3 ms·
The article is a bit weird, so here's my summary of the situation, as someone in the security field: - Berstein, an extremely esteemed security researcher[0],
by BoppreH 3y ago
The article is a bit weird, so here's my summary of the situation, as someone in the security field:
- Berstein, an extremely esteemed security researcher[0], published a long blog post last week[1] criticizing NIST's standardization process for new Post-Quantum-Crypto algorithms. He is focusing on the selection of Key Encapsulation Mechanisms (think TLS key exchange). Two big options are Kyber and NTRU (coauthored by Berstein).
- His main complaint is that NIST is playing fast and loose with the selection process, and had disqualified a fast NTRU variant due to barely not meeting a certain security threshold. The missing variant makes NTRU look slower and less flexible than it actually is.
- Meanwhile, NIST accepted a similar fast Kyber variant based on shaky assumptions. Berstein argues at length that it doesn't meet the security threshold either and should be disqualified. Funnily, NIST used Berstein's own research in (seemingly) incorrect fashion to argue for Kyber's security.
- There's an air of impropriety, as if NIST was favoring one algorithm over the other, for unknown reasons. And in the beginning of the post, Berstein shows the results of his recent lawsuit to reveal more information about the internal NIST process: it seems that NIST and NSA met more often than previously thought.
My interpretation leans more towards NIST making an internal mistake in evaluating the algorithms, rather than NSA pushing its agenda. One could argue that Berstein is sour that his algorithm might not be picked, and is trying underhanded tactics. On the other hand, he does have excellent reputation, and convincingly argues that NIST made an important mistake and is not transparent enough.
[0] https://www.metzdowd.com/pipermail/cryptography/2016-March/028824.html https://www.metzdowd.com/pipermail/cryptography/2016-March/0...
[1] https://blog.cr.yp.to/20231003-countcorrectly.html https://blog.cr.yp.to/20231003-countcorrectly.html
- fitblipper 3y ago> My interpretation leans more towards NIST making an internal mistake in evaluating the algorithms, rather than NSA pushing its agenda. Why do you say this? The NSA has done this exact thing in the past[1], so why give them the benefit of the doubt this time? [1] https://en.m.wikipedia.org/wiki/Dual_EC_DRBG https://en.m.wikipedia.org/wiki/Dual_EC_DRBG
- BoppreH 3y agoBecause Dual_EC_DRBG was very heavy handed. It was driven by NSA itself (and based on a paper named "Kleptography"!); the backdoor was obvious; and they had to ~bribe~ monetarily incentivize companies to actually implement and use it. Meanwhile, both NTRU and Kyber are lattice-based, and their designs came from honest attempts. To be an NSA effort, there would need to exist an exploitable flaw in Kyber, but not NTRU, known only to the NSA. And it's not like NTRU as a whole got disqualified; only the fastest variant did. That's the problem with spy agencies, you never know what they are capable of. But if it was an NSA effort, it would be, by far, the most subtle one uncovered so far.
- akdor1154 3y agoThere is definitely a selection bias if judging 'subtlety of NSA activities' by only examining 'NSA activities that were unsubtle enough to be discovered'.
- vlovich123 3y agoThere’s no reason to believe that the NSA doesn’t learn and evolve from past efforts. Changing rules on the fly and improperly applying said rules could be a way to select a weak option you can break while having stronger plausible deniability than what happened with Dual_EC_DRBG (which btw wasn’t actually confirmed until the Snowden leak). So here’s someone claiming NIST is being suspicious in how the algorithm selection happened. The rules really need to be set in stone at the beginning of the competition or before the phases at least. And you can’t pick diametrically opposed rule sets between phases (as happened if you read Bernstein’s letter), only tweaks.
- TMWNN 3y agoOn the other hand, DES is an example of where people were sure that NSA persuaded IBM to weaken it but, to quote Bruce Schneier, "It took the academic community two decades to figure out that the NSA 'tweaks' actually improved the security of DES". <https://www.cnet.com/news/privacy/saluting-the-data-encryption-legacy/ https://www.cnet.com/news/privacy/saluting-the-data-encrypti...>
- matthewdgreen 3y agoIf “an academic is sour they didn’t receive credit” and “an academic wants to help the world” are both on the menu, you should always linger over the first possibility. Hell, I’m an academic and you should consider it in regards to this post.