3 ms·

I kind of worry about that, too. Up until now, it has been NSA pretty much the ones establishing the new security standards, since they have the best minds on i

by devx 13y ago

I kind of worry about that, too. Up until now, it has been NSA pretty much the ones establishing the new security standards, since they have the best minds on it. But now we can't trust them, or even anyone who's "worked" for them, but now quit because of it was revealed that they are doing with their work (at least I like to imagine there are people who think like that at the NSA). So what now? I guess my hope is more math and cryptography professors from around the world (not just US), will put their minds to work on this, in the interest of the whole Internet community. If that happens, in the end would be for the best.

quaunaut 13y ago
> Up until now, it has been NSA pretty much the ones establishing the new security standards, since they have the best minds on it. They have? I thought they were still regularly fought and ignored by the rest of the crypto community.
derefr 13y ago
Here's an idea for one of those "We The People" petitions: split up the NSA's COMSEC and SIGINT/MASINT divisions into two-or-more agencies. The COMSEC one can keep being the "National Security Agency"; the SIGINT one can be the "Central Signals Agency" or something[1]. Now add a law stating that: - the CSA can't do any SIGINT that works at cross-purposes to the NSA's mission (e.g. putting backdoors in crypto libraries so widely-used that government secrets are likely riding over lines relying on those libraries somewhere), and that - any time the CSA discovers a problem with crypto the NSA relies on, they have to immediately communicate that fact to the NSA, and that communication has to go through public channels. With that in place, I'd feel safe (in fact, safer than ever before) trusting the NSA's crypto. They'd have one pure incentive-structure: good crypto for securing gov/mil communications; and the CSA, though wreaking havoc everywhere else, would be locked out of hindering them in it. --- [1] not "Foreign Signals Agency", since they don't seem to plan on relinquishing their Domestic Signals.
- harrytuttle 13y ago
  You think adding laws is going to solve the problem? Not a chance.
  - derefr 13y ago
    Solve which problem? Adding laws could solve the very small problem of "NSA crypto being trustworthy crypto for use by anyone other than the NSA." Obviously my proposal won't solve any large problems (like making the organization I dubbed the CSA stop... doing the stuff it does; which implicitly further requires that the government stop wanting them to do that stuff.) But specific problems have specific solutions.

by devx 13y ago

quaunaut 13y ago

> Up until now, it has been NSA pretty much the ones establishing the new security standards, since they have the best minds on it. They have? I thought they were still regularly fought and ignored by the rest of the crypto community.

derefr 13y ago

Here's an idea for one of those "We The People" petitions: split up the NSA's COMSEC and SIGINT/MASINT divisions into two-or-more agencies. The COMSEC one can keep being the "National Security Agency"; the SIGINT one can be the "Central Signals Agency" or something[1]. Now add a law stating that: - the CSA can't do any SIGINT that works at cross-purposes to the NSA's mission (e.g. putting backdoors in crypto libraries so widely-used that government secrets are likely riding over lines relying on those libraries somewhere), and that - any time the CSA discovers a problem with crypto the NSA relies on, they have to immediately communicate that fact to the NSA, and that communication has to go through public channels. With that in place, I'd feel safe (in fact, safer than ever before) trusting the NSA's crypto. They'd have one pure incentive-structure: good crypto for securing gov/mil communications; and the CSA, though wreaking havoc everywhere else, would be locked out of hindering them in it. --- [1] not "Foreign Signals Agency", since they don't seem to plan on relinquishing their Domestic Signals.

harrytuttle 13y ago
You think adding laws is going to solve the problem? Not a chance.
- derefr 13y ago
  Solve which problem? Adding laws could solve the very small problem of "NSA crypto being trustworthy crypto for use by anyone other than the NSA." Obviously my proposal won't solve any large problems (like making the organization I dubbed the CSA stop... doing the stuff it does; which implicitly further requires that the government stop wanting them to do that stuff.) But specific problems have specific solutions.