft.
  - vertexFarm 8y ago
    Anyone who falls for this kind of reasoning is incredibly naive. If you ever hear that somebody has a plan to have the best offense and make sure that everyone else has the second-best defense so they're the only ones who can do something bad, the first thing that should come to your mind is that they are planning to do something bad. It's not an "will they" situation. It's a "can they" situation. If they have the capability, they will do it. That is a terrible plan. And don't tell me that they are on our side so it's okay. Secretive, crypto-state actors are on their own side. Ask yourself: if this power eventually falls under the unilateral control of the executive branch, will that always be a good thing under any conceivable future administration? Believing the justifications is extremely dangerous.
tptacek 8y ago
It's worth bearing in mind that the documentation issues here are basically process concerns more than they are substantive concerns. Both Simon and Speck are straightforward designs. Cryptographers are capable of evaluating a deliberately-simple lightweight ARX cipher! But in real standards competitions, academic cryptographers bundle their designs with rationale essays and point-by-point explanations of how the designer mitigated attacks, like differential and linear trails. Standards groups didn't get that from NSA, and when academic cryptographers poked at the ciphers and asked questions about linear trails, the NSA designers got standoffish. I think there's a subtext to all of this where the NSA is dismissive of, well, basically all academic cryptanalytic work. The converse of that, of academics and the NSA, didn't (I think?) used to be true, but might gradually be taking this shape, so that the two groups are just mutually dismissive of each other. So, where in the past the NSA got some deference that enabled them to submit standards proposals that didn't follow process, now the opposite is true, and academic cryptographers expect deference. It's no tragedy. NSA brought this on themselves, and really, what we're "losing" here is kind of a marginal design anyways, right? (I write this in the hopes that someone better connected to these issues will correct me on lots of it!)
- wahern 8y ago
  Speck and Simon have the benefit of simplicity. Like RC4, Speck could even be memorized. It's like 30 years of block cipher design has been condensed into the smallest possible algorithm. Simplicity is useful. I've seen on multiple occasions bugs in more complex algorithms, like ChaCha20. Test vectors don't help as much--or at all--when you're creating a bespoke CSPRNG as in the OpenBSD and Linux kernels that repurposes the core round functions. Moreover, if we're talking about backdoors, then code complexity--even just sheer number of lines of code--is the spy's friend. For more complex algorithms it would be more practical to trojan COTS and FOSS software to, e.g., substitute an operation so you'd still get the same logical output but lose side-channel resistance. I'm not an EE, but assuming all the standard reviews happen, I'd much prefer that hardware vendors use something like Simon. Hardware acceleration is the very definition of a blackbox. Hardware developers can copy+paste+munge as well as any software programmer, but there's rarely any subsequent external review. The value of simplicity just can't be overestimated here. Because hardware products lack the extra layers of transparent, open review, we really want to minimize the potential for accidental screwups. The simpler the algorithm, the fewer degrees of freedom they have to be creative. The smaller block size and smaller key size profiles were dubious, but that's a judgment call. The NSA probably sees so much bad crypto out there that the Simon & Speck designers could have earnestly considered them a step up. Note that the debate about these weaker profiles was never about choosing them over some stronger algorithm. Rather, the alternative argument was that if a hardware design was so low-power and so low-bandwidth that those profiles were useful, it would be better to not have any crypto at all so nobody would have a false sense of security. From an engineering perspective I think most would agree with the latter; but as a practical matter commercial vendors no doubt will sell half-baked crypto in such tiny devices, and without a known quantity we'll probably be worse off. In any event, those weaker profiles have already been ceded. Assuming the algorithms continue to hold up to review, I think it would be a net loss to lose Simon & Speck. And, frankly, I'm more suspicious of the motivations of, e.g., Chinese and Russian security services. As for why the NSA designers haven't been cooperating as much as the community has desired, it's anybody's guess. AFAIU, these designs were something of a 20% project for these engineers and they're probably not getting much support from management for pushing these designs. I don't even think they work in one of the departments these designs normally come from; IIRC they've claimed they tossed it over the fence to one of those secret departments and got a thumbs up. But who knows. And it shouldn't matter, especially for something so simple. All evidence suggests that the NSA no longer possesses extraordinary skill when it comes to cipher and hash design, so provenance shouldn't color anyone's judgment. Academic and private industry designers can and have worked for security services, too.
stevew20 8y ago
Though, the NSA did lose the keys to their van full of fun toys to the Shadow Brokers just a couple years ago. In my mind that adds 'incompetent' right there next to 'evil/criminal' on the list of reasons they are untrustworthy.
- imglorp 8y ago
  I think that speaks more to the vastly more difficult task of playing defense than offense. There's a great dad joke that relates: if you have a boy, you only have to worry about one little prick, but if you have a girl, you have to worry about all the little pricks out there.
  - mirimir 8y ago
    One could reverse genders in that joke, but many would call that version sexist ;) And both versions are, in truth.
maxlybbert 8y ago
I don’t know anything about how the NSA interacted with ISO, but it is worth mentioning that the NSA has material explaining these ciphers: * https://csrc.nist.gov/csrc/media/events/lightweight-cryptography-workshop-2015/documents/papers/session1-shors-paper.pdf https://csrc.nist.gov/csrc/media/events/lightweight-cryptogr... * https://eprint.iacr.org/2017/560.pdf https://eprint.iacr.org/2017/560.pdf * https://www.nist.gov/sites/default/files/documents/2016/10/18/wingers-presentation-lwc2016.pdf https://www.nist.gov/sites/default/files/documents/2016/10/1... Those include statements about how far cryptanalysis have weakened the ciphers, which the NSA claims was roughly what they had expected during design. If the NSA published its own cryptanalysis, would you believe it, or would you assume they had told less than the whole story? What if they paid an academic to publish cryptanalysis (“of course he would say that, he was paid $X by the NSA!”)? The NSA appears to be in a catch-22 here.
- marricks 8y ago
  I think when someone like the NSA provides you an algo you either decide you can’t trust them or need to ask some heavy hitting questions to make sure it’s not broken somewhere along the line for their benefit. I’d opt for not trusting them, but even if they did provide some details elsewhere I’d imagine ISO had some questions the NSA didn’t feel like answering...
  - tajen 8y ago
    But we can also assume that everyone else working in security has their own other bias: Chinese and Russian services must be at work too.
  - garmaine 8y ago
    The nice thing about mathematics is that truth and falsity doesn’t derive from trust or authority.
jonathanstrange 8y ago
However, Speck is out in the open, the specification is public. It's surprisingly simple to implement. Too simple, as some cryptographers would say...

vertexFarm 8y ago

It's like a burglar offering to change your locks. And promising he doesn't have a copy of the key. But you aren't allowed to check. Just trust him.

akvadrako 8y ago
On the other hand, an honest burglar is probably the most reliable source for all the known exploits and can judge a good lock when they see it.
- executesorder66 8y ago
  Yes, but the NSA is hardly honest.

imglorp 8y ago

They brought this on themselves. The root problem is they have two conflicting missions: one is to help USA secure itself and the other is to read all comms worldwide.

fjsolwmv 8y ago
The way it's supposed to work is that they try to have the best code cracking, and then they want everyone to use the second best codes so no one else can crack code. If they aren't the best the plan can't work and you get junk like clipper chip or whatever it was called.
- bluGill 8y ago
  IT is a little more complex than that - they need to also figure out what codes the US government uses for classified secrets that we don't won't other countries to find. It is not clear how they resolve the inherent conflict in these goals.
  - rocqua 8y ago
    For these ciphers, it seems less likely that NSA has a backdoor that no-one else could find. Notably in the case of dual-EC there was a recommended curve chosen by the NSA. That was easy to backdoor by knowing how the curve was generated.
    - tptacek 8y ago
      More importantly, pretty much the whole point of a PKRNG is to make the random state recoverable. It's not as if competing RNGs have designs that enable the kind of backdoor Dual EC does. That's what was so weird about it, and why there was some doubt about what it was --- not doubt that people should use Dual EC (of course they shouldn't, and it's been amazing to see companies like RSA and Juniper actually adopt it; the cryptographic incompetence behind those decisions was shocking), but that NSA could really be using such blatantly awful tradecraft.
- vertexFarm 8y ago
  Anyone who falls for this kind of reasoning is incredibly naive. If you ever hear that somebody has a plan to have the best offense and make sure that everyone else has the second-best defense so they're the only ones who can do something bad, the first thing that should come to your mind is that they are planning to do something bad. It's not an "will they" situation. It's a "can they" situation. If they have the capability, they will do it. That is a terrible plan. And don't tell me that they are on our side so it's okay. Secretive, crypto-state actors are on their own side. Ask yourself: if this power eventually falls under the unilateral control of the executive branch, will that always be a good thing under any conceivable future administration? Believing the justifications is extremely dangerous.

tptacek 8y ago

It's worth bearing in mind that the documentation issues here are basically process concerns more than they are substantive concerns. Both Simon and Speck are straightforward designs. Cryptographers are capable of evaluating a deliberately-simple lightweight ARX cipher! But in real standards competitions, academic cryptographers bundle their designs with rationale essays and point-by-point explanations of how the designer mitigated attacks, like differential and linear trails. Standards groups didn't get that from NSA, and when academic cryptographers poked at the ciphers and asked questions about linear trails, the NSA designers got standoffish. I think there's a subtext to all of this where the NSA is dismissive of, well, basically all academic cryptanalytic work. The converse of that, of academics and the NSA, didn't (I think?) used to be true, but might gradually be taking this shape, so that the two groups are just mutually dismissive of each other. So, where in the past the NSA got some deference that enabled them to submit standards proposals that didn't follow process, now the opposite is true, and academic cryptographers expect deference. It's no tragedy. NSA brought this on themselves, and really, what we're "losing" here is kind of a marginal design anyways, right? (I write this in the hopes that someone better connected to these issues will correct me on lots of it!)

wahern 8y ago
Speck and Simon have the benefit of simplicity. Like RC4, Speck could even be memorized. It's like 30 years of block cipher design has been condensed into the smallest possible algorithm. Simplicity is useful. I've seen on multiple occasions bugs in more complex algorithms, like ChaCha20. Test vectors don't help as much--or at all--when you're creating a bespoke CSPRNG as in the OpenBSD and Linux kernels that repurposes the core round functions. Moreover, if we're talking about backdoors, then code complexity--even just sheer number of lines of code--is the spy's friend. For more complex algorithms it would be more practical to trojan COTS and FOSS software to, e.g., substitute an operation so you'd still get the same logical output but lose side-channel resistance. I'm not an EE, but assuming all the standard reviews happen, I'd much prefer that hardware vendors use something like Simon. Hardware acceleration is the very definition of a blackbox. Hardware developers can copy+paste+munge as well as any software programmer, but there's rarely any subsequent external review. The value of simplicity just can't be overestimated here. Because hardware products lack the extra layers of transparent, open review, we really want to minimize the potential for accidental screwups. The simpler the algorithm, the fewer degrees of freedom they have to be creative. The smaller block size and smaller key size profiles were dubious, but that's a judgment call. The NSA probably sees so much bad crypto out there that the Simon & Speck designers could have earnestly considered them a step up. Note that the debate about these weaker profiles was never about choosing them over some stronger algorithm. Rather, the alternative argument was that if a hardware design was so low-power and so low-bandwidth that those profiles were useful, it would be better to not have any crypto at all so nobody would have a false sense of security. From an engineering perspective I think most would agree with the latter; but as a practical matter commercial vendors no doubt will sell half-baked crypto in such tiny devices, and without a known quantity we'll probably be worse off. In any event, those weaker profiles have already been ceded. Assuming the algorithms continue to hold up to review, I think it would be a net loss to lose Simon & Speck. And, frankly, I'm more suspicious of the motivations of, e.g., Chinese and Russian security services. As for why the NSA designers haven't been cooperating as much as the community has desired, it's anybody's guess. AFAIU, these designs were something of a 20% project for these engineers and they're probably not getting much support from management for pushing these designs. I don't even think they work in one of the departments these designs normally come from; IIRC they've claimed they tossed it over the fence to one of those secret departments and got a thumbs up. But who knows. And it shouldn't matter, especially for something so simple. All evidence suggests that the NSA no longer possesses extraordinary skill when it comes to cipher and hash design, so provenance shouldn't color anyone's judgment. Academic and private industry designers can and have worked for security services, too.

stevew20 8y ago

Though, the NSA did lose the keys to their van full of fun toys to the Shadow Brokers just a couple years ago. In my mind that adds 'incompetent' right there next to 'evil/criminal' on the list of reasons they are untrustworthy.

imglorp 8y ago
I think that speaks more to the vastly more difficult task of playing defense than offense. There's a great dad joke that relates: if you have a boy, you only have to worry about one little prick, but if you have a girl, you have to worry about all the little pricks out there.
- mirimir 8y ago
  One could reverse genders in that joke, but many would call that version sexist ;) And both versions are, in truth.

maxlybbert 8y ago

I don’t know anything about how the NSA interacted with ISO, but it is worth mentioning that the NSA has material explaining these ciphers: * https://csrc.nist.gov/csrc/media/events/lightweight-cryptography-workshop-2015/documents/papers/session1-shors-paper.pdf https://csrc.nist.gov/csrc/media/events/lightweight-cryptogr... * https://eprint.iacr.org/2017/560.pdf https://eprint.iacr.org/2017/560.pdf * https://www.nist.gov/sites/default/files/documents/2016/10/18/wingers-presentation-lwc2016.pdf https://www.nist.gov/sites/default/files/documents/2016/10/1... Those include statements about how far cryptanalysis have weakened the ciphers, which the NSA claims was roughly what they had expected during design. If the NSA published its own cryptanalysis, would you believe it, or would you assume they had told less than the whole story? What if they paid an academic to publish cryptanalysis (“of course he would say that, he was paid $X by the NSA!”)? The NSA appears to be in a catch-22 here.

marricks 8y ago
I think when someone like the NSA provides you an algo you either decide you can’t trust them or need to ask some heavy hitting questions to make sure it’s not broken somewhere along the line for their benefit. I’d opt for not trusting them, but even if they did provide some details elsewhere I’d imagine ISO had some questions the NSA didn’t feel like answering...
- tajen 8y ago
  But we can also assume that everyone else working in security has their own other bias: Chinese and Russian services must be at work too.
- garmaine 8y ago
  The nice thing about mathematics is that truth and falsity doesn’t derive from trust or authority.

jonathanstrange 8y ago

However, Speck is out in the open, the specification is public. It's surprisingly simple to implement. Too simple, as some cryptographers would say...