3 ms·
Rogaway published though: was lack of attention the result of the NSA influencing industry to ignore academic work?
by wbl 13y ago
Rogaway published though: was lack of attention the result of the NSA influencing industry to ignore academic work?
- tptacek 13y agoRogaway didn't publish academically. He commented on the mailing list, and a bunch of standards group denizens pooped all over him. The same thing happened to Dan Bernstein on namedroppers. Is Perry Metzger an NSA agent? I have reason to doubt it.
- anologwintermut 13y agoIs the argument whether using either of the proposed IV generation modes is wrong or if it was do to NSA tampering? It certainly is wrong to do so (and should have been known to be wrong by the time of Rogaway's comment).
- tptacek 13y agoI don't believe it was broadly known to be wrong during IPSEC standardization.
- anologwintermut 13y agoIs that true for the LFSR proposal?I thought LFSRs were basically never thought to be cryptographically secure.
- tptacek 13y agoI don't know the specific proposal, but I know how CBC designs with LFSR-generated IVs work, and why you'd want a deterministic generator for your IVs, and it's because it allows both sides to agree on a non-repeating progression of IVs without actually sending the extra block on every message. LFSRs are also sometimes used in counter mode, too. Again: obviously, a simple LFSR isn't cryptographically secure, and anyone who would deploy one in a cryptosystem probably already knows that. The question is: how are you mounting the attack you're talking about?
- anologwintermut 13y agoDo you know of protocols that use LFSRs for IV generations of cryptographic purposes? Can you link to them ? I'd like to see if they are breakable.
- tptacek 13y agoI've got nothing I can cite to you; it's also true that a lot of bespoke crypto enjoys a lack of usable attacker chosen plaintext, which is admittedly not a good property to rely on for a standard.
- wbl 13y agohttp://www.cs.ucdavis.edu/~rogaway/papers/draft-rogaway-ipsec-comments-00.txt http://www.cs.ucdavis.edu/~rogaway/papers/draft-rogaway-ipse... If you could provide some more information on responses, perhaps emails dismissing it, I think we can figure out what went wrong.
- tptacek 13y agoWhat went wrong with IPSEC was that a bunch of standards group people set out to build a crypto standard that would impact every networking vendor on the planet, and did so with frank and open hostility towards academic cryptographers. The idea that NSA would have tried to subvert IETF implies that IETF was organized enough to subvert. But it wasn't and isn't. IETF is like the Internet's student council. Lots of smart people have involved themselves with IETF, but those among them that I have talked to about it seem universally and profoundly frustrated by the whole process.