5 ms·

Many government or government affiliated organizations are required to comply with NIST approved algorithms by regulation or for interoperability. If NIST canno

Many government or government affiliated organizations are required to comply with NIST approved algorithms by regulation or for interoperability. If NIST cannot be trusted as a reputable source it leaves those organizations in limbo. They are not equipped to roll their own crypto and even if they did, it would be a disaster.

icodestuff 4y ago
"Other people have no choice but to trust NIST" is not a good argument for trusting NIST. Somehow I don't imagine the NSA is concerned about -- and is probably actively in favor of -- those organizations having backdoors.
- wmf 4y ago
  It's an argument for fixing NIST so that it is trustworthy again.
  - throwaway654329 4y ago
    This. One wonders if NIST can be fixed or if it should simply be abolished with all archives opened in the interest of restoring faith in the government. The damage done by NSA and NIST is much larger than either of those organizations.
    - deleted 4y ago
      [deleted]
zamadatix 4y ago
"Roll your own crypto" typically refers to making your own algorithm or implementation of an algorithm not choosing the algorithm.
- lazide 4y ago
  Would you really want every random corporation having some random person pick from the list of open source cipher packages? Which last I checked , still included things like 3DES, MD5, etc. You might as well hand a drunk monkey a loaded sub machine gun.
  - CodeSgt 4y ago
    Surely I'm misunderstanding, are you really advocating that people should roll their own encryption algorithms from scratch? As in, they should invent novel and secure algorithms in isolation? And this should happen.... at every major enterprise or software company in the world?
    - lazide 4y ago
      You are completely misunderstanding yes. I'm saying some standards body is appropriate for validating/vetting algorithms, and having a standards body advocate for known reasonable ones is... reasonable and desirable. That NIST has a history of being compromised by the NSA (and other standards bodies would likely similarly be a target), is a problem. But having everyone 'figure it out' on their own is even worse. 'hand a drunk monkey a loaded submachine gun' worse.
      - CodeSgt 4y ago
        That makes much more sense. Thank you for the clarification.
      - pessimizer 4y ago
        > That NIST has a history of being compromised by the NSA is a problem. It's a disqualifying problem. If you go to a standards body to prevent yourself from making unintentional mistakes, and they have introduced intentional mistakes, any other reasonable option is better.
        lazide 4y ago

icodestuff 4y ago

"Other people have no choice but to trust NIST" is not a good argument for trusting NIST. Somehow I don't imagine the NSA is concerned about -- and is probably actively in favor of -- those organizations having backdoors.

wmf 4y ago
It's an argument for fixing NIST so that it is trustworthy again.
- throwaway654329 4y ago
  This. One wonders if NIST can be fixed or if it should simply be abolished with all archives opened in the interest of restoring faith in the government. The damage done by NSA and NIST is much larger than either of those organizations.
  - deleted 4y ago
    [deleted]

zamadatix 4y ago

"Roll your own crypto" typically refers to making your own algorithm or implementation of an algorithm not choosing the algorithm.

lazide 4y ago
Would you really want every random corporation having some random person pick from the list of open source cipher packages? Which last I checked , still included things like 3DES, MD5, etc. You might as well hand a drunk monkey a loaded sub machine gun.
- CodeSgt 4y ago
  Surely I'm misunderstanding, are you really advocating that people should roll their own encryption algorithms from scratch? As in, they should invent novel and secure algorithms in isolation? And this should happen.... at every major enterprise or software company in the world?
  - lazide 4y ago
    You are completely misunderstanding yes. I'm saying some standards body is appropriate for validating/vetting algorithms, and having a standards body advocate for known reasonable ones is... reasonable and desirable. That NIST has a history of being compromised by the NSA (and other standards bodies would likely similarly be a target), is a problem. But having everyone 'figure it out' on their own is even worse. 'hand a drunk monkey a loaded submachine gun' worse.
    - CodeSgt 4y ago
      That makes much more sense. Thank you for the clarification.
    - pessimizer 4y ago
      > That NIST has a history of being compromised by the NSA is a problem. It's a disqualifying problem. If you go to a standards body to prevent yourself from making unintentional mistakes, and they have introduced intentional mistakes, any other reasonable option is better.
      - lazide 4y ago