5 ms·

I've wondered occasionally if Rijndael was chosen over the other AES finalists so that the NSA would have a NOBUS backdoor in the form of the whole s-box timing

• ggm 7y ago
  Its impossible to prove absent a snowden-class leak. The premise is they have secret knowledge. Maths is inductive reasoning, they might have a non-inductive insight into a thing which exposes a magic key to them, but they have to do a risk analysis the bad guys (tm) can do the same AHA moment and secure the same advantage. In this space, I feel about the only public evidence would be when the NSA feel the protocol cannot be trusted for government use, where the primary risk is other-state actors. I also feel the blurring of the role for the agencies here does nobody any favours. NOBUS confers a specific advantage which massively undermines your own position in the longer term for tactical advantage now. I would probably be told by wiser heads tactics trumps strategy, but when you face 20-50 year relationships and you burned your partners 15 years ago, that tactical win can be a bit of a problem. The UK did this with Enigma: kept their insight secret and handed the captured units to the commonwealth governments. They did not help their own cause in the 1960s independence wars, trust was close to zero. I have no evidence the ability to decrypt their signals helped or hindered btw. Its conjecture on my part.
  • badrabbit 7y ago
    Could they simply use a different sbox? Or can specific implementations be written to avoid the vuln? You have to also keep in mind,aes is class-b crypto, the only publicly known class-a ciphers are decades older than aes.
    • alephnil 7y ago
      The sbox is a part of the definition of AES. If you change it it is no longer AES, and the new algorithm (that may well have vulnerabilities) is no longer compatible with the cryptographic protocols that specifies that they use AES as a cipher.
  • RomanBob 7y ago
    > but they have to do a risk analysis the bad guys (tm) can do the same AHA moment and secure the same advantage. Are you implying that the NSA is the good guys (tm)??
• optimiz3 7y ago
  Extremely unlikely; Rijndael S-Box entries can be calculated in constant time using first principles or bit-slicing. No lookup tables needed. Timing side-channel vulnerabilities in an AES S-Box implementation would be flaws in the implementation and application as opposed to the algorithm.
  • badrabbit 7y ago
    Yes, they can be calculated in constant time, NSA's friends can be told to use constant time from the start while everyone else used libs that copies from the non constant time reference implementation?
    • optimiz3 7y ago
      Reference code is almost never what you want to go into production, what with various perf and security issues. It's there to test spec compliance.
      • badrabbit 7y ago
        Yes but flaws in he spec bleed into all implementation that ..you now...uses it as a reference.
• tptacek 7y ago
  That's the opposite of a NOBUS backdoor; it's an everyone backdoor, since anyone can run a timing attack on AES.