6 ms·

To use his analogy though, why remove seatbelts? It's like saying we have IPv6 now, why do we need IPv4 support.

tptacek 1y ago
For the same reason your Toyota Camry doesn't have a roll cage. I'd use a hybrid if I was designing a system; I am deeply suspicious of all cryptography, and while I don't think Kyber is going to collapse, I wouldn't bet against 10-15 years of periodic new implementation bugs nobody knew to look for. But I'm cynical about cryptography. It's really clear why people would want a non-hybrid code point. Let me just say this once as clearly as I can: I sort of don't give a shit about any of this. A pox on all their houses. I think official cryptographic standards are a force for evil. More good is going to be done for the world by systems that implement well enough to become de facto standards. More WireGuards, fewer RFCs. Certainly, I can't possibly give even a millifuck about what NIST wants. But I also can't be chill about these blog posts Bernstein writes where it's super clear his audience is not his colleagues in cryptography research, but rather a lay audience that just assumes anything he writes must be true and important. It's gross, because you can see the wires he's using to hold these arguments together (yes, even I can see them), and I don't like it when people insult their audiences this way.
- timschmidt 1y ago
  > For the same reason your Toyota Camry doesn't have a roll cage. It does though. It's just been engineered integral to the unibody. And there are crumple zones, airbags, seat belts, ABS, emergency braking systems, collision sensors, and more layered defenses in addition. No sane engineer would argue that removing these layers of defense would make the car safer.
  - wizzwizz4 1y ago
    If you remove enough of them, then the car is much lighter: in some scenarios (such as when the car has no occupants), that makes it much safer. Of course, these scenarios are relatively rare – but a "sane engineer" could easily make an argument along these lines.
    - timschmidt 1y ago
      Strong disagree. Best practice is to evaluate the likelihood of scenarios along with potential negative impacts and your contrived scenario fails on both counts. It would not survive review. If you are lucky, your senior engineer may consider it a joke. Unlucky and you might be the joke for suggesting it. Either way you'd be liable for such a decision, were it to make it into a production vehicle and result in a death. Which is why many engineers wear the ring. Folks do love to argue though.
- commandersaki 1y ago
  It's really clear why people would want a non-hybrid code point. To me it really isn't. TLS has no need for it. But let's focus the context for some US government organisations that want this for their FIPS maturity level they're aiming for. Why would these organisations want a weaker algorithm for TLS than what is standardised; more importantly how does it benefit deployment except save a tiny bit of computation and eliminate some ECC code. I'm not going to jump the shark and say it is nefarious, but I will throw in my 2 cents and say it doesn't help security and is unnecessary.
  - csande17 1y ago
    And this gets back to the Dual-EC argument, right? Dual-EC was standardized as this weird government thing that maybe you technically need for FIPS, but obviously if you're seriously designing a cryptosystem you wouldn't choose it. And that seems to be GP's position on non-hybrid PQ as well -- just that the reason for not choosing it is "it introduces risk for very little benefit" instead of "it is obviously a bumbling attempt at introducing a backdoor".
    - timschmidt 1y ago
      > Dual-EC was standardized as this weird government thing that maybe you technically need for FIPS, but obviously if you're seriously designing a cryptosystem you wouldn't choose it. Unless NSA pays you $10 million, as they did to RSA, to make said obviously bumbling attempt the default in their security products. https://en.wikipedia.org/wiki/Dual_EC_DRBG#Timeline_of_Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG#Timeline_of_Dual_... https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9BJ1C220131220/ https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9... Or unless the presence of such less secure options in compliant implementations enables a https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack
      - commandersaki 1y ago
        Also: https://eprint.iacr.org/2016/376.pdf https://eprint.iacr.org/2016/376.pdf
- pharrington 1y ago
  You're arguing against deliberate cooperation.
- deleted 1y ago
  [deleted]

For the same reason your Toyota Camry doesn't have a roll cage. I'd use a hybrid if I was designing a system; I am deeply suspicious of all cryptography, and while I don't think Kyber is going to collapse, I wouldn't bet against 10-15 years of periodic new implementation bugs nobody knew to look for. But I'm cynical about cryptography. It's really clear why people would want a non-hybrid code point. Let me just say this once as clearly as I can: I sort of don't give a shit about any of this. A pox on all their houses. I think official cryptographic standards are a force for evil. More good is going to be done for the world by systems that implement well enough to become de facto standards. More WireGuards, fewer RFCs. Certainly, I can't possibly give even a millifuck about what NIST wants. But I also can't be chill about these blog posts Bernstein writes where it's super clear his audience is not his colleagues in cryptography research, but rather a lay audience that just assumes anything he writes must be true and important. It's gross, because you can see the wires he's using to hold these arguments together (yes, even I can see them), and I don't like it when people insult their audiences this way.

timschmidt 1y ago
> For the same reason your Toyota Camry doesn't have a roll cage. It does though. It's just been engineered integral to the unibody. And there are crumple zones, airbags, seat belts, ABS, emergency braking systems, collision sensors, and more layered defenses in addition. No sane engineer would argue that removing these layers of defense would make the car safer.
- wizzwizz4 1y ago
  If you remove enough of them, then the car is much lighter: in some scenarios (such as when the car has no occupants), that makes it much safer. Of course, these scenarios are relatively rare – but a "sane engineer" could easily make an argument along these lines.
  - timschmidt 1y ago
    Strong disagree. Best practice is to evaluate the likelihood of scenarios along with potential negative impacts and your contrived scenario fails on both counts. It would not survive review. If you are lucky, your senior engineer may consider it a joke. Unlucky and you might be the joke for suggesting it. Either way you'd be liable for such a decision, were it to make it into a production vehicle and result in a death. Which is why many engineers wear the ring. Folks do love to argue though.
commandersaki 1y ago
It's really clear why people would want a non-hybrid code point. To me it really isn't. TLS has no need for it. But let's focus the context for some US government organisations that want this for their FIPS maturity level they're aiming for. Why would these organisations want a weaker algorithm for TLS than what is standardised; more importantly how does it benefit deployment except save a tiny bit of computation and eliminate some ECC code. I'm not going to jump the shark and say it is nefarious, but I will throw in my 2 cents and say it doesn't help security and is unnecessary.
- csande17 1y ago
  And this gets back to the Dual-EC argument, right? Dual-EC was standardized as this weird government thing that maybe you technically need for FIPS, but obviously if you're seriously designing a cryptosystem you wouldn't choose it. And that seems to be GP's position on non-hybrid PQ as well -- just that the reason for not choosing it is "it introduces risk for very little benefit" instead of "it is obviously a bumbling attempt at introducing a backdoor".
  - timschmidt 1y ago
    > Dual-EC was standardized as this weird government thing that maybe you technically need for FIPS, but obviously if you're seriously designing a cryptosystem you wouldn't choose it. Unless NSA pays you $10 million, as they did to RSA, to make said obviously bumbling attempt the default in their security products. https://en.wikipedia.org/wiki/Dual_EC_DRBG#Timeline_of_Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG#Timeline_of_Dual_... https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9BJ1C220131220/ https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9... Or unless the presence of such less secure options in compliant implementations enables a https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack
    - commandersaki 1y ago
      Also: https://eprint.iacr.org/2016/376.pdf https://eprint.iacr.org/2016/376.pdf
pharrington 1y ago
You're arguing against deliberate cooperation.
deleted 1y ago
[deleted]