4 ms·
When I looked more into the SHAs and SELinux a while ago, I had always wondered why the NSA would create/sponsor these things.
by vincie 13y ago
When I looked more into the SHAs and SELinux a while ago, I had always wondered why the NSA would create/sponsor these things.
- tptacek 13y agoBecause NSA is chartered with assisting the USG and, as a knock-on effect, the US economy, with infosec. It's part of their job. Just like designing secure ciphers is part of their job, along with breaking them.
- vincie 13y agoWhy not leave it to the private sector?
- tptacek 13y agoAmong other reasons, because the private sector sucks at it.
- vincie 13y agoThe latest SHA3 was determined in a competition amongst private sector contestants, won by Keccak. Schneier himself put up a candidate - Skein. Edit: Then there's TrustedBSD (as opposed to SELinux)
- tptacek 13y agoSHA3 was a contest run by NIST, known to its friends by its other name, NSA.
- deleted 13y ago[deleted]
- superuser2 13y agoHave you seen what passes for security, even in tech companies that sell primarily security?
- MichaelGG 13y agoActual quote from the CTO of a company that makes some security-related software (it's a major selling point) for a specific sector. They probably have over a hundred million people using this stuff day-to-day, indirectly, and hundreds of direct, large customers. Security bypass can easily cost hundreds of thousands a month. I had found a backdoor in their platform, so I asked if they had such basic holes, how they managed to write a large C-based app securely. Like, buffer overflows, for example. CTO/head of development replied: "Buffer overflows? Probably not an issue, unless the network is really fast." Cringe.
- lawnchair_larry 13y agoBullshit. "Even agency programs ostensibly intended to guard American communications are sometimes used to weaken protections. The N.S.A.’s Commercial Solutions Center, for instance, invites the makers of encryption technologies to present their products and services to the agency with the goal of improving American cybersecurity. But a top-secret N.S.A. document suggests that the agency’s hacking division uses that same program to develop and “leverage sensitive, cooperative relationships with specific industry partners” to insert vulnerabilities into Internet security products. "
- tptacek 13y agoObviously you're not an SELinux fan.
- hobb0001 13y agoThe NSA is a schizophrenic organization. It is tasked with two opposing goals: - To eavesdrop on the communications of foreign entities. - To protect our own government from foreign entities that are doing the same. It is the latter directive that has provided SELinux and AES.
- meepmorp 13y agoThere's nothing at all opposing about those goals. They're both natural by products of expertise in signals intelligence and cryptanalysis, and skill breaking security helps provide more secure systems by subjecting them to more sophisticated attacks.
- hobb0001 13y agoTrue enough. It has only become schizophrenic lately because it is now eavesdropping on domestic communication as well.
- atonse 13y agoJust as a clarification, NSA doesn't set those standards. Agencies like NIST set AES and SHA3 through open worldwide competitions. These standards then become parts of larger compliance guidelines like FIPS (Federal Information Protection Standard I think) that govern how the USG should protect its data.
- tptacek 13y agoNIST has like 2 cryptographers, doesn't it? The real guidance at NIST comes from NSA. If you think NSA is backdooring Suite B crypto, you can't trust NIST.