4 ms·

I don't think you understood the argument above. My attempt to clarify it as I understood it: The argument is that a unique-to-NSA analysis technique could be

I don't think you understood the argument above. My attempt to clarify it as I understood it: The argument is that a unique-to-NSA analysis technique could be used to get NOBUS backdoor by virtue that only NSA would be able to use the analysis to get key/message recovery, etc. This is especially true if such a technique were combined with a unique-to-NSA ability to store or process characteristics of a cipher. The NSA likely has both a unique cryptanalytic techniques and a considerable computational advantage. The NSA has, before, refused to disclose the motivation for its designs because doing so could leak a unique-to-NSA analysis technique. The argument (not fact) of the parent comment is that this could be the reason for NSA not disclosing its design rationale now. It could be a backdoor. The entire purpose of the parent comment is to convey that it is conceivable to NOBUS backdoor simple symmetric ciphers with the resources of the NSA. As such, it is an appropriate response and an argument that _does_ work. Side note: I remember (different username at the time) discussing with you here, on hacker news, whether DUAL_EC was a backdoor. Of course, that doesn't mean that there is a backdoor in this case.

tptacek 8y ago
I understand the argument fine; it just doesn't cohere. First, it's self-evident that differential cryptanalysis is not a good example of a NOBUS backdoor, since it was independently discovered multiple times, including by a pair of academics. By contrast, even after BULLRUN, Dual EC is still a NOBUS backdoor. The "nobody but us" part of it is ensured cryptographically; breaking it likely involves solving the ECDLP. It's not "nobody but us until somebody figures it out". Second, you can't argue that something is an NSA backdoor when NSA's only role in standardizing crypto relative to it is to make the standard resistant to it. Once again: the NSA may well have many cryptanalytic techniques unknown to the academic literature (I think people generally used to assume that was true and I think that's less and less so every year). But a NOBUS backdoor isn't simply a cipher that NSA can break and nobody else can break yet. It's a cipher that the NSA can break and cannot foresee any adversary breaking within the frontiers of its own knowledge. Whatever cryptanalytic techniques NSA can discover, so too can the Russians, Israelis, French, and Chinese. The point of a NOBUS backdoor is that it's safe to deploy on your own systems.
- notveryrational 8y ago
  The NSA is a pragmatic organization and is concerned only by "nobody but us until somebody figures it out", so long as there is an operational advantage it provides to the United States. We should also note that "nobody but us until somebody figures it out" is true also of ECDLP. I'm not really interested in that argument, because we both know exactly where it goes. Is it different than symmetric cryptography? Yes. But we're talking about symmetric cryptography. > Second, you can't argue that something is an NSA backdoor when NSA's only role in standardizing crypto relative to it is to make the standard resistant to it. Nobody is. Yes, the NSA almost certainly has unique-to-NSA analytic techniques. New techniques are discovered in the academic community on a regular basis - they aren't rare in some way that it would be reasonable to believe that a professional community of the world's best cryptographers with their own cryptanalytic communities, working full time, would have discovered and honed their own. In fact, it would be pretty unusual to believe they don't. You misunderstand NOBUS. It's purely a pragmatic expression meaning advantage. NSA is under no illusions that their advantage in cryptography on every standard is going to last forever. Please don't spread FUD on NOBUS.
  - tptacek 8y ago
    I don't understand the distinction you're trying to draw between block ciphers and the ECLDP. Dual EC was an RNG, which is (among other things) an important symmetric primitive. I think the definition of NOBUS that you're working is the one that's broken, not mine. I also think you're overestimating the frequency with which powerful new techniques for attacking block ciphers occur in the literature. It's 2018 and the debate about Speck's security still hinged in part on Matsui. Fundamental new cryptanalytic techniques against block ciphers are, in fact, pretty rare.
    - notveryrational 8y ago
      > I don't understand the distinction you're trying to draw between block ciphers and the ECLDP. Dual EC was an RNG, which is (among other things) an important symmetric primitive. I think the definition of NOBUS that you're working is the one that's broken, not mine. I'm not sure where we'll get with it. I'm okay with your misunderstanding. Please ignore that part of the comment and read the remaining content. Please don't let an objection on a small part of the content distract you from the remaining content of the argument. > I also think you're overestimating the frequency with which powerful new techniques for attacking block ciphers occur in the literature. You are clearly underestimating the frequency. We both understand how heavily caveated your argument referencing Matsui is. My fear is that your misunderstanding and underestimation will lead to FUD about backdoors, like it did last time with DUAL_EC. It's also important to note that your argument has shifted significantly in this short exchange. NSA only cares about NOBUS weaknesses for operational and national security advantages. Thanks for your time.

tptacek 8y ago

I understand the argument fine; it just doesn't cohere. First, it's self-evident that differential cryptanalysis is not a good example of a NOBUS backdoor, since it was independently discovered multiple times, including by a pair of academics. By contrast, even after BULLRUN, Dual EC is still a NOBUS backdoor. The "nobody but us" part of it is ensured cryptographically; breaking it likely involves solving the ECDLP. It's not "nobody but us until somebody figures it out". Second, you can't argue that something is an NSA backdoor when NSA's only role in standardizing crypto relative to it is to make the standard resistant to it. Once again: the NSA may well have many cryptanalytic techniques unknown to the academic literature (I think people generally used to assume that was true and I think that's less and less so every year). But a NOBUS backdoor isn't simply a cipher that NSA can break and nobody else can break yet. It's a cipher that the NSA can break and cannot foresee any adversary breaking within the frontiers of its own knowledge. Whatever cryptanalytic techniques NSA can discover, so too can the Russians, Israelis, French, and Chinese. The point of a NOBUS backdoor is that it's safe to deploy on your own systems.

notveryrational 8y ago
The NSA is a pragmatic organization and is concerned only by "nobody but us until somebody figures it out", so long as there is an operational advantage it provides to the United States. We should also note that "nobody but us until somebody figures it out" is true also of ECDLP. I'm not really interested in that argument, because we both know exactly where it goes. Is it different than symmetric cryptography? Yes. But we're talking about symmetric cryptography. > Second, you can't argue that something is an NSA backdoor when NSA's only role in standardizing crypto relative to it is to make the standard resistant to it. Nobody is. Yes, the NSA almost certainly has unique-to-NSA analytic techniques. New techniques are discovered in the academic community on a regular basis - they aren't rare in some way that it would be reasonable to believe that a professional community of the world's best cryptographers with their own cryptanalytic communities, working full time, would have discovered and honed their own. In fact, it would be pretty unusual to believe they don't. You misunderstand NOBUS. It's purely a pragmatic expression meaning advantage. NSA is under no illusions that their advantage in cryptography on every standard is going to last forever. Please don't spread FUD on NOBUS.
- tptacek 8y ago
  I don't understand the distinction you're trying to draw between block ciphers and the ECLDP. Dual EC was an RNG, which is (among other things) an important symmetric primitive. I think the definition of NOBUS that you're working is the one that's broken, not mine. I also think you're overestimating the frequency with which powerful new techniques for attacking block ciphers occur in the literature. It's 2018 and the debate about Speck's security still hinged in part on Matsui. Fundamental new cryptanalytic techniques against block ciphers are, in fact, pretty rare.
  - notveryrational 8y ago
    > I don't understand the distinction you're trying to draw between block ciphers and the ECLDP. Dual EC was an RNG, which is (among other things) an important symmetric primitive. I think the definition of NOBUS that you're working is the one that's broken, not mine. I'm not sure where we'll get with it. I'm okay with your misunderstanding. Please ignore that part of the comment and read the remaining content. Please don't let an objection on a small part of the content distract you from the remaining content of the argument. > I also think you're overestimating the frequency with which powerful new techniques for attacking block ciphers occur in the literature. You are clearly underestimating the frequency. We both understand how heavily caveated your argument referencing Matsui is. My fear is that your misunderstanding and underestimation will lead to FUD about backdoors, like it did last time with DUAL_EC. It's also important to note that your argument has shifted significantly in this short exchange. NSA only cares about NOBUS weaknesses for operational and national security advantages. Thanks for your time.