3 ms·

They're adhering to their charter. If you show up to my manager demanding to know why I made a specific engineering decision, he's not going to tell you - that'

by mjg59 1y ago

They're adhering to their charter. If you show up to my manager demanding to know why I made a specific engineering decision, he's not going to tell you - that's not the process, that's not his job, he's going to trust me to make good decisions unless presented with evidence I've misbehaved. But as has been pointed out elsewhere, the distinction between the Dual EC DRBG objections and here are massive. The former had an obvious technical weakness that provided a clear mechanism for a back door, and no technical justification for this was ever meaningfully presented, and also it wasn't an IETF discussion. The counterpoints to Dan's engineering complaints (such as they are) are easily accessible to everyone, Dan just chose not to mention them.

timschmidt 1y ago
> unless presented with evidence The complaint seems well referenced with evidence of poor engineering decisions to me. > Dual EC DRBG ... had an obvious technical weakness that provided a clear mechanism for a back door Removing an entire layer of well tested encryption qualifies as an obvious technical weakness to me. And as I've mentioned elsewhere in these comments, opens users up to a https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack should flaws in the new cipher be found. There is a long history of such flaws being discovered, even after deployment. Several examples of which DJB references. I see no cogent reason for such recklessness, and many reasons to avoid it. Continued pointing toward "procedure" seems to cede the case.
- mjg59 1y ago
  Why don't we hybridise all crypto? We'd get more security if we required RSA+ECDSA+ED25519 at all times, right? Or is the answer that the benefits are small compared to the drawbacks? I am unqualified to provide an answer, but I suspect you are also, and the answer we have from a whole bunch of people who are qualified is that they think the benefits aren't worth it. So why is it fundamentally and obviously true for PQC? This isn't actually an engineering hill I'd die on, if more people I trust made clear arguments for why this is dangerous I'd take it very seriously, but right now we basically have djb against the entire world writing a blogpost that makes ludicrous insinuations and fails to actually engage with any of the counterarguments, and look just no.
  - timschmidt 1y ago
    > Why don't we hybridise all crypto? So you've constructed a strawman. Another indication of ceding the argument. > and the answer we have from a whole bunch of people who are qualified The ultimate job of a manager or a board is to take responsibility for the decisions of the organization. All of your comments in this thread center around abdicating that responsibility to others. > This isn't actually an engineering hill I'd die on Could have fooled me. > we basically have djb against the entire world Many of your comments indicate to me that clashing personalities may be interfering with making the right engineering decision.
    - mjg59 1y ago
      If the argument is "Why adopt a protocol that may rely on a weak algorithm without any additional protection" then I think it's up to you to demonstrate why that argument doesn't apply to any other scenario as well.
      - timschmidt 1y ago
        Again with the strawmen. "Why adopt a protocol that may rely on a weak algorithm without any additional protection" Does not accurately represent the situation at hand. And that seems intentional. "Why weaken an existing protocol in ways we know may be exploitable?" is a more accurate representation. And I believe the burden of evidence lies on those arguing to do so.
        mjg59 1y ago
        Kyber is not known to be weaker than any other well used algorithm.
        timschmidt 1y ago
        Another strawman. No one in this thread said Kyber was known to be weaker. Just that elliptic curve cryptography is well tested, better understood as a consequence of being used in production longer, and that removing it opens up transmissions made without both to attacks on the less widely used algorithm which would not otherwise be successful. It really seems like you're trying not to hear what's been said.
digitalPhonix 1y ago
> If you show up to my manager demanding to know why I made a specific engineering decision, he's not going to tell you Well if your working in a standards development organisation then your manager probably should. It looks like (in the US at least) standards development organisations have to have (and follow) very robust transparency processes to not be default-liable for individual decisions. (Unlike most organisations, such as where where you and your manager from your scenario come from)

by mjg59 1y ago

timschmidt 1y ago

> unless presented with evidence The complaint seems well referenced with evidence of poor engineering decisions to me. > Dual EC DRBG ... had an obvious technical weakness that provided a clear mechanism for a back door Removing an entire layer of well tested encryption qualifies as an obvious technical weakness to me. And as I've mentioned elsewhere in these comments, opens users up to a https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack should flaws in the new cipher be found. There is a long history of such flaws being discovered, even after deployment. Several examples of which DJB references. I see no cogent reason for such recklessness, and many reasons to avoid it. Continued pointing toward "procedure" seems to cede the case.

mjg59 1y ago
Why don't we hybridise all crypto? We'd get more security if we required RSA+ECDSA+ED25519 at all times, right? Or is the answer that the benefits are small compared to the drawbacks? I am unqualified to provide an answer, but I suspect you are also, and the answer we have from a whole bunch of people who are qualified is that they think the benefits aren't worth it. So why is it fundamentally and obviously true for PQC? This isn't actually an engineering hill I'd die on, if more people I trust made clear arguments for why this is dangerous I'd take it very seriously, but right now we basically have djb against the entire world writing a blogpost that makes ludicrous insinuations and fails to actually engage with any of the counterarguments, and look just no.
- timschmidt 1y ago
  > Why don't we hybridise all crypto? So you've constructed a strawman. Another indication of ceding the argument. > and the answer we have from a whole bunch of people who are qualified The ultimate job of a manager or a board is to take responsibility for the decisions of the organization. All of your comments in this thread center around abdicating that responsibility to others. > This isn't actually an engineering hill I'd die on Could have fooled me. > we basically have djb against the entire world Many of your comments indicate to me that clashing personalities may be interfering with making the right engineering decision.
  - mjg59 1y ago
    If the argument is "Why adopt a protocol that may rely on a weak algorithm without any additional protection" then I think it's up to you to demonstrate why that argument doesn't apply to any other scenario as well.
    - timschmidt 1y ago
      Again with the strawmen. "Why adopt a protocol that may rely on a weak algorithm without any additional protection" Does not accurately represent the situation at hand. And that seems intentional. "Why weaken an existing protocol in ways we know may be exploitable?" is a more accurate representation. And I believe the burden of evidence lies on those arguing to do so.
      - mjg59 1y ago
        Kyber is not known to be weaker than any other well used algorithm.
        timschmidt 1y ago
        Another strawman. No one in this thread said Kyber was known to be weaker. Just that elliptic curve cryptography is well tested, better understood as a consequence of being used in production longer, and that removing it opens up transmissions made without both to attacks on the less widely used algorithm which would not otherwise be successful. It really seems like you're trying not to hear what's been said.

digitalPhonix 1y ago

> If you show up to my manager demanding to know why I made a specific engineering decision, he's not going to tell you Well if your working in a standards development organisation then your manager probably should. It looks like (in the US at least) standards development organisations have to have (and follow) very robust transparency processes to not be default-liable for individual decisions. (Unlike most organisations, such as where where you and your manager from your scenario come from)