3 ms·

I don't think the problem is that kyber was designed weak. the fear is that the NSA/NIST saw an algorithm that was weaker than it should be and worked nice and

I don't think the problem is that kyber was designed weak. the fear is that the NSA/NIST saw an algorithm that was weaker than it should be and worked nice and hard to make sure it became the standard. the worry isn't a back door, it's unintentional mistakes that are being capitalized on.

tptacek 3y ago
Applying this logic, there is literally nothing NIST could have done here other than not run the competition in the first place; if it's not enough that almost every participant in the competition agrees that it was well conducted --- if the consensus of the whole academic field of post-quantum cryptography doesn't count for anything --- then all you're really saying is that there's no way to create a trustworthy standard. And, to that, I say: hell yes. Cryptographic standards are, in my view, a force for evil. Nobody uses Blake2 because it's "standardized"; they use it because there's a rough consensus of credible, credentialed cryptographers that it's strong, and it's obviously fast. We can do Internet cryptography without entities like NIST and the IETF. This is something Bernstein believes as well; he's said it before (I have my view on standards in part because of his own). But he's not being honest about that here: had his submission won, he'd have endorsed the competition, even though the exact same logic holds --- he should, by this logic, trust his own submission less if it wins. But I also want to be especially candid here: this "NIST is acting as the catspaw of NSA by selecting the weakest standard" argument is also the standard rhetorical fallback for arguers who have just this instant learned that NIST didn't itself design CRYSTALS-Kyber, but don't want to surrender their credibility by admitting it.
- myrion 3y ago
  At least for myself, I disagree that NIST could only win by not running the competition. The impression I have right now is that they made some mistakes and in response to having those pointed out went "well, that's just like, your opinion, man" instead of explaining why it's not a mistake, or fixing it, or something. That's what makes me suspicious, anyway.
- adgjlsfhk1 3y ago
  > if the consensus of the whole academic field of post-quantum cryptography doesn't count for anything This is precisely not what I'm saying (and isn't what's happening here). What I'm saying is that given the evidence presented about NIST repeatedly changing evaluation methods, incorrectly calculating the strength of the Kyber, and refusing to clarify any of the above, it really looks like NIST had an outcome that they wanted to reach and took the actions necessary to reach that outcome. It's also really weird to say "it's not enough that almost every participant in the competition agrees that it was well conducted" in response to the lead designers of one of the two primary algorithms saying that the competition wasn't well conducted. With a competition like this, you do expect some people to think that the decision criteria weren't quite the right ones or something like that, but here there's a very clear accusation that NIST either just lied about the security of Kyber or messed it up and refused to correct it when it was pointed out to them.
  - tptacek 3y ago
    https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/W2VOzy0wz_E/m/LjmQyMurBQAJ https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/W2VO...
deleted 3y ago
[deleted]

tptacek 3y ago

Applying this logic, there is literally nothing NIST could have done here other than not run the competition in the first place; if it's not enough that almost every participant in the competition agrees that it was well conducted --- if the consensus of the whole academic field of post-quantum cryptography doesn't count for anything --- then all you're really saying is that there's no way to create a trustworthy standard. And, to that, I say: hell yes. Cryptographic standards are, in my view, a force for evil. Nobody uses Blake2 because it's "standardized"; they use it because there's a rough consensus of credible, credentialed cryptographers that it's strong, and it's obviously fast. We can do Internet cryptography without entities like NIST and the IETF. This is something Bernstein believes as well; he's said it before (I have my view on standards in part because of his own). But he's not being honest about that here: had his submission won, he'd have endorsed the competition, even though the exact same logic holds --- he should, by this logic, trust his own submission less if it wins. But I also want to be especially candid here: this "NIST is acting as the catspaw of NSA by selecting the weakest standard" argument is also the standard rhetorical fallback for arguers who have just this instant learned that NIST didn't itself design CRYSTALS-Kyber, but don't want to surrender their credibility by admitting it.

myrion 3y ago
At least for myself, I disagree that NIST could only win by not running the competition. The impression I have right now is that they made some mistakes and in response to having those pointed out went "well, that's just like, your opinion, man" instead of explaining why it's not a mistake, or fixing it, or something. That's what makes me suspicious, anyway.
adgjlsfhk1 3y ago
> if the consensus of the whole academic field of post-quantum cryptography doesn't count for anything This is precisely not what I'm saying (and isn't what's happening here). What I'm saying is that given the evidence presented about NIST repeatedly changing evaluation methods, incorrectly calculating the strength of the Kyber, and refusing to clarify any of the above, it really looks like NIST had an outcome that they wanted to reach and took the actions necessary to reach that outcome. It's also really weird to say "it's not enough that almost every participant in the competition agrees that it was well conducted" in response to the lead designers of one of the two primary algorithms saying that the competition wasn't well conducted. With a competition like this, you do expect some people to think that the decision criteria weren't quite the right ones or something like that, but here there's a very clear accusation that NIST either just lied about the security of Kyber or messed it up and refused to correct it when it was pointed out to them.
- tptacek 3y ago
  https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/W2VOzy0wz_E/m/LjmQyMurBQAJ https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/W2VO...

deleted 3y ago

[deleted]