35 ms·
Let's opt for the simplest possible way to describe this. A good number of the proposals (in particular, the proposals that actually got close to being chosen)
by cassonmars 2mo ago
Let's opt for the simplest possible way to describe this.
A good number of the proposals (in particular, the proposals that actually got close to being chosen), are based on lattice constructions.
NTRU's underlying construction has been available to scrutinize for 30 years, whereas the Module-LWE proposals (Kyber being one) has had 11 years. Keep in mind, the largest employer (and under very tight classified controls) of number theorists _is_ the NSA. In terms of overall intellectual power, if there _is_ a problem in the MLWE constructions, they'd very likely be the first to find it, all while not saying a single word. Then, despite clear objections laid out by people with explicit expertise on the distinctions between RLWE and MLWE, especially w/r/t parameter choice, Kyber, under weaker parameters, was chosen anyway.
We can't rely on the obvious tells anymore – they've already played that hand (EC-DRBG) and were caught. If a bad standard is being pushed, it has to be done in a way that is so subtle, that it literally comes up to, "yeah, maybe this is weaker, but we haven't found a way to prove that". DJB already lost the selection process, so now the goal is to at the very least, avoid recommendations that push an unshielded, far less historically tested option, with no helpful antidote if it were to be broken.
I get that generally assuming conspiracies is a bad starting place for debate (after all, how do you disprove a hypothesis that is expected to be so surreptitiously constructed that it evades all ability to be scrutinized?), and I'd similarly think this is an unreasonable assumption, except for the fact _it has already happened and been exposed, multiple times_.
- tptacek 2mo agoWait, first off, I want to note here that you're suggesting that 1990s NTRU is a more trustworthy design than Module-LWE. But the bigger problem is with your logic. It applies to literally any other choice NIST could have made. If they had selected Classical McEliece, another Bernstein submission, people like you would be on threads pointing and saying "see, the security of McEliece is collapsing before our eyes, of course NSA forced NIST to choose it".