7 ms·

The same way Dual_EC_DRBG became a NIST standard, the NSA pulls the strings. You can't expect a government department to provide robust security to the masses

The same way Dual_EC_DRBG became a NIST standard, the NSA pulls the strings. You can't expect a government department to provide robust security to the masses when the rest of the government is trying the prevent that exact situation. At this point anything, cryptography related, coming from NIST should be considered compromised.

sidewndr46 5y ago
An apt comparison for the NIST standardization process would be the World Wrestling Entertainment. Except Vince McMahon just likes making money, whereas the NSA has the objective of interecepting all communications, forever.
tptacek 5y ago
A risible argument. NSA wants NOBUS vulnerabilities: the kind they can exploit, but nobody else can, because NIST cryptography gets used on the kinds of systems NSA doesn't want exploited in a weekend with a laptop.
- generalizations 5y ago
  They fooled us once; are you suggesting we let them fool us again? We have very good reason to look at NIST with suspicion from now on.
  - secretkeyholder 5y ago
    This is a very reasonable take. The people at NIST are in a bind. Many of them are good people with positive intentions, but they cannot speak freely about NSA and they say so openly at cryptography conferences when asked.
- SturgeonsLaw 5y ago
  NOBUS vulns are a fantasy, and the NSA's dual goals of strengthening and weakening security are impossible to truly resolve
  - tptacek 5y ago
    They are, huh? Well then: what's the private key for Dual EC?
    - secretkeyholder 5y ago
      What is the private key? It is a private key probably still stored in a hardware module controlled by NSA CES, isn’t it? This isn’t a problem: Just ask for decrypts by the usual FISA CES API and you don’t need the private key directly.
      - tptacek 5y ago
        I don't think you're following the actual dispute on this subthread.
        secretkeyholder 5y ago
        I followed it and was trying to point out that your question was imprecise.
        tptacek 5y ago
        Respectfully, I think you're a little lost here.
        secretkeyholder 5y ago
        It’s all good. I take it respectfully. Let me try again and I mean this entirely in good faith. I don’t think you’re an NSA shill as I think my other comments were taken by random readers. I do think you’re just mistaken and like many Americans (myself included) we want to believe in our institutions. You seem like a reasonable person, and I meant no slight towards you. My read is that you asked what is the secret key with the implication that if they have it they should reveal it. No one who has it would do that to settle an argument. Well maybe someone would but it seems like an unreasonable ask. Absence of evidence isn’t evidence of absence (of the theft of the secret key for the q parameter for Dual EC), right? If Dual EC didn’t have a backdoor, no could steal the secret key that NSA uses to exploit it. One is more secure than the other, and I take your comment as requiring the secret key for the corresponding Q to leak for that design to be a bad idea that is insecure. Again, I don’t think that is a reasonable standard of evidence. We know people steal stuff from NSA and we cannot expect that they will drop the secret key on hacker news to decide that it was a bad idea in the first place. NOBUS is a fantasy idea - is there even a reasonable proposal that isn’t less secure than the same system without a backdoor? Even with ECDLP in play, if a CRQC is really in our future, Dual EC isn’t a forever NOBUS backdoor. If we knew how to do public key cryptography that could last 100+ years and we thought it was also post-quantum, maybe a backdoor wouldn’t weaken the system overall. But that’s a lot of maybes…
- secretkeyholder 5y ago
  If a cryptographically relevant quantum computer is built - then everyone with a CRQC can recover the secret key for the Q parameter. Not a very good NOBUS plan if CRQC are expected to be built as NIST and NSA have made clear by their desire for pq crypto standards. A pertinent question comes to mind: do you suggest NSA hasn’t and could not have stolen the private key that is relevant for the Juniper Q parameter swap? I wouldn’t find such a claim reasonable and NSA would have it if they want it. One presumes that the Chinese still have a copy of that other private key for their swapped out Q parameter. Maybe they keep it with their copy of the OPM data that they took. Maybe they use the OPM data for leverage on the actual secret key holders to get the original private key for the original Q parameter. Maybe they don’t care because swapping Q was better and easier. If you think this Dual EC design is a success… https://eprint.iacr.org/2016/376.pdf https://eprint.iacr.org/2016/376.pdf NSA outclasses every other intelligence service on earth but they too have insiders who leave with more than is allowed. Furthermore, NSA has also been willing to deploy LFSR designs which are still being broken by a single digit number of persons such as the recent PX-1000cr break. Do you know if NSA considered that NOBUS? https://www.cryptomuseum.com/crypto/philips/px1000/ https://www.cryptomuseum.com/crypto/philips/px1000/ If NSA considered the LFSR design in the DES replacement cipher in the PX-1000cr NOBUS, their claim of NOBUS was wrong. If they didn’t consider it NOBUS, then on what ground do you claim that they only want to deploy NOBUS backdoors? Either way, we can observe just from public cases that their backdoor strategy isn’t limited to only deploying NOBUS backdoors. To claim they only want NOBUS is an NSA PR talking point from Vanee’ Vines herself at the NSA press office. It is not only wrong, it’s blatantly ahistorical. NSA wants plaintext and that means they don’t only deploy and push NOBUS backdoors. There are other examples that aren’t public yet and definitely aren’t NOBUS.
  - tptacek 5y ago
    It's tricky to get a bead on what it is people think I'm arguing here. My argument is simple and narrow: if it's an attack discovered independently that can break a cryptosystem with realistic parameters over a weekend on a laptop, it's not an NSA backdoor. NSA backdoors are trivially exploitable by NSA, but not trivially exploitable by anyone with the relevant mathematics background.
tux3 5y ago
This is pure paranoia, I'll be the first to criticize NIST and NSA for the damage they've done to standards and to their own credibility. But don't over-correct. You can't just call anyone who submits to NIST an NSA puppet. There is zero parrallel with the Dual EC backdoor.
- secretkeyholder 5y ago
  Prudence sometimes looks like paranoia. The parallel that matters is that NSA is documented as being inclined to design, allow, and promote backdoors like Dual EC to be standardized by NIST. They have no obligation to break and publish the break as Ward has done here. It’s not that the authors of rainbow are suspect, it’s that the result of the process isn’t telling us what we hope it tells us. NIST must consult with NSA by law but the law does not require NSA to help. It certainly does not require NSA to save NIST from standardizing a broken system. The Dual EC backdoor is a documented act of strategic sabotage by NSA and NIST, though we extend the benefit of the doubt to NIST. What stands between us and additional standardized backdoors is effectively a very small number of smart academics who relative to NSA are underfunded and under resourced. Thankfully we have people like Ward breaking systems and publishing it openly. Unfortunately we have NSA funded people pushing things as well, Dragonfly and IETF come to mind here as well. NIST standardization does not mean NSA can’t break it. Historically, we know from the Dual EC standardization that they can break it by their own design, and they let the world deploy and use Dual EC to NSA’s own advantage.
Ar-Curunir 5y ago
There is no indication that that’s what happened in this case. This stuff is just non-trivial to cryptanalyze , and there’s not that many people who can do it.
- secretkeyholder 5y ago
  NSA is regularly claimed to be the employer of the largest number of mathematicians in the world. The reason we don’t know about the NSA analysis is that the law doesn’t require NSA to analyze the winners and then make the results public. If Ward can do it and make it public, that’s wonderful and we should thank him. Thank you Ward! We can’t say the same about NSA. This is really a problem and we should be able to rely on NSA to break such schemes and to deliver the result openly to NIST. It’s unbelievable that this isn’t the case and rather we have to rely on some nice guy with a weekend of laptop time.

sidewndr46 5y ago

An apt comparison for the NIST standardization process would be the World Wrestling Entertainment. Except Vince McMahon just likes making money, whereas the NSA has the objective of interecepting all communications, forever.

tptacek 5y ago

A risible argument. NSA wants NOBUS vulnerabilities: the kind they can exploit, but nobody else can, because NIST cryptography gets used on the kinds of systems NSA doesn't want exploited in a weekend with a laptop.

generalizations 5y ago
They fooled us once; are you suggesting we let them fool us again? We have very good reason to look at NIST with suspicion from now on.
- secretkeyholder 5y ago
  This is a very reasonable take. The people at NIST are in a bind. Many of them are good people with positive intentions, but they cannot speak freely about NSA and they say so openly at cryptography conferences when asked.
SturgeonsLaw 5y ago
NOBUS vulns are a fantasy, and the NSA's dual goals of strengthening and weakening security are impossible to truly resolve
- tptacek 5y ago
  They are, huh? Well then: what's the private key for Dual EC?
  - secretkeyholder 5y ago
    What is the private key? It is a private key probably still stored in a hardware module controlled by NSA CES, isn’t it? This isn’t a problem: Just ask for decrypts by the usual FISA CES API and you don’t need the private key directly.
    - tptacek 5y ago
      I don't think you're following the actual dispute on this subthread.
      - secretkeyholder 5y ago
        I followed it and was trying to point out that your question was imprecise.
        tptacek 5y ago
        Respectfully, I think you're a little lost here.
        secretkeyholder 5y ago
        It’s all good. I take it respectfully. Let me try again and I mean this entirely in good faith. I don’t think you’re an NSA shill as I think my other comments were taken by random readers. I do think you’re just mistaken and like many Americans (myself included) we want to believe in our institutions. You seem like a reasonable person, and I meant no slight towards you. My read is that you asked what is the secret key with the implication that if they have it they should reveal it. No one who has it would do that to settle an argument. Well maybe someone would but it seems like an unreasonable ask. Absence of evidence isn’t evidence of absence (of the theft of the secret key for the q parameter for Dual EC), right? If Dual EC didn’t have a backdoor, no could steal the secret key that NSA uses to exploit it. One is more secure than the other, and I take your comment as requiring the secret key for the corresponding Q to leak for that design to be a bad idea that is insecure. Again, I don’t think that is a reasonable standard of evidence. We know people steal stuff from NSA and we cannot expect that they will drop the secret key on hacker news to decide that it was a bad idea in the first place. NOBUS is a fantasy idea - is there even a reasonable proposal that isn’t less secure than the same system without a backdoor? Even with ECDLP in play, if a CRQC is really in our future, Dual EC isn’t a forever NOBUS backdoor. If we knew how to do public key cryptography that could last 100+ years and we thought it was also post-quantum, maybe a backdoor wouldn’t weaken the system overall. But that’s a lot of maybes…
secretkeyholder 5y ago
If a cryptographically relevant quantum computer is built - then everyone with a CRQC can recover the secret key for the Q parameter. Not a very good NOBUS plan if CRQC are expected to be built as NIST and NSA have made clear by their desire for pq crypto standards. A pertinent question comes to mind: do you suggest NSA hasn’t and could not have stolen the private key that is relevant for the Juniper Q parameter swap? I wouldn’t find such a claim reasonable and NSA would have it if they want it. One presumes that the Chinese still have a copy of that other private key for their swapped out Q parameter. Maybe they keep it with their copy of the OPM data that they took. Maybe they use the OPM data for leverage on the actual secret key holders to get the original private key for the original Q parameter. Maybe they don’t care because swapping Q was better and easier. If you think this Dual EC design is a success… https://eprint.iacr.org/2016/376.pdf https://eprint.iacr.org/2016/376.pdf NSA outclasses every other intelligence service on earth but they too have insiders who leave with more than is allowed. Furthermore, NSA has also been willing to deploy LFSR designs which are still being broken by a single digit number of persons such as the recent PX-1000cr break. Do you know if NSA considered that NOBUS? https://www.cryptomuseum.com/crypto/philips/px1000/ https://www.cryptomuseum.com/crypto/philips/px1000/ If NSA considered the LFSR design in the DES replacement cipher in the PX-1000cr NOBUS, their claim of NOBUS was wrong. If they didn’t consider it NOBUS, then on what ground do you claim that they only want to deploy NOBUS backdoors? Either way, we can observe just from public cases that their backdoor strategy isn’t limited to only deploying NOBUS backdoors. To claim they only want NOBUS is an NSA PR talking point from Vanee’ Vines herself at the NSA press office. It is not only wrong, it’s blatantly ahistorical. NSA wants plaintext and that means they don’t only deploy and push NOBUS backdoors. There are other examples that aren’t public yet and definitely aren’t NOBUS.
- tptacek 5y ago
  It's tricky to get a bead on what it is people think I'm arguing here. My argument is simple and narrow: if it's an attack discovered independently that can break a cryptosystem with realistic parameters over a weekend on a laptop, it's not an NSA backdoor. NSA backdoors are trivially exploitable by NSA, but not trivially exploitable by anyone with the relevant mathematics background.

tux3 5y ago

This is pure paranoia, I'll be the first to criticize NIST and NSA for the damage they've done to standards and to their own credibility. But don't over-correct. You can't just call anyone who submits to NIST an NSA puppet. There is zero parrallel with the Dual EC backdoor.

secretkeyholder 5y ago
Prudence sometimes looks like paranoia. The parallel that matters is that NSA is documented as being inclined to design, allow, and promote backdoors like Dual EC to be standardized by NIST. They have no obligation to break and publish the break as Ward has done here. It’s not that the authors of rainbow are suspect, it’s that the result of the process isn’t telling us what we hope it tells us. NIST must consult with NSA by law but the law does not require NSA to help. It certainly does not require NSA to save NIST from standardizing a broken system. The Dual EC backdoor is a documented act of strategic sabotage by NSA and NIST, though we extend the benefit of the doubt to NIST. What stands between us and additional standardized backdoors is effectively a very small number of smart academics who relative to NSA are underfunded and under resourced. Thankfully we have people like Ward breaking systems and publishing it openly. Unfortunately we have NSA funded people pushing things as well, Dragonfly and IETF come to mind here as well. NIST standardization does not mean NSA can’t break it. Historically, we know from the Dual EC standardization that they can break it by their own design, and they let the world deploy and use Dual EC to NSA’s own advantage.

Ar-Curunir 5y ago

There is no indication that that’s what happened in this case. This stuff is just non-trivial to cryptanalyze , and there’s not that many people who can do it.

secretkeyholder 5y ago
NSA is regularly claimed to be the employer of the largest number of mathematicians in the world. The reason we don’t know about the NSA analysis is that the law doesn’t require NSA to analyze the winners and then make the results public. If Ward can do it and make it public, that’s wonderful and we should thank him. Thank you Ward! We can’t say the same about NSA. This is really a problem and we should be able to rely on NSA to break such schemes and to deliver the result openly to NIST. It’s unbelievable that this isn’t the case and rather we have to rely on some nice guy with a weekend of laptop time.