5 ms·
NIST Privacy Framework
- KennyBlanken 4y ago[flagged]
- retrocryptid 4y agoDid you read the content at the link you posted? It seems to imply the opposite of the comment you made.
- VWWHFSfQ 4y agoMy understanding was that NSA was the bad actor here. Not NIST. They intentionally withheld information about a timing vulnerability in an encryption algorithm that was being evaluated for standardization by NIST.
- mananaysiempre 4y agoWe’ll see once Bernstein v NIST[1] settles, though I’m willing to accept that was normal bureaucratic apathy and inertia rather than anything nefarious. Still, if we change “trust NIST [not to be evil]” to “trust NIST’s processes [not to be exploitable by evil]”, I’m not at all reassured. It pays to remember the backdoor was not at all unknown[2] even before the standard entered NIST from ANSI. Honestly, the whole debacle with making NIST be in charge of (civilian) cryptography makes me more than a little bit sad. Originally, it’s a metrology institution. Metrologists (worldwide) are a very small circle of narrow-focused (and not outrageously well-paid) specialists that usually react to anybody being interested in their field with the kind of joy most often encountered in small fluffy animals. (They are similar to archivists, observational astronomers, or invertebrate biologists in that way.) Now it seems as though the whole enterprise in the US has become tainted by the association with the national security behemoth. [1] https://www.courtlistener.com/docket/64872195/bernstein-v-national-institute-of-standards-and-technology/ https://www.courtlistener.com/docket/64872195/bernstein-v-na... [2] https://blog.cryptographyengineering.com/2015/01/14/hopefully-last-post-ill-ever-write-on/ https://blog.cryptographyengineering.com/2015/01/14/hopefull... (I especially like the passive-aggressive patent)
- KennyBlanken 4y agoIf it were not for the fact that this has happened multiple times, and that each time the cryptography community was openly skeptical, I could believe "normal bureaucratic apathy and inertia."
- tptacek 4y agoWhat are the "multiple" times here?
- tptacek 4y agoBernstein vs. NIST is just a FOIA suit, about an open standards contest where all the participants were public academics. It's not going to uncover the next BULLRUN.
- mananaysiempre 4y agoI don’t really expect it to (and the known situation is bad enough already that I don’t expect much would change even if it did). But I do hope it’ll shed some light on the entanglement (pun not intended) between the NSA and whatever process drives NIST’s crypto publications. There obviously has to be some, given the former is the US government crypto expert and the other is the issuer of public documents on US government crypto. But as a data point for NIST’s credibility, it’d be nice to know how screwed up it is there. Maybe I won’t learn anything about that here either? Dunno.
- tptacek 4y agoI doubt it's going to show you anything that interesting, since what was published in the PQ competition was simply an academic team's submission.
- Raineer 4y agoIf you're going to blame NIST for what NSA did in this case - you might as well say "don't even trust anyone for digital privacy" since the NSA already collects literally everything from everyone. I think the implication that NIST lacks integrity is unfair.
- vuln 4y ago“Not wittingly” https://apnews.com/article/business-33a88feb083ea35515de3c73e3d854ad https://apnews.com/article/business-33a88feb083ea35515de3c73...
- javier_e06 4y agoFrom their site: "The NIST Privacy Framework is a voluntary tool developed in collaboration with stakeholders intended to help organizations identify and manage privacy risk to build innovative products and services while protecting individuals’ privacy." What is a voluntary tool? Beats me. Who are the stakeholders? Beats me. Help organizations to manage risk. What kind of risk? Whose privacy? yadda yadda yadda.. Run on sentence. My take away: NIST needs to hire writers.
- schnable 4y agoI suspect this is a result of too many writers!
- varunjain99 4y agoMaybe it was written by ChatGPT!
- gdevenyi 4y agoJust a Bueracrat. Same thing.
- retrocryptid 4y agoIf you were there when we were writing that copy back in 2005, you could have schooled us in how not to write like a LLM that hadn't been invented yet. Also, the copy you're referring to was written by a contractor, not "a bureaucrat."
- pleasantpeasant 4y agoMaybe they don't want you to know those things.
- stonogo 4y ago"Voluntary tool" means other federal agencies are not required to adopt it. "Developed in collaboration with stakeholders" means this was not 100% internally developed at NIST. The rest of your questions are answered in the FAQ. It's not a run-on sentence; it's just a long one, and if you're looking for a way to ensure your users' privacy while building a computer-oriented service, that executive summary tells you enough to decide whether this is something you want to further investigate. Drive-by web forum commentators, in general, are not considered target audience for these documents.
- dboreham 4y agoRegulatory capture sausage in the making?
- rsfern 4y agoNIST doesn’t make any regulations, it’s a standards and metrology agency. Is there something specific in this framework that you think benefits big tech (or some other parties) but is not in the best interest of the public?
- TrapLord_Rhodo 4y agoFedRAMP, StateRAMP, and CMMC are entirely based on NIST Standards. If you want to do business with the federal, state or local government you will need to comply with these regulations (Soon, these programs are being rolled out) Edit: Granted, OP obviously has no idea what they're talking about. They are very forward thinking methods for ensuring a zero trust network, communications and data exchange. They include very explicit controls and requirements for maintaining data security.
- psychphysic 4y agoI know we don't have much choice but is this really safe? The recent pentagon papers are nothing if not impressive of how deeply US intelligence is in just about every conversation that matters. So can we trust NIST? As far as I know there have been concerns in the past that they have played ball and so have private security firms. That said maybe a US backdoor is better than all round shoddy engineering? I imagine something like this would be a great way to slip in a weak link.
- unethical_ban 4y agoThis is a policy framework, not an encryption algorithm.
- kjs3 4y agoWhat 'choice' exactly are you being denied?
- psychphysic 4y agoAlternative sources of advice that isn't confirmed to work with NSA to spy on people.
- kjs3 4y agoYou do understand this is a non-obligatory guidance document, right? You can continue to not read nor understand it and no one will be any the wiser. The NSA will almost certainly not put you on a blacklist someplace (no promises and all that). Then you can google "privacy framework" to find a wealth of other non-obligatory guidance documents more to your liking (most of which will reference a NIST document or two someplace, so be careful).
- psychphysic 4y ago[flagged]
- 4y ago
- ChikkaChiChi 4y agoThis is from 2020
- djha-skin 4y agoDoes anyone really still trust these guys after the revelations of the last decade? Seems to me they had their fingers in a lot of pies.
- AndrewKemendo 4y agoCan you point to some specific complaints of wrongdoing? NIST generally doesn’t have any “power” that they can abuse - unless you consider any standards organization an abuse of sovereignty or some such
- deleted 4y ago[deleted]
- fintler 4y agoIt's not exactly recent, but Dual_EC_DRGB wasn't handled well. (pdf) https://harvardnsj.org/wp-content/uploads/2022/06/Vol13Iss2_Kostyuk-Landau_Dual-EC-DRGB.pdf https://harvardnsj.org/wp-content/uploads/2022/06/Vol13Iss2_...
- MattPalmer1086 4y agoNo, that wasn't handled well and it damaged them. The NSA were the ones who backdoored it though, and NIST ignored warnings of a possible back door. However, in general NIST standards are very good.
- AndrewKemendo 4y agoWhich was rescended…so I’m not sure what the complaint is This is about as good as it gets for any organization