4 ms·

> The past has shown that often the USA government/NSA sponsored or developed encryption algorithms used in many popular devices This sort of unfounded conspir

> The past has shown that often the USA government/NSA sponsored or developed encryption algorithms used in many popular devices This sort of unfounded conspiratorial thinking is absurd. The past has shown the opposite, that whenever government tries to shove broken algorithms down people's throats, cryptographers ignore it and go for something they can prove is correct. BLAKE2 and ChaCha20 are algorithms designed by cryptographers that hate the government.

nsajko 5y ago
> This sort of unfounded conspiratorial thinking is absurd. GP's baseless accusations indeed are distasteful. > cryptographers ignore it and go for something they can prove is correct. BLAKE2 and ChaCha20 are algorithms designed by cryptographers BLAKE2 is based on ARX, so proofs regarding some of its properties are very difficult or infeasible, as far as I understand. It is my understanding that other designs are much more popular among cryptographers because they are mathematically and financially easier to analyze, implying better security (because nation-state-level resources aren't necessary for finding vulnerabilities). See, e.g.: https://keccak.team/2017/not_arx.html https://keccak.team/2017/not_arx.html
- api 5y ago
  Wild-ass speculation alert! Please don't turn into FUD. NSA floated a cipher a while back called Speck. https://en.wikipedia.org/wiki/Speck_(cipher) https://en.wikipedia.org/wiki/Speck_(cipher) After the dual-EC debacle it's understandable that people would be skeptical of a cipher from the NSA. People assumed Speck might be intentionally weak or backdoored. Thing is... it's a stupid simple ARX cipher. Dual-EC was obviously suspect for multiple reasons, but Speck is so simple it doesn't really have room for any "magic" constants that could have been optimized to introduce a back door or vulnerability. That means there are two possibilities: (1) Speck is fine. (2) The NSA knows something about ARX ciphers that we don't. Option #1 is orders of magnitude more likely than option #2, but if we are entertaining wild speculation there's some for you.
  - whatshisface 5y ago
    (3) Speck is fine, but NSA wants to weaken the precedent of not trusting the cyphers it releases, to slip a bad one in later.
    - Dylan16807 5y ago
      Wanting a better reputation is an obvious motivator for 1. This isn't a separate option.
  - tptacek 5y ago
    There's a cool paper that proposes embedding a NOBUS susceptibility to linear cryptanalysis in constants for ARX ciphers like SPECK (like SPECK, not SPECK), I should dig it up. Reliably demonstrating that capability would be an advancement in the state of the art of cryptography, though, as I understand it.
  - nullc 5y ago
    Speck supports configurations with keys small enough to be brute forcable. There is a nice attack pattern where you standardize something with some insecure modes, then you use targeted attacks to get your targets to use those insecure modes. I'm not aware of any non-NSA ciphers from the last decade that supports a 64-bit key...
    - api 5y ago
      This is a good point. They claim this is to support tiny devices but that would have to be a really tiny device for trimming 64 bits off a key to matter. The 128-bit and 256-bit key versions of Speck are probably fine, but...

nsajko 5y ago

> This sort of unfounded conspiratorial thinking is absurd. GP's baseless accusations indeed are distasteful. > cryptographers ignore it and go for something they can prove is correct. BLAKE2 and ChaCha20 are algorithms designed by cryptographers BLAKE2 is based on ARX, so proofs regarding some of its properties are very difficult or infeasible, as far as I understand. It is my understanding that other designs are much more popular among cryptographers because they are mathematically and financially easier to analyze, implying better security (because nation-state-level resources aren't necessary for finding vulnerabilities). See, e.g.: https://keccak.team/2017/not_arx.html https://keccak.team/2017/not_arx.html

api 5y ago
Wild-ass speculation alert! Please don't turn into FUD. NSA floated a cipher a while back called Speck. https://en.wikipedia.org/wiki/Speck_(cipher) https://en.wikipedia.org/wiki/Speck_(cipher) After the dual-EC debacle it's understandable that people would be skeptical of a cipher from the NSA. People assumed Speck might be intentionally weak or backdoored. Thing is... it's a stupid simple ARX cipher. Dual-EC was obviously suspect for multiple reasons, but Speck is so simple it doesn't really have room for any "magic" constants that could have been optimized to introduce a back door or vulnerability. That means there are two possibilities: (1) Speck is fine. (2) The NSA knows something about ARX ciphers that we don't. Option #1 is orders of magnitude more likely than option #2, but if we are entertaining wild speculation there's some for you.
- whatshisface 5y ago
  (3) Speck is fine, but NSA wants to weaken the precedent of not trusting the cyphers it releases, to slip a bad one in later.
  - Dylan16807 5y ago
    Wanting a better reputation is an obvious motivator for 1. This isn't a separate option.
- tptacek 5y ago
  There's a cool paper that proposes embedding a NOBUS susceptibility to linear cryptanalysis in constants for ARX ciphers like SPECK (like SPECK, not SPECK), I should dig it up. Reliably demonstrating that capability would be an advancement in the state of the art of cryptography, though, as I understand it.
- nullc 5y ago
  Speck supports configurations with keys small enough to be brute forcable. There is a nice attack pattern where you standardize something with some insecure modes, then you use targeted attacks to get your targets to use those insecure modes. I'm not aware of any non-NSA ciphers from the last decade that supports a 64-bit key...
  - api 5y ago
    This is a good point. They claim this is to support tiny devices but that would have to be a really tiny device for trimming 64 bits off a key to matter. The 128-bit and 256-bit key versions of Speck are probably fine, but...