5 ms·

I see your point, but be careful of throwing the baby out with the bathwater on this one. AES largely gained popularity in part by the NSA adopting it into the

I see your point, but be careful of throwing the baby out with the bathwater on this one. AES largely gained popularity in part by the NSA adopting it into the "Suite B Crypto" program. The NSA also helped strengthen and develop DSA & SHA during it's early years.

adgjlsfhk1 3y ago
the NSA has always liked somewhat weak encryption. specifically, they would really like if encryption could be broken in very roughly 1 week to 1 year on a super computer.
- sandworm101 3y ago
  Perhaps in the past, but the NSA are good at predicting trends. They know that something broken by a supercomputer today will likely be broken on a smartwatch tomorrow. Intelligence agencies, unlike most tech firms, need to futureproof their secrets for decades. While the NSA no doubt has an interest secret backdoors, I don't think they would today support mathematically weak encryption.
- tptacek 3y ago
  That doesn't make sense as an NSA target, because NSA's adversaries all easily clear that threshold. What NSA supposedly wants are "NOBUS" weaknesses: keyed vulnerabilities for which only they hold the keys.
  - user764743 3y ago
    In the case of the Shadow Brokers, it revealed that those supposed "NOBUS" were low level vulnerabilities that did not need a supercomputer to break.
    - tptacek 3y ago
      A vulnerability isn't "NOBUS" just because it exploits an unpublished zero-day. Dual EC was NOBUS because exploiting it required a curve private key that presumably only NSA had.
- tialaramex 3y ago
  NOBUS (Encryption which Nobody But Us can break) which is the rationale for DES weakness) doesn't make any sense any more today. Can the Americans spend a thousand times more on compute power than the Chinese today? Do they have uniquely intelligent mathematicians? No. So there's no point in popularizing any solutions that the US can break, because if they can the Chinese can break them too. I think lots of people have this idea that everybody thought DES was fine and so the reality of attacks on DES was astonishing, therefore AES won't be any better we're just in the dark somehow. That's just not true, DES was known to be purposefully weak, good enough but not actually good. 56-bit keys and 64-bit block sizes - you can't brute force that with a computer you can buy from the store, but it's not ludicrous and clearly somebody with government money can do it eventually. AES makes those numbers enough bigger that you just can't break it this way.

adgjlsfhk1 3y ago

the NSA has always liked somewhat weak encryption. specifically, they would really like if encryption could be broken in very roughly 1 week to 1 year on a super computer.

sandworm101 3y ago
Perhaps in the past, but the NSA are good at predicting trends. They know that something broken by a supercomputer today will likely be broken on a smartwatch tomorrow. Intelligence agencies, unlike most tech firms, need to futureproof their secrets for decades. While the NSA no doubt has an interest secret backdoors, I don't think they would today support mathematically weak encryption.
tptacek 3y ago
That doesn't make sense as an NSA target, because NSA's adversaries all easily clear that threshold. What NSA supposedly wants are "NOBUS" weaknesses: keyed vulnerabilities for which only they hold the keys.
- user764743 3y ago
  In the case of the Shadow Brokers, it revealed that those supposed "NOBUS" were low level vulnerabilities that did not need a supercomputer to break.
  - tptacek 3y ago
    A vulnerability isn't "NOBUS" just because it exploits an unpublished zero-day. Dual EC was NOBUS because exploiting it required a curve private key that presumably only NSA had.
tialaramex 3y ago
NOBUS (Encryption which Nobody But Us can break) which is the rationale for DES weakness) doesn't make any sense any more today. Can the Americans spend a thousand times more on compute power than the Chinese today? Do they have uniquely intelligent mathematicians? No. So there's no point in popularizing any solutions that the US can break, because if they can the Chinese can break them too. I think lots of people have this idea that everybody thought DES was fine and so the reality of attacks on DES was astonishing, therefore AES won't be any better we're just in the dark somehow. That's just not true, DES was known to be purposefully weak, good enough but not actually good. 56-bit keys and 64-bit block sizes - you can't brute force that with a computer you can buy from the store, but it's not ludicrous and clearly somebody with government money can do it eventually. AES makes those numbers enough bigger that you just can't break it this way.