The cryptographic community used to have a lot of trust in the NSA, and that trust was well-deserved. One of the most well-known contributions was improving the

The cryptographic community used to have a lot of trust in the NSA, and that trust was well-deserved. One of the most well-known contributions was improving the resistance of DES to differential analysis, which hadn’t even been discovered in the academic world yet. The NSA recommended an S-Box change, and provided next to no rationale for doing so. Only years later did we understand why. Recommendations from the NSA find their way into standards that are implemented by the government itself, and that is one of the reasons the community trusted the NSA to a degree. It wasn’t seen as being in their long-term self-interest to insert backdoors that others could find into their standards. Obviously that trust was wiped out by the DUAL_EC_DRBG debacle, although many cryptographers still believe it’s worthwhile to analyze and consider NSA ciphers on their own merits just as you would a cipher by DJB. In my personal opinion, as a general rule, I would wager that symmetric ciphers published by them can be reasonably assumed to be free of back doors, since there’s fewer degrees of freedom to insert them except through real cryptographic weaknesses which others could independently discover. Asymmetric algorithms probably shouldn’t be given this benefit of the doubt, since there are enough degrees of freedom to be possible to have a private master key of sorts (e.g., DUAL_EC_DRBG) which isn’t be able to be discovered independently and can only be revealed if it’s stolen directly.