5 ms·

DJB has a historical record of being correct on crypto. His 'tantrums' led to Bernstein v. United States, which established source code as speech.

by ozr 3y ago

mcpherrinm 3y ago
DJB is obviously a talented cryptographer, but he’s also clearly got a big ego. He’s drawing unfounded conclusions to discredit the work of other cryptographers whose work was chosen over his own.
- olliej 3y ago
  That's not fair. NIST has a documented history of working with the NSA, intentionally hiding that interaction, and the outcome was a major security problem. So it seems DJB believes that NIST has not provided sufficient documentation, and given their history it's reasonable to take a position that if they don't do that, the outcome cannot be trusted. So the issue is that once NIST did that the irrevocably destroy any basis to say "you can trust us". Hence they cannot have anything that they cannot document the source for. e.g. any non-trivial numbers have to have a documented generation path, and any non-trivial numbers in those steps also have to have a documented generation path. Let's assume for now NIST is being 100% honest, and there's no attempted subterfuge. How can we distinguish that from them intentionally hiding subterfuge? Even though in this hypothetical where we're assuming no corruption, we have no way to know unless we have everything. It's not reasonable for anyone at this point to have an algorithm that has any unexplained numbers, but for an organization that is again documented as having sabotaged standards it's absurd.
  - tptacek 3y ago
    This is a comment that only makes sense if you believe NIST designed CRYSTALS-Kyber, or had a significant hand in its design. But nothing of the sort happened. The CRYSTALS team is overwhelmingly academic and overwhelmingly European. It's frustrating that Bernstein has communicated about this without making that clear, because it's obvious that lots of people believe NIST went off in a room and came up with a scheme, and your first responsibility in discussing this honestly is to dispel that misconception.
    - nvm0n2 3y ago
      It doesn't actually matter. NIST should not be involved at all. Jesus this is basic, if all they're doing is refereeing a competition there's really no excuse for them to be involved at all.
      - tptacek 3y ago
        They're the American national standards organization. The point of the competition is to pick a standard.
    - adgjlsfhk1 3y ago
      I don't think the problem is that kyber was designed weak. the fear is that the NSA/NIST saw an algorithm that was weaker than it should be and worked nice and hard to make sure it became the standard. the worry isn't a back door, it's unintentional mistakes that are being capitalized on.
      - tptacek 3y ago
        Applying this logic, there is literally nothing NIST could have done here other than not run the competition in the first place; if it's not enough that almost every participant in the competition agrees that it was well conducted --- if the consensus of the whole academic field of post-quantum cryptography doesn't count for anything --- then all you're really saying is that there's no way to create a trustworthy standard. And, to that, I say: hell yes. Cryptographic standards are, in my view, a force for evil. Nobody uses Blake2 because it's "standardized"; they use it because there's a rough consensus of credible, credentialed cryptographers that it's strong, and it's obviously fast. We can do Internet cryptography without entities like NIST and the IETF. This is something Bernstein believes as well; he's said it before (I have my view on standards in part because of his own). But he's not being honest about that here: had his submission won, he'd have endorsed the competition, even though the exact same logic holds --- he should, by this logic, trust his own submission less if it wins. But I also want to be especially candid here: this "NIST is acting as the catspaw of NSA by selecting the weakest standard" argument is also the standard rhetorical fallback for arguers who have just this instant learned that NIST didn't itself design CRYSTALS-Kyber, but don't want to surrender their credibility by admitting it.

DJB has a historical record of being correct on crypto. His 'tantrums' led to Bernstein v. United States, which established source code as speech.

by ozr 3y ago

DJB has a historical record of being correct on crypto. His 'tantrums' led to Bernstein v. United States, which established source code as speech.

mcpherrinm 3y ago

DJB is obviously a talented cryptographer, but he’s also clearly got a big ego. He’s drawing unfounded conclusions to discredit the work of other cryptographers whose work was chosen over his own.

olliej 3y ago
That's not fair. NIST has a documented history of working with the NSA, intentionally hiding that interaction, and the outcome was a major security problem. So it seems DJB believes that NIST has not provided sufficient documentation, and given their history it's reasonable to take a position that if they don't do that, the outcome cannot be trusted. So the issue is that once NIST did that the irrevocably destroy any basis to say "you can trust us". Hence they cannot have anything that they cannot document the source for. e.g. any non-trivial numbers have to have a documented generation path, and any non-trivial numbers in those steps also have to have a documented generation path. Let's assume for now NIST is being 100% honest, and there's no attempted subterfuge. How can we distinguish that from them intentionally hiding subterfuge? Even though in this hypothetical where we're assuming no corruption, we have no way to know unless we have everything. It's not reasonable for anyone at this point to have an algorithm that has any unexplained numbers, but for an organization that is again documented as having sabotaged standards it's absurd.
- tptacek 3y ago
  This is a comment that only makes sense if you believe NIST designed CRYSTALS-Kyber, or had a significant hand in its design. But nothing of the sort happened. The CRYSTALS team is overwhelmingly academic and overwhelmingly European. It's frustrating that Bernstein has communicated about this without making that clear, because it's obvious that lots of people believe NIST went off in a room and came up with a scheme, and your first responsibility in discussing this honestly is to dispel that misconception.
  - nvm0n2 3y ago
    It doesn't actually matter. NIST should not be involved at all. Jesus this is basic, if all they're doing is refereeing a competition there's really no excuse for them to be involved at all.
    - tptacek 3y ago
      They're the American national standards organization. The point of the competition is to pick a standard.
  - adgjlsfhk1 3y ago
    I don't think the problem is that kyber was designed weak. the fear is that the NSA/NIST saw an algorithm that was weaker than it should be and worked nice and hard to make sure it became the standard. the worry isn't a back door, it's unintentional mistakes that are being capitalized on.
    - tptacek 3y ago
      Applying this logic, there is literally nothing NIST could have done here other than not run the competition in the first place; if it's not enough that almost every participant in the competition agrees that it was well conducted --- if the consensus of the whole academic field of post-quantum cryptography doesn't count for anything --- then all you're really saying is that there's no way to create a trustworthy standard. And, to that, I say: hell yes. Cryptographic standards are, in my view, a force for evil. Nobody uses Blake2 because it's "standardized"; they use it because there's a rough consensus of credible, credentialed cryptographers that it's strong, and it's obviously fast. We can do Internet cryptography without entities like NIST and the IETF. This is something Bernstein believes as well; he's said it before (I have my view on standards in part because of his own). But he's not being honest about that here: had his submission won, he'd have endorsed the competition, even though the exact same logic holds --- he should, by this logic, trust his own submission less if it wins. But I also want to be especially candid here: this "NIST is acting as the catspaw of NSA by selecting the weakest standard" argument is also the standard rhetorical fallback for arguers who have just this instant learned that NIST didn't itself design CRYSTALS-Kyber, but don't want to surrender their credibility by admitting it.