4 ms·

This is quite concerning, and respect to DJB for fighting against it. However, I have to wonder...who would this actually compromise that matters to NSA? * Tar

This is quite concerning, and respect to DJB for fighting against it. However, I have to wonder...who would this actually compromise that matters to NSA? * Targets with sufficient technical understanding would use hybrids anyway. * Average users and unsophisticated targets can already be monitored through PRISM which makes cryptography moot. So...what's their actual end game here?

skissane 1y ago
I think the point is... even if you can't get everyone to adopt your backdoored technology, you are much better off if 30% of the market adopts it than if >1%... Intelligence is a numbers game, they never get everything, but if your net is wide enough and you don't give up, you'll catch a lot of fish over time
tptacek 1y ago
What's quite concerning? Be specific.
- arcfour 1y ago
  It is concerning that the IETF is moving forward with a proposal that weakens security and is of questionable technical merit, with the most reasonable explanation being that this is the result of efforts by government surveillance agencies to enable or potentially enable monitoring of encrypted communications supposedly protected by this standard; additionally, it is concerning that disagreeing with this decision is being met with censure and outright hostility by leaders of the IETF.
  - tptacek 1y ago
    I'm asking how, specifically, it "weakens security" and is of "questionable technical merits". The IETF isn't a government body.
    - Thom2000 1y ago
      It's hard to answer your question without repeating the arguments made in the post itself. Are you implying that djb blew the matter out of proportion?
      - mjg59 1y ago
        Poor quality analogy: should ed25519 only have been incorporated into protocols in conjunction with another cryptographic primitive? Surely requiring a hybrid with ecdsa would be more secure? Why did djb not argue for everyone using ed25519 to use a hybrid? Was he trying to reduce security? The reason this is a poor quality analogy is that fundamentally ecdsa and ed25519 are sufficiently similar that people had a high degree of confidence that there was no fundamental weakness in ed25519, and so it's fine - whereas for PQC the newer algorithms are meaningfully mathematically distinct, and the fact that SIKE turned out to be broken is evidence that we may not have enough experience and tooling to be confident that any of them are sufficiently secure in themselves and so a protocol using PQC should use a hybrid algorithm with something we have more confidence in. And the counter to that is that SIKE was meaningfully different in terms of what it is and does and cryptographers apparently have much more confidence in the security of Kyber, and hybrid algorithms are going to be more complicated to implement correctly, have worse performance, and so on. And the short answer seems to be that a lot of experts, including several I know well and would absolutely attest are not under the control of the NSA, seem to feel that the security benefits of a hybrid approach don't justify the drawbacks. This is a decision where entirely reasonable people could disagree, and there are people other than djb who do disagree with it. But only djb has engaged in a campaign of insinuating that the NSA has been controlling the process with the goal of undermining security.
        adgjlsfhk1 1y ago
        > seem to feel that the security benefits of a hybrid approach don't justify the drawbacks. The problem with this statement to me is that we know of at least 1/4 finalists in the post quantum cryptography challenge is broken, so it's very hard to assign a high probability that the rest of the algorithms will be secure from another decade of advancement (this is not helped by the fact that since the beginning of the contest, the lattice based methods have lost a signficant number of bits as better attacks have been discovered).
timschmidt 1y ago
Coupled with QUANTUMINSERT, it would enable a https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack even for folks who might otherwise be using stronger encryption methods.
- skininthegame25 1y ago
  [dead]
londons_explore 1y ago
The vast majority of organisations just use whatever default security settings their Cisco router or web browser comes with. The NSA starts by requiring some insecure protocols be supported, and then when support is widespread they start requiring it be made a default by requiring compliance testing be done with default config.
- philsnow 1y ago
  They also historically have extremely deep access to networks, and even if a given corp doesn't allow them to put a box inside the corp's own network, they control / have access to many or all of the links between most corps' datacenters. From this privileged network position, if both sides support weaker crypto that NSA lobbied for, they can MitM the initial connection and omit the hybrid methods from the client's TLS ClientHello, and then client/server proceed to negotiate into a cipher that NSA prefers.
  - londons_explore 1y ago
    Pretty sure this isn't possible?? There must be some way to use a hash of the clientHello later in the key exchange process to make sure the connection fails if the hello is tampered with...?
    - kevvok 1y ago
      Yeah, the ClientHello message(s) are already part of the transcript signed by the server (and the client in mTLS) during the handshake
tgsovlerkhgsel 1y ago
99% of global TLS traffic?

skissane 1y ago

I think the point is... even if you can't get everyone to adopt your backdoored technology, you are much better off if 30% of the market adopts it than if >1%... Intelligence is a numbers game, they never get everything, but if your net is wide enough and you don't give up, you'll catch a lot of fish over time

tptacek 1y ago

What's quite concerning? Be specific.

arcfour 1y ago
It is concerning that the IETF is moving forward with a proposal that weakens security and is of questionable technical merit, with the most reasonable explanation being that this is the result of efforts by government surveillance agencies to enable or potentially enable monitoring of encrypted communications supposedly protected by this standard; additionally, it is concerning that disagreeing with this decision is being met with censure and outright hostility by leaders of the IETF.
- tptacek 1y ago
  I'm asking how, specifically, it "weakens security" and is of "questionable technical merits". The IETF isn't a government body.
  - Thom2000 1y ago
    It's hard to answer your question without repeating the arguments made in the post itself. Are you implying that djb blew the matter out of proportion?
    - mjg59 1y ago
      Poor quality analogy: should ed25519 only have been incorporated into protocols in conjunction with another cryptographic primitive? Surely requiring a hybrid with ecdsa would be more secure? Why did djb not argue for everyone using ed25519 to use a hybrid? Was he trying to reduce security? The reason this is a poor quality analogy is that fundamentally ecdsa and ed25519 are sufficiently similar that people had a high degree of confidence that there was no fundamental weakness in ed25519, and so it's fine - whereas for PQC the newer algorithms are meaningfully mathematically distinct, and the fact that SIKE turned out to be broken is evidence that we may not have enough experience and tooling to be confident that any of them are sufficiently secure in themselves and so a protocol using PQC should use a hybrid algorithm with something we have more confidence in. And the counter to that is that SIKE was meaningfully different in terms of what it is and does and cryptographers apparently have much more confidence in the security of Kyber, and hybrid algorithms are going to be more complicated to implement correctly, have worse performance, and so on. And the short answer seems to be that a lot of experts, including several I know well and would absolutely attest are not under the control of the NSA, seem to feel that the security benefits of a hybrid approach don't justify the drawbacks. This is a decision where entirely reasonable people could disagree, and there are people other than djb who do disagree with it. But only djb has engaged in a campaign of insinuating that the NSA has been controlling the process with the goal of undermining security.
      - adgjlsfhk1 1y ago
        > seem to feel that the security benefits of a hybrid approach don't justify the drawbacks. The problem with this statement to me is that we know of at least 1/4 finalists in the post quantum cryptography challenge is broken, so it's very hard to assign a high probability that the rest of the algorithms will be secure from another decade of advancement (this is not helped by the fact that since the beginning of the contest, the lattice based methods have lost a signficant number of bits as better attacks have been discovered).

timschmidt 1y ago

Coupled with QUANTUMINSERT, it would enable a https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack even for folks who might otherwise be using stronger encryption methods.

skininthegame25 1y ago
[dead]

londons_explore 1y ago

The vast majority of organisations just use whatever default security settings their Cisco router or web browser comes with. The NSA starts by requiring some insecure protocols be supported, and then when support is widespread they start requiring it be made a default by requiring compliance testing be done with default config.

philsnow 1y ago
They also historically have extremely deep access to networks, and even if a given corp doesn't allow them to put a box inside the corp's own network, they control / have access to many or all of the links between most corps' datacenters. From this privileged network position, if both sides support weaker crypto that NSA lobbied for, they can MitM the initial connection and omit the hybrid methods from the client's TLS ClientHello, and then client/server proceed to negotiate into a cipher that NSA prefers.
- londons_explore 1y ago
  Pretty sure this isn't possible?? There must be some way to use a hash of the clientHello later in the key exchange process to make sure the connection fails if the hello is tampered with...?
  - kevvok 1y ago
    Yeah, the ClientHello message(s) are already part of the transcript signed by the server (and the client in mTLS) during the handshake

tgsovlerkhgsel 1y ago

99% of global TLS traffic?