3 ms·

It should be noted that Bernstein was complaining about the lack of transparency and NSA involvement in https://twitter.com/hashbreaker/status/12859228083929088

It should be noted that Bernstein was complaining about the lack of transparency and NSA involvement in https://twitter.com/hashbreaker/status/1285922808392908800 https://twitter.com/hashbreaker/status/1285922808392908800

john_alan 6y ago
Of course, NIST compliance is a circus. I use it as a list of what not to use. Once a senior cryptographer in Citi's R&D lab was grilling me on my use of 25519 being without NIST's blessing. I asked him what he would use, he said, "cryptographically speaking 25519", Ok.jpg.
- dependenttypes 6y ago
  > I use it as a list of what not to use. Bernstein's (the one that made 25519) own submissions passed to round 3 though. Do you also avoid AES/SHA3/BLAKE because they were NIST finalists?
- skissane 6y ago
  > Of course, NIST compliance is a circus. The problem is when customers start demanding it. Then you don't really have much of a choice. Especially when your competitors are offering it – what is the more successful sales strategy – try to convince the customer they don't really need what they think they need, or just give them what they want? You'll win more deals with the second approach than the first. That doesn't mean you can't use NIST-unapproved algorithms that are technically superior to the NIST-approved ones. You can just have some "NIST mode" (or "FIPS mode" to use the older terminology) that you can turn on for those customers that ask for it, and then only NIST-approved algorithms get used for those customers. (It is more than just the choice of algorithms, you also need to have a certified implementation – in Java, one can replace BouncyCastle with BouncyCastle FIPS, and then have a flag to turn on approved mode for the instance; once in approved mode, use of non-certified algorithms is blocked.)
- raincom 6y ago
  Interesting. Arjen Lenstra used to be at Citi's R&D Lab; his brother is Hendrik Lenstra, who was Bernstein's Ph.D advisor.

john_alan 6y ago

Of course, NIST compliance is a circus. I use it as a list of what not to use. Once a senior cryptographer in Citi's R&D lab was grilling me on my use of 25519 being without NIST's blessing. I asked him what he would use, he said, "cryptographically speaking 25519", Ok.jpg.

dependenttypes 6y ago
> I use it as a list of what not to use. Bernstein's (the one that made 25519) own submissions passed to round 3 though. Do you also avoid AES/SHA3/BLAKE because they were NIST finalists?
skissane 6y ago
> Of course, NIST compliance is a circus. The problem is when customers start demanding it. Then you don't really have much of a choice. Especially when your competitors are offering it – what is the more successful sales strategy – try to convince the customer they don't really need what they think they need, or just give them what they want? You'll win more deals with the second approach than the first. That doesn't mean you can't use NIST-unapproved algorithms that are technically superior to the NIST-approved ones. You can just have some "NIST mode" (or "FIPS mode" to use the older terminology) that you can turn on for those customers that ask for it, and then only NIST-approved algorithms get used for those customers. (It is more than just the choice of algorithms, you also need to have a certified implementation – in Java, one can replace BouncyCastle with BouncyCastle FIPS, and then have a flag to turn on approved mode for the instance; once in approved mode, use of non-certified algorithms is blocked.)
raincom 6y ago
Interesting. Arjen Lenstra used to be at Citi's R&D Lab; his brother is Hendrik Lenstra, who was Bernstein's Ph.D advisor.