A couple of cases come to mind where the NSA is seemed to demonstrate superior awareness of cryptanalytic attacks. But note that in neither case did the NSA rec

A couple of cases come to mind where the NSA is seemed to demonstrate superior awareness of cryptanalytic attacks. But note that in neither case did the NSA recommend the use of a cipher that was weaker than the number of bits on the label. 1. Differential Cryptanalysis https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_involvement_in_the_design https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.2... A general technique, but the DES standard turned out to have been developed to be resistant to it before it was known about in public circles. 2. Impossible differential cryptanalysis https://en.wikipedia.org/wiki/Impossible_differential_cryptanalysis https://en.wikipedia.org/wiki/Impossible_differential_crypta... This general technique was invented and quickly broke 31 out of 32 rounds of Skipjack. Schneier wrote in 1998 "I can't imagine that the NSA would field an algorithm with 32 rounds when they could break 31, so I believe that the NSA did not know about this attack. And the cryptanalysts are still working on improving their attack, so it is possible that they will get to 32 rounds." But no one yet has.