5 ms·

> But NSA doesn't want arbitrary weaknesses; it wants NOBUS backdoors The NSA's handling[1] of differential cryptanalysis suggests they could consider an entir

by pdkl95 8y ago

> But NSA doesn't want arbitrary weaknesses; it wants NOBUS backdoors The NSA's handling[1] of differential cryptanalysis suggests they could consider an entire analysis technique to be (pseudo-)NOBUS. If they believed they were the only people that knew of a new cryptanalysis technique, I could see them recommending a cypher that is weak to it. (This is only a hypothetical concern. I have not studied the specifics of Speck/Simon) [1] Don Coppersmith, in his 1994 paper[2]: "After discussions with NSA, it was decided that disclosure of the design considerations would reveal the technique of differential cryptanalysis, a powerful technique that could be used against many ciphers. This in turn would weaken the competitive advantage the United States enjoyed over other countries in the field of cryptography." [2] (pdf) http://simson.net/ref/1994/coppersmith94.pdf http://simson.net/ref/1994/coppersmith94.pdf

tedunangst 8y ago
But didn't they do the exact opposite, and strengthen DES against the attack?
- namibj 8y ago
  But they did not say why they wanted the S-Boxes changed.
  - lvh 8y ago
    That makes sense even if you assume the NSA is adhering to its mission: if you don't publicly disclose the existence of differential cryptanalysis and the enemy hasn't figured it out the enemy may standardize on a weak cipher. The NSA wins in both of its missions: make the US more secure, make everyone else less secure.
tptacek 8y ago
This argument doesn't work. The NSA is pretty universally believed to have optimized the DES s-boxes for resistance to differential cryptanalysis. Obviously, at the time differential was a NOBUS weakness --- NSA would have deployed it against competing cipher designs, which is sort of the whole point of employing cryptanalysts in the first place --- but it was never a NOBUS backdoor in NSA's own design.
- notveryrational 8y ago
  I don't think you understood the argument above. My attempt to clarify it as I understood it: The argument is that a unique-to-NSA analysis technique could be used to get NOBUS backdoor by virtue that only NSA would be able to use the analysis to get key/message recovery, etc. This is especially true if such a technique were combined with a unique-to-NSA ability to store or process characteristics of a cipher. The NSA likely has both a unique cryptanalytic techniques and a considerable computational advantage. The NSA has, before, refused to disclose the motivation for its designs because doing so could leak a unique-to-NSA analysis technique. The argument (not fact) of the parent comment is that this could be the reason for NSA not disclosing its design rationale now. It could be a backdoor. The entire purpose of the parent comment is to convey that it is conceivable to NOBUS backdoor simple symmetric ciphers with the resources of the NSA. As such, it is an appropriate response and an argument that _does_ work. Side note: I remember (different username at the time) discussing with you here, on hacker news, whether DUAL_EC was a backdoor. Of course, that doesn't mean that there is a backdoor in this case.
  - tptacek 8y ago
    I understand the argument fine; it just doesn't cohere. First, it's self-evident that differential cryptanalysis is not a good example of a NOBUS backdoor, since it was independently discovered multiple times, including by a pair of academics. By contrast, even after BULLRUN, Dual EC is still a NOBUS backdoor. The "nobody but us" part of it is ensured cryptographically; breaking it likely involves solving the ECDLP. It's not "nobody but us until somebody figures it out". Second, you can't argue that something is an NSA backdoor when NSA's only role in standardizing crypto relative to it is to make the standard resistant to it. Once again: the NSA may well have many cryptanalytic techniques unknown to the academic literature (I think people generally used to assume that was true and I think that's less and less so every year). But a NOBUS backdoor isn't simply a cipher that NSA can break and nobody else can break yet. It's a cipher that the NSA can break and cannot foresee any adversary breaking within the frontiers of its own knowledge. Whatever cryptanalytic techniques NSA can discover, so too can the Russians, Israelis, French, and Chinese. The point of a NOBUS backdoor is that it's safe to deploy on your own systems.
notveryrational 8y ago
That's a great point. In addition, NSA has not only unique analytical techniques but also unique number-crunching capabilities. The combination of these allow it to design ciphers that can be broken by NSA but not by adversaries. The author made mention of this specifically in the link: had his university had additional hardware, he is confident that more rounds would easily be broken.

by pdkl95 8y ago

tedunangst 8y ago

But didn't they do the exact opposite, and strengthen DES against the attack?

namibj 8y ago
But they did not say why they wanted the S-Boxes changed.
- lvh 8y ago
  That makes sense even if you assume the NSA is adhering to its mission: if you don't publicly disclose the existence of differential cryptanalysis and the enemy hasn't figured it out the enemy may standardize on a weak cipher. The NSA wins in both of its missions: make the US more secure, make everyone else less secure.

tptacek 8y ago

This argument doesn't work. The NSA is pretty universally believed to have optimized the DES s-boxes for resistance to differential cryptanalysis. Obviously, at the time differential was a NOBUS weakness --- NSA would have deployed it against competing cipher designs, which is sort of the whole point of employing cryptanalysts in the first place --- but it was never a NOBUS backdoor in NSA's own design.

notveryrational 8y ago
I don't think you understood the argument above. My attempt to clarify it as I understood it: The argument is that a unique-to-NSA analysis technique could be used to get NOBUS backdoor by virtue that only NSA would be able to use the analysis to get key/message recovery, etc. This is especially true if such a technique were combined with a unique-to-NSA ability to store or process characteristics of a cipher. The NSA likely has both a unique cryptanalytic techniques and a considerable computational advantage. The NSA has, before, refused to disclose the motivation for its designs because doing so could leak a unique-to-NSA analysis technique. The argument (not fact) of the parent comment is that this could be the reason for NSA not disclosing its design rationale now. It could be a backdoor. The entire purpose of the parent comment is to convey that it is conceivable to NOBUS backdoor simple symmetric ciphers with the resources of the NSA. As such, it is an appropriate response and an argument that _does_ work. Side note: I remember (different username at the time) discussing with you here, on hacker news, whether DUAL_EC was a backdoor. Of course, that doesn't mean that there is a backdoor in this case.
- tptacek 8y ago
  I understand the argument fine; it just doesn't cohere. First, it's self-evident that differential cryptanalysis is not a good example of a NOBUS backdoor, since it was independently discovered multiple times, including by a pair of academics. By contrast, even after BULLRUN, Dual EC is still a NOBUS backdoor. The "nobody but us" part of it is ensured cryptographically; breaking it likely involves solving the ECDLP. It's not "nobody but us until somebody figures it out". Second, you can't argue that something is an NSA backdoor when NSA's only role in standardizing crypto relative to it is to make the standard resistant to it. Once again: the NSA may well have many cryptanalytic techniques unknown to the academic literature (I think people generally used to assume that was true and I think that's less and less so every year). But a NOBUS backdoor isn't simply a cipher that NSA can break and nobody else can break yet. It's a cipher that the NSA can break and cannot foresee any adversary breaking within the frontiers of its own knowledge. Whatever cryptanalytic techniques NSA can discover, so too can the Russians, Israelis, French, and Chinese. The point of a NOBUS backdoor is that it's safe to deploy on your own systems.

notveryrational 8y ago

That's a great point. In addition, NSA has not only unique analytical techniques but also unique number-crunching capabilities. The combination of these allow it to design ciphers that can be broken by NSA but not by adversaries. The author made mention of this specifically in the link: had his university had additional hardware, he is confident that more rounds would easily be broken.