3 ms·
And this gets back to the Dual-EC argument, right? Dual-EC was standardized as this weird government thing that maybe you technically need for FIPS, but obvious
by csande17 1y ago
And this gets back to the Dual-EC argument, right? Dual-EC was standardized as this weird government thing that maybe you technically need for FIPS, but obviously if you're seriously designing a cryptosystem you wouldn't choose it. And that seems to be GP's position on non-hybrid PQ as well -- just that the reason for not choosing it is "it introduces risk for very little benefit" instead of "it is obviously a bumbling attempt at introducing a backdoor".
- timschmidt 1y ago> Dual-EC was standardized as this weird government thing that maybe you technically need for FIPS, but obviously if you're seriously designing a cryptosystem you wouldn't choose it. Unless NSA pays you $10 million, as they did to RSA, to make said obviously bumbling attempt the default in their security products. https://en.wikipedia.org/wiki/Dual_EC_DRBG#Timeline_of_Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG#Timeline_of_Dual_... https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9BJ1C220131220/ https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9... Or unless the presence of such less secure options in compliant implementations enables a https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack
- commandersaki 1y agoAlso: https://eprint.iacr.org/2016/376.pdf https://eprint.iacr.org/2016/376.pdf
- csande17 1y agoYeah. Like, the argument here is that the reason government agencies push stuff into standards is because they do in fact want people to use it. "Well government purchasing is just Like That, surely no one will actually use this option in the real world" is an even weaker counter-argument if the option is not obviously backdoored.