> DES ... it was never a NOBUS backdoor in NSA's own design > Second, you can't argue that something is an NSA backdoor when NSA's only role in standardizing c

> DES ... it was never a NOBUS backdoor in NSA's own design > Second, you can't argue that something is an NSA backdoor when NSA's only role in standardizing crypto relative to it is to make the standard resistant to it. I'm not suggesting there was a backdoor in DES; I probably should have made that clearer. > at the time differential was a NOBUS weakness Exactly, this is what I'm talking about. This would (hypothetically) incentivise them encourage the use of designs that are vulnerable to the cryptanalysis method that only they know about. > Dual EC is still a NOBUS backdoor. The "nobody but us" part of it is ensured cryptographically; breaking it likely involves solving the ECDLP The fundamental problem with that type of NOBUS backdoor is that breaks when someone steals/blackmails/leaks the private key. This should be a concern to any agency that already experienced many of their secrets being exfiltrated by a contractor. edit: > (I think people generally used to assume that was true and I think that's less and less so every year) I generally agree - this seems unlikely in practice, although I don't have good evidence for that belief.