3 ms·

They did both - they strengthened it from differential integrity but weakened it by picking a known-to-be-too-short key length. Meaning they had the compute pow

They did both - they strengthened it from differential integrity but weakened it by picking a known-to-be-too-short key length. Meaning they had the compute power to crack it but others couldn’t do the same through pure algorithmic means. As for your post below > it can't be that NSA simply knows a vulnerability that impacts one very specific lattice scheme and not the others Ok. My argument is they know all lattice schemes are weak and the push to use a lattice-only scheme is precisely to have a cryptographic mechanism they can easily bypass without a classical known-secure backstop.

tptacek 2mo ago
See, here's another argument that doesn't work here, because Bernstein very publicly backs a different lattice cryptography scheme. In addition to the previously-stated reason why that argument is inoperative (besides being unfalsifiable, it admits a strategy where NSA "poisons the well" to get people to avoid a particular construction or family of algorithms, so that we all move to weaker ones --- a counterfactual that should be much more vivid after what was released this week!)
- vlovich123 2mo ago
  Does Bernstein back using the alternate scheme exclusively or combined as a hybrid? You’re arguing in bad faith throughout the thread, taking the weakest possible interpretation of anything said and extrapolating to nonsensical positions to paint the people who disagree with you as idiots. Please do better.
  - tptacek 2mo ago
    We'll never know, because he only started advocating for hybrids after MLKEM happened. When he did 25519, he did not advocate for 25519/RSA or 25519/FFDH or 25519/P256 hybrids. Agree or disagree with my arguments on substance; it's fine, we're all coming to this with different priors, levels of experience, familiarity with the drama and with the underlying issues, etc. But this "do better, you're in bad faith" stuff is just chaff, and you'd do well to leave it out of your comments. (It's hard sometimes for me to do that, too. Disagreement is tough!)
    - vlovich123 2mo ago
      Why do you then argue from both sides that no one is proposing lattice only for standardization while simultaneously clearly pushing that it should be lattice only? And clearly there is a concern for the lattice only recommendation, even if not officially a standard, being recommended as one. As for why he didn’t advocate for hybrid schemes for 25519, I can’t speak for him. I’m going to guess that it might have something to do with elliptic curve cryptography preceding lattice by 11 years in teens of initial implementation and in more practical terms it’s ahead in terms of research and application by 25-30 years for constructing the algorithms and building solid implementations. Lattice cryptography is fairly nascent and new, with most attention in the past 10-15 years. Both algorithms and implementations have seen significant vulnerabilities discovered. But you know obviously know this which is why it feels to me like you are presenting arguments in bad faith.
      - tptacek 2mo ago
        Lattice cryptography is not in fact fairly nascent. It's new to you, which is not the same thing. That's why I raised the point about 25519's vintage: you're thinking about 25519 in today's context (which, ironically, has taken some of the shine off of it!) and not in the context of 2005, when it was introduced. When TextSecure adopted Curve25519, Bernstein didn't complain and say "you should be doing hybrid triple-FFDH/triple-Curve25519". This is especially useful to know given that mainstream elliptic curve and lattice cryptography are of roughly the same vintage. As commercial propositions, things actually getting fitted into protocols, both date back to the mid-1990s. For a time, there was a question as to whether NTRU might succeed RSA rather than elliptic curves! Nobody's arguing from "both sides". You're continuing to misconstrue what's happening. It's also not true that "nobody is proposing lattice-only". The whole point of this story is that pure MLKEM is a proposal on the table. It has to be, because there are environments that need to use it (that, or not do PQC at all). None of them are environments you're ever likely to work in, and hybrids remain the default and the only PQC KEM standards-track RFC for PQC in development. I'm going to keep pointing out that a lot of the reason you don't have this context is that Bernstein doesn't want you to. He expects you to take his word for it.

tptacek 2mo ago

See, here's another argument that doesn't work here, because Bernstein very publicly backs a different lattice cryptography scheme. In addition to the previously-stated reason why that argument is inoperative (besides being unfalsifiable, it admits a strategy where NSA "poisons the well" to get people to avoid a particular construction or family of algorithms, so that we all move to weaker ones --- a counterfactual that should be much more vivid after what was released this week!)

vlovich123 2mo ago
Does Bernstein back using the alternate scheme exclusively or combined as a hybrid? You’re arguing in bad faith throughout the thread, taking the weakest possible interpretation of anything said and extrapolating to nonsensical positions to paint the people who disagree with you as idiots. Please do better.
- tptacek 2mo ago
  We'll never know, because he only started advocating for hybrids after MLKEM happened. When he did 25519, he did not advocate for 25519/RSA or 25519/FFDH or 25519/P256 hybrids. Agree or disagree with my arguments on substance; it's fine, we're all coming to this with different priors, levels of experience, familiarity with the drama and with the underlying issues, etc. But this "do better, you're in bad faith" stuff is just chaff, and you'd do well to leave it out of your comments. (It's hard sometimes for me to do that, too. Disagreement is tough!)
  - vlovich123 2mo ago
    Why do you then argue from both sides that no one is proposing lattice only for standardization while simultaneously clearly pushing that it should be lattice only? And clearly there is a concern for the lattice only recommendation, even if not officially a standard, being recommended as one. As for why he didn’t advocate for hybrid schemes for 25519, I can’t speak for him. I’m going to guess that it might have something to do with elliptic curve cryptography preceding lattice by 11 years in teens of initial implementation and in more practical terms it’s ahead in terms of research and application by 25-30 years for constructing the algorithms and building solid implementations. Lattice cryptography is fairly nascent and new, with most attention in the past 10-15 years. Both algorithms and implementations have seen significant vulnerabilities discovered. But you know obviously know this which is why it feels to me like you are presenting arguments in bad faith.
    - tptacek 2mo ago
      Lattice cryptography is not in fact fairly nascent. It's new to you, which is not the same thing. That's why I raised the point about 25519's vintage: you're thinking about 25519 in today's context (which, ironically, has taken some of the shine off of it!) and not in the context of 2005, when it was introduced. When TextSecure adopted Curve25519, Bernstein didn't complain and say "you should be doing hybrid triple-FFDH/triple-Curve25519". This is especially useful to know given that mainstream elliptic curve and lattice cryptography are of roughly the same vintage. As commercial propositions, things actually getting fitted into protocols, both date back to the mid-1990s. For a time, there was a question as to whether NTRU might succeed RSA rather than elliptic curves! Nobody's arguing from "both sides". You're continuing to misconstrue what's happening. It's also not true that "nobody is proposing lattice-only". The whole point of this story is that pure MLKEM is a proposal on the table. It has to be, because there are environments that need to use it (that, or not do PQC at all). None of them are environments you're ever likely to work in, and hybrids remain the default and the only PQC KEM standards-track RFC for PQC in development. I'm going to keep pointing out that a lot of the reason you don't have this context is that Bernstein doesn't want you to. He expects you to take his word for it.