8 ms·
NSA and IETF: Can an attacker purchase standardization of weakened cryptography?
- mjg59 1y agoIt's a touch odd to make a big deal of the fact that you've filed a complaint and fail to mention that it was formally rejected three days before you published the post: https://datatracker.ietf.org/group/iesg/appeals/artifact/146 https://datatracker.ietf.org/group/iesg/appeals/artifact/146
- fn-mote 1y agoLots of respect to both you and the author, but the rejection gives no real response to any of the issues I see raised in the document. It failed to raise my confidence at all. > The IESG has concluded that there were no process failures by the SEC ADs. The IESG declines to directly address the complaint on the TLS WG document adoption matter. Instead, the appellant should refile their complaint with the SEC ADs in a manner which conforms to specified process.
- mjg59 1y agoI feel like if your argument is that the rules weren't followed, you have a pretty strong obligation to follow the rules in submitting your complaint.
- timschmidt 1y agoHaving served on boards, rejections on procedural grounds which fail to address engineering concerns which have been raised stink of a cop-out.
- mjg59 1y agoHave you read the complaint? It's not about engineering concerns, it's about whether procedures were followed correctly.
- timschmidt 1y ago> Have you read the complaint? It's not about engineering concerns, it's about whether procedures were followed correctly. This complaint? https://cr.yp.to/2025/20250812-non-hybrid.pdf https://cr.yp.to/2025/20250812-non-hybrid.pdf Engineering concerns start in section 2 and continue through section 4. It seems you haven't read it.
- mjg59 1y agoThere's a bunch of content that's not actually the complaint, and then there's section 4 which is the actual complaint and is overwhelmingly about procedure.
- timschmidt 1y ago> and then there's section 4 which is the actual complaint and is overwhelmingly about procedure. Ah, yes, procedural complaints such as "The draft creates security risks." and "There are no principles supporting the adoption decision.", and "The draft increases software complexity." I don't know what complaint you're reading, but you're working awful hard to ignore the engineering concerns presented in the one I've read and linked to.
- mjg59 1y agoAs is made clear from the fact that those issues all link to the mailing list, these are not novel issues. They were raised during discussion, taken into account, and the draft authors concluded they were answered adequately. Complaining about them at this point is fundamentally a complaint that the process failed to take these issues into account appropriately, and the issues should be revisited. Given that this was raised to the IESG, who are not the point of contact for engineering issues, the response is focused on that. There's a mechanism Dan can use to push for engineering decisions to be reviewed - he didn't do that.
- timschmidt 1y ago
- EasyMark 1y agoIt's still nice that it was put up for completeness. And as we know this stuff has a long sordid history of people who are proponents of weakening encryption not giving up easily.
- schoen 1y agoDJB has been complaining about this NSA position since 2022 (I guess long before it was an issue at the TLS WG): https://blog.cr.yp.to/20220805-nsa.html https://blog.cr.yp.to/20220805-nsa.html I'm actually quite surprised that anyone is advocating the non-hybrid PQ key exchange for real applications. If it isn't some sort of gimmick to allow NSA to break these, it's sure showing a huge amount of confidence in relatively recently developed mechanisms. It feels kind of like saying "oh, now that we can detect viruses in sewage, hospitals should stop bothering to report possible epidemic outbreaks, because that's redundant with the sewage monitoring capability". (Except worse, because it involves some people who may secretly be pursuing goals that are the opposite of everyone else's.) Edit: DJB said in that 2022 post > Publicly, NSA justifies this by > > . pointing to a fringe case where a careless effort to add an extra security layer damaged security, and > . expressing "confidence in the NIST PQC process".
- tptacek 1y agoExpand on "recently-developed mechanisms".
- schoen 1y agoI don't have a good sense of what to point to as the "mechanism". https://en.wikipedia.org/wiki/Lattice-based_cryptography#History https://en.wikipedia.org/wiki/Lattice-based_cryptography#His... 2005 (LWE), 2012 (LWE for key exchange), earlier (1990s for lattice math in general), 2017 (Kyber submission), later (competition modifications to Kyber)? I can see where one could see the mathematics as moderately mature (comparable in age to ECC, but maybe less intensively studied?). As above, I don't know quite how to think about whether the "thing" here is properly "lattices", "LWE", "LWE-KEX", "Kyber", or "the parameters and instantiation of Kyber from the NIST PQ competition". Depending where we focus our attention there, I suppose this gives us some timeframe from the 1980s (published studies of computational complexity of lattice-related algorithms) to "August 2024" (adoptions of NIST PQ FIPS documents). Edit: The other contextual thing that freaks out DJB, for those who might not be familiar, is that one of the proposed standards NIST was considering, SIKE, made it all the way through to the final (fourth) round of consideration, whereupon it was completely broken by a couple of researchers bringing to bear mathematical insight. Now SIKE had a very different architecture than the other proposals in the fourth round, so it seems like a portion of the debate is whether the undetected mathematical problems in SIKE are symptomatic of "the NIST competition came extraordinarily close to approving something that was totally broken, so maybe it wasn't actually that great at evaluating candidate algorithms, or at least maybe the mathematics community's understanding of post-quantum key exchange algorithms is still immature" or more symptomatic of "SIKE had such a weird and distinctive architecture that it was hard to understand or analyze, or hard to motivate relevant experts to understand or analyze it, unlike other candidate algorithms that were and are much better understood". It seems like DJB is saying the former and you're saying the latter.
- arcfour 1y agoThis is quite concerning, and respect to DJB for fighting against it. However, I have to wonder...who would this actually compromise that matters to NSA? * Targets with sufficient technical understanding would use hybrids anyway. * Average users and unsophisticated targets can already be monitored through PRISM which makes cryptography moot. So...what's their actual end game here?
- skissane 1y agoI think the point is... even if you can't get everyone to adopt your backdoored technology, you are much better off if 30% of the market adopts it than if >1%... Intelligence is a numbers game, they never get everything, but if your net is wide enough and you don't give up, you'll catch a lot of fish over time
- tptacek 1y agoWhat's quite concerning? Be specific.
- arcfour 1y agoIt is concerning that the IETF is moving forward with a proposal that weakens security and is of questionable technical merit, with the most reasonable explanation being that this is the result of efforts by government surveillance agencies to enable or potentially enable monitoring of encrypted communications supposedly protected by this standard; additionally, it is concerning that disagreeing with this decision is being met with censure and outright hostility by leaders of the IETF.
- tptacek 1y agoI'm asking how, specifically, it "weakens security" and is of "questionable technical merits". The IETF isn't a government body.
- Thom2000 1y agoIt's hard to answer your question without repeating the arguments made in the post itself. Are you implying that djb blew the matter out of proportion?
- EasyMark 1y agoThe mere idea that that they want to do this makes me want a 3rd layer of encryption on top of the other 2.
- londons_explore 1y agoEncryption layers are actually pretty cheap for the vast majority of ciphers and applications. Seems dumb not to have like 10.
- krior 1y agoNothing is as cheap (and secure at the same time) as hardware-accelerated AES. Thats why its often the only encryption-layer used.
- marcosdumay 1y ago> Nothing is as cheap as hardware-accelerated AES. Yes, and at the same time all of modern crypto is incredibly cheap and can be added as wished on almost every application without any visible extra costs. So the answer to the GP is not that trivial one. The actual answer is about software complexity making errors more likely, and similar encryption schemes not really adding any resiliency.
- seabass-labrax 1y agoMake sure you absolutely have fresh entropy for all ten of your encryption layers. Re-using secrets and randomness between different encryption algorithms can leak a lot of data!
- commandersaki 1y agoAh FIPS, the bastion of security standards.
- taffronaut 1y agoI misread that as "the bassoon of security standards" and it sent my brain in a whole other direction
- deleted 1y ago[deleted]
- zghst 1y agoThere is so much here to debate about. A) Never trust the cyber feds. B) The NSA is not the place anyone thinks, it’s a Wild West in the most bizarre of places, trust me from experience. C) Cryptology concerns more of than security and exchanging messages or packets, sometimes you don’t even know what kind of thing (living) can and has been decrypted. D) The NSA plays very, very, very dirty. It is like a digital CIA, they are in everything (i.e. cyber spies in various roles at tech/telecom/manufacturer company xyz). E) NEVER LISTEN TO THE DAMN NSA / DRIVEN BY A CULTURE OF EXPLOITATION
- torben-friis 1y ago>sometimes you don’t even know what kind of thing (living) can and has been decrypted. ?
- Y_Y 1y agoOk, aside from not trusting the NSA, could you expand on why someone should trust you?
- heresie-dabord 1y ago> expand on why someone should trust you The point is to trust no one and no thing that we cannot examine freely, closely, and transparently. And to maintain healthy skepticism of any entity that claims to have a virtuous process to do its business.
- dotancohen 1y agoGGP stated: > trust me from experience.
- SV_BubbleTime 1y agoAnd the point is “trust me: trust no one, but especially not them” is the meaning you are ignoring.
- tptacek 1y agoI used to be such a fan of this guy. But he's turned into Ed Zitron, the same long rambling rants, except about cryptography, and except that he knows what he's talking about, and he knows that you have to know literally nothing at all about the field he's commenting on to associated Dual EC with anything happening in PQ. And if you know anything about the field, trying to compare MLKEM with SIKE is the same deal. It's really sad. Dual EC wasn't a shockingly clever, CS-boundary-pushing hack (and NSA has apparently deployed at least one of those in the last 20 years). It was an RNG (not a key agreement protocol) based on asymmetric public key cryptography, a system where you could look at it and just ask "where's the private key?" There wasn't a ton of academic research trying to pick apart flaws in Dual EC because why would there be? Who would ever use it? (It turns out: a big chunk of the industry, which all ran on ultra-closed source code and was much less cryptographically literate that most people thought. I was loudly wrong about this at the time!) MLKEM is a standard realization of CRYSTALS-Kyber, an algorithm submitted to the NIST PQ contest by a team of some of the biggest names in academic PQ cryptography, including Peter Schwabe, a prior collaborator of Bernstein. Nobody is looking at MLKEM and wondering "huh, where's the private key?". MLKEM is based on cryptographic ideas that go back to the 1990s, and were intensively studied in the 2000s. It's not oddball weird cryptography. It is to the lineage of lattice cryptography roughly what Ed25519 was to elliptic curve cryptography at the time of Ed25519's adoption. Utterly unlike SIKE, which isn't a lattice algorithm at all, but rather a supersingular isogeny algorithm, a cryptographic primitive based on an entirely new problem class, and an extremely abstruse one at that. The field had been studying lattice cryptography intensively for decades by the time MLKEM came to pass. That's not remotely true of isogeny cryptography. Isogenies were taken seriously not because of confidence in the hardness of isogenies, but because of ergonomics: they were a drop-in replacement for Diffie Hellman in a way MLKEM isn't. These are all things Bernstein is counting on you not knowing when you read this piece.
- commandersaki 1y agoTo use his analogy though, why remove seatbelts? It's like saying we have IPv6 now, why do we need IPv4 support.
- 1y ago
- greatgib 1y agoFor bigger impact, this article would deserve a tldr executive summary at the beginning I think.
- logicallee 1y agoI skimmed the article, but it doesn't make too much sense. It says: >Surveillance agency NSA and its partner GCHQ are trying to have standards-development organizations endorse weakening ECC+PQ down to just PQ. The NSA spends about half of its resources attempting to hack the FBI and erase its evidence against them in the matter of keeping my wife and me from communicating. The other half of the staff are busy commenting online about how unfair this is, and attempting to get justice. There are no NSA resources left for actions like the one I quoted. I don't think NSA is involved in it.
- philodeon 1y agoAccording to the New York Times in 2013, based on Snowden documents, the NSA allocates $250 million every year for the actions you quoted. They call it the “SIGINT Enabling Project”. They are not running out of resources.
- alphazard 1y agoIt sounds like there is probably some ongoing drama here, but aside from that: this post has convinced me that standards this important need to be decided on by organizations that aren't a government. I wonder who else could reasonably host a standardization process? Maybe the Linux Foundation? All the cryptography talent seems to be working on ZK proofs at the moment in the Ethereum ecosysetem; I think if Vitalik organized a contest like NIST people would pay attention. The most important thing is to incentivize attackers to break the cryptography on dummy examples instead of in the wild. Ideally: before the algorithm is standardized. The Ethereum folks are well setup to offer bounties for this. If a cryptographer can make FU money through responsible disclosure, then there is less incentive to sell the exploit to dishonest parties.
- bgwalter 1y agoThe chilling part is that a guy named Wouters threatens to ban Bernstein in a characteristically rude CoC message: https://mailarchive.ietf.org/arch/msg/tls/RK1HQB7Y-WFBxQaAveeT7pHZbbc/ https://mailarchive.ietf.org/arch/msg/tls/RK1HQB7Y-WFBxQaAve... Trust the process!
- pluto_modadic 1y agoI think... that's because.. DJB was... (gasp) disobeying the code of conduct. and has been, for a long, long, loooong time.
- andai 1y ago> The post-quantum algorithm might turn out to be breakable even with today's computers This implies that what is actually being offered is Security Through Ignorance. Is this encryption sound? Maybe, who knows! Let's wait and find out!
- wartywhoa23 1y agoThe same applies to the raving push to replace RSA with ECC. A long trusted algorithm suddenly became ill-trusted, too complex to implement right, too slow, too unfashionable, and the influx of these accusations was too synchronized and templated to look like something organic.
- 1vuio0pswjnm7 1y agoWe need something better than TLS, a non-standard Maybe an stunnel for CurveCP, or something like PQConnect History has shown djb is usually right He has been far more productive at writing software and developing cryptography that has avoided security vulnerabilities than any of the IETF WG members. The best part about his software IMHO is that it is small with low resource requirements and can primarily serve ordinary individual computer users, as opposed to large, complex, steep learning curve software primarily serving corporations like the ones that publish RFCs and send people to IETF meetings Anyone reading this comment is probably using djb's cryptography in TLS. His contributions to today's internet are substantial It really says a lot about "IETF" and other Silicon Valley pseudo-governance that a talented and trustworthy author, who has remained an academic when so many have sold out, gets treated like a nuisance