4 ms·

It's also very concerning that are least 2 NSA employees working within IETF groups as far as I know, and they don't want to get rid of them. One is the one Tre

It's also very concerning that are least 2 NSA employees working within IETF groups as far as I know, and they don't want to get rid of them. One is the one Trevor Perrin called out from the CFRG, but I remember someone else calling out another on a security blog, either months before the Snowden leaks came out or soon after. NSA is not to be trusted in terms of security anymore, when by far their main priority these days is to undermine the security of protocols. If certain organizations don't want to get rid of them, then I can't trust that organization either. And I don't care how much of a "good guy" he is within the organization. It's probably his job to play the good guy.

derefr 13y ago
Having NSA employees standardizing TLS extensions is about as surprising as having Google employees standardizing HTTP extensions. The NSA isn't just a bunch of spies; they're also the managers of the US government's crypto infrastructure. If the USG wants to make some devices--secure phones, say--that use TLS in a weird way, but wants other devices--commercial off-the-shelf routers, say--to be able to interoperate with those devices, then the USG gets the NSA to draft a TLS extension allowing the routers to consider the behavior of the secure phone normative.