4 ms·
Wild-ass speculation alert! Please don't turn into FUD. NSA floated a cipher a while back called Speck. https://en.wikipedia.org/wiki/Speck_(cipher) https://e
by api 5y ago
Wild-ass speculation alert! Please don't turn into FUD.
NSA floated a cipher a while back called Speck.
https://en.wikipedia.org/wiki/Speck_(cipher) https://en.wikipedia.org/wiki/Speck_(cipher)
After the dual-EC debacle it's understandable that people would be skeptical of a cipher from the NSA. People assumed Speck might be intentionally weak or backdoored.
Thing is... it's a stupid simple ARX cipher. Dual-EC was obviously suspect for multiple reasons, but Speck is so simple it doesn't really have room for any "magic" constants that could have been optimized to introduce a back door or vulnerability.
That means there are two possibilities:
(1) Speck is fine.
(2) The NSA knows something about ARX ciphers that we don't.
Option #1 is orders of magnitude more likely than option #2, but if we are entertaining wild speculation there's some for you.
- whatshisface 5y ago(3) Speck is fine, but NSA wants to weaken the precedent of not trusting the cyphers it releases, to slip a bad one in later.
- Dylan16807 5y agoWanting a better reputation is an obvious motivator for 1. This isn't a separate option.
- tptacek 5y agoThere's a cool paper that proposes embedding a NOBUS susceptibility to linear cryptanalysis in constants for ARX ciphers like SPECK (like SPECK, not SPECK), I should dig it up. Reliably demonstrating that capability would be an advancement in the state of the art of cryptography, though, as I understand it.
- nullc 5y agoSpeck supports configurations with keys small enough to be brute forcable. There is a nice attack pattern where you standardize something with some insecure modes, then you use targeted attacks to get your targets to use those insecure modes. I'm not aware of any non-NSA ciphers from the last decade that supports a 64-bit key...
- api 5y agoThis is a good point. They claim this is to support tiny devices but that would have to be a really tiny device for trimming 64 bits off a key to matter. The 128-bit and 256-bit key versions of Speck are probably fine, but...