4 ms·

> Sometimes even speck may be the right tool for the job. I disagree. Proliferation of very-likely-backdoored crypto is dangerous. By using it you're demonstra

> Sometimes even speck may be the right tool for the job. I disagree. Proliferation of very-likely-backdoored crypto is dangerous. By using it you're demonstrating that it is OK to use crap the NSA is pushing. If it gains in popularity, you'll have people trying to use it for sensitive communications, etc, without understanding why it is a terrible idea.

mistaken 8y ago
Even if it comes from the NSA it doesn't necessarily mean it's backdoored. Speck is a good algorithm for performance constrained devices. It was removed from the kernel since it couldn't be included into Android systems due to political reasons, and the authors of the module wrote an implementation of an alternative algorithm for this use-case.
- craftyguy 8y ago
  > Even if it comes from the NSA it doesn't necessarily mean it's backdoored I suppose you could say the same thing about someone with a history of robbing banks.. just because they walked into your bank doesn't mean they are about to rob it (but it's highly likely they are).
  - tptacek 8y ago
    If someone with a history of robbing banks arrived at my bank with a ski mask and a bulging duffle bag, I would say "go away, bank robber". The analogy to cryptography would be the NSA proposing yet another PKRNG, of any kind. On the other hand, if someone with a history of robbing banks called me on the phone and asked me what the interest rates on my checking accounts were, I would tell them, because they can't rob my bank over the phone. The analogy here would be to the NSA suggesting a streamlined, simplified ARX block cipher transform, a backdoor in which would imply some fundamentally unknown property of block ciphers that would presumably jeopardize a whole variety of other academic ciphers, and would not accomplish the NOBUS property that NSA requires of backdoors in things they encourage USG assets to use themselves.
  - betterunix2 8y ago
    The NSA actually has a history of solid block cipher and hash function proposals: https://en.wikipedia.org/wiki/Data_Encryption_Standard https://en.wikipedia.org/wiki/Data_Encryption_Standard https://en.wikipedia.org/wiki/SHA-1 https://en.wikipedia.org/wiki/SHA-1 https://en.wikipedia.org/wiki/Skipjack_(cipher) https://en.wikipedia.org/wiki/Skipjack_(cipher)
dmitrygr 8y ago
I understand and respect your viewpoint. I even agree in most ways. But due to my particular limitations it was speck or nothing.
tptacek 8y ago
It is extraordinarily unlikely that Speck is backdoored, since it's a (deliberately) simple ARX block cipher transform, a close cousin to a variety of other block cipher designs from academic cryptography.
- tialaramex 8y ago
  Yeah, https://lwn.net/Articles/762152/ https://lwn.net/Articles/762152/ has a full source code to Speck. It's like - OK, where is the backdoor, is eight the backdoor, or is three? Did the NSA sneak a backdoor into the idea of binary arithmetic when that was invented? If people want to pick fights with the NSA, fine, but this may have been the dumbest possible fight to pick. How does the implementation of HPolyC look in terms of whether I would notice if you hid something naughty in there?
  - tptacek 8y ago
    Speck was announced to the world in a paper with design documentation, diagrams, and source code. Just read the Shors paper. https://eprint.iacr.org/2017/560 https://eprint.iacr.org/2017/560 Nobody is hiding anything in HPolyC either.
    - tialaramex 8y ago
      My concern wasn't with speculating that anybody is hiding anything in HPolyC but with the comparable amount of code amongst which naughty things might be hidden, today or in future, in Linux, or more likely, in something else. Unfortunately HPolyC is _much_ bigger and more complicated. I'm sure it gets Google's job done, but I think overall purging Speck because of people's weird paranoia about the NSA was an unforced error and we'll regret it.
      - tptacek 8y ago
        HPolyC is "bigger" but is built out of cryptographic components you generally already have to trust: the Poly1305 MAC and the XChaCha cipher. It's a construction, not a new block cipher transform. So obviously it takes more lines of code to run it. But it introduces fewer new primitives.
jessaustin 8y ago
...very-likely-backdoored... This may be a silly comment but I'm glad you made it. It inspired more interesting and informative response than TFA and all the rest of this page.
anfilt 8y ago
I have read the paper for speck. The actaully cipher is very unlikely to have been back doored. The only isue I have is the mode of operation with 64 bit blocks and short keys. In my opinion just ignore the 64bit variants and keys less than 96 bits in lenth. The cipher is rather simple so hiding a back door would require a method of attack not known to anyone publicly. Theres just too small of a surface, and uses pretty stanard operations.

mistaken 8y ago

Even if it comes from the NSA it doesn't necessarily mean it's backdoored. Speck is a good algorithm for performance constrained devices. It was removed from the kernel since it couldn't be included into Android systems due to political reasons, and the authors of the module wrote an implementation of an alternative algorithm for this use-case.

craftyguy 8y ago
> Even if it comes from the NSA it doesn't necessarily mean it's backdoored I suppose you could say the same thing about someone with a history of robbing banks.. just because they walked into your bank doesn't mean they are about to rob it (but it's highly likely they are).
- tptacek 8y ago
  If someone with a history of robbing banks arrived at my bank with a ski mask and a bulging duffle bag, I would say "go away, bank robber". The analogy to cryptography would be the NSA proposing yet another PKRNG, of any kind. On the other hand, if someone with a history of robbing banks called me on the phone and asked me what the interest rates on my checking accounts were, I would tell them, because they can't rob my bank over the phone. The analogy here would be to the NSA suggesting a streamlined, simplified ARX block cipher transform, a backdoor in which would imply some fundamentally unknown property of block ciphers that would presumably jeopardize a whole variety of other academic ciphers, and would not accomplish the NOBUS property that NSA requires of backdoors in things they encourage USG assets to use themselves.
- betterunix2 8y ago
  The NSA actually has a history of solid block cipher and hash function proposals: https://en.wikipedia.org/wiki/Data_Encryption_Standard https://en.wikipedia.org/wiki/Data_Encryption_Standard https://en.wikipedia.org/wiki/SHA-1 https://en.wikipedia.org/wiki/SHA-1 https://en.wikipedia.org/wiki/Skipjack_(cipher) https://en.wikipedia.org/wiki/Skipjack_(cipher)

dmitrygr 8y ago

I understand and respect your viewpoint. I even agree in most ways. But due to my particular limitations it was speck or nothing.

tptacek 8y ago

It is extraordinarily unlikely that Speck is backdoored, since it's a (deliberately) simple ARX block cipher transform, a close cousin to a variety of other block cipher designs from academic cryptography.

tialaramex 8y ago
Yeah, https://lwn.net/Articles/762152/ https://lwn.net/Articles/762152/ has a full source code to Speck. It's like - OK, where is the backdoor, is eight the backdoor, or is three? Did the NSA sneak a backdoor into the idea of binary arithmetic when that was invented? If people want to pick fights with the NSA, fine, but this may have been the dumbest possible fight to pick. How does the implementation of HPolyC look in terms of whether I would notice if you hid something naughty in there?
- tptacek 8y ago
  Speck was announced to the world in a paper with design documentation, diagrams, and source code. Just read the Shors paper. https://eprint.iacr.org/2017/560 https://eprint.iacr.org/2017/560 Nobody is hiding anything in HPolyC either.
  - tialaramex 8y ago
    My concern wasn't with speculating that anybody is hiding anything in HPolyC but with the comparable amount of code amongst which naughty things might be hidden, today or in future, in Linux, or more likely, in something else. Unfortunately HPolyC is _much_ bigger and more complicated. I'm sure it gets Google's job done, but I think overall purging Speck because of people's weird paranoia about the NSA was an unforced error and we'll regret it.
    - tptacek 8y ago
      HPolyC is "bigger" but is built out of cryptographic components you generally already have to trust: the Poly1305 MAC and the XChaCha cipher. It's a construction, not a new block cipher transform. So obviously it takes more lines of code to run it. But it introduces fewer new primitives.

jessaustin 8y ago

...very-likely-backdoored... This may be a silly comment but I'm glad you made it. It inspired more interesting and informative response than TFA and all the rest of this page.

anfilt 8y ago

I have read the paper for speck. The actaully cipher is very unlikely to have been back doored. The only isue I have is the mode of operation with 64 bit blocks and short keys. In my opinion just ignore the 64bit variants and keys less than 96 bits in lenth. The cipher is rather simple so hiding a back door would require a method of attack not known to anyone publicly. Theres just too small of a surface, and uses pretty stanard operations.