NIST denies it weakened its encryption standard to please the NSA The US National Institute of Standards and Technology (NIST) has vehemently denied accusations that it deliberately weakened encryption standards to help the NSA's monitoring activities. "We want to assure the IT cybersecurity community that the transparent, public process used to rigorously vet our standards is still in place …
Supposedly, Anthony Weiner flipped the bird at a reporter as he drove away from his post-electoral slaughter party. Just to complete the circus atmosphere, the latest woman he was caught sending dick pics to camped outside the party, promoting her newfound career as a porn star.
So farewell to public life for Carlos Danger, but you'll be seeing (too much) more of him on local singles chat rooms.....
I don't understand what the big deal is for people here. Yes, they consulted with the NSA. The NSA also contributed code the the linux kernel. Not everything the NSA does is evil (just most of it). Furthermore, it's simply bad to confuse technical issues with personal attacks - in this case, the technical question of whether a crypto standard is secure has nothing directly to do with the provenance of the math. The crypto standard process was still open and public, and the NSA was one of several contributors.
The analogy to MS/ISO is false. There was clear evidence that the ISO was not taking its job of managing the standards process seriously, instead just rubber-stamping something from MS.
And that is the whole issue. We have no way of knowing what tools the NSA may have, or just how that might make their contributions a weakness.
Which means that now, someone (or, more likely, several someones) will have to go over the whole thing again with a fine-toothed comb and a spirit of paranoia, in order to vet once again the work that has already been done.
And even when that is done, there is no being sure that nothing was missed, because we don't know what the NSA can do.
This is probably the worst possible fallout of the whole NSA debacle. Trust is gone, and with it, our security and peace of mind.
To make it short : ignorance really is bliss.
"You need to exclude their contributions entirely." - But how do you know which contributors are spies? It's entirely possible that some spies don't wear cloaks and carry daggers. On the internet, nobody knows you're not a dog --- and they don't know you're not a spook, either. In fact, you might be a spook dog.
>"You need to exclude their contributions entirely." - But how do you know which contributors are spies?
Exactly... but you don't need to exclude - just mistrust and use WISELY. Just as Linus does with Intel/NSA "random" feeds.
Use simple, scrutinised primitives, of diverse design and designers and combine them SIMPLY and CLEANLY. KISS.
Not sure you can trust the NSA's cipher? SIMPLY cascade it with serpent and twofish using 3 independent keys.
Not sure you can trust the NSA's digest? SIMPLY create a compound hash of its hash XORed with those of Whirlpool and Skein.
Ever noticed how VERY MUCH effort has been spent slinging FUD at Truecrypt?
"You need to exclude their contributions entirely." - But how do you know which contributors are spies?
More generally, threat models which can't be implemented aren't useful in practice. They may be of theoretical interest, or more likely (and as is typical in this sort of forum) for waving someone's ideological commitments about, but they provide no guidance for proceeding with actual work in the real world.
I see where he was going with the spousal infidelity analogy, but it falls short.
This is more like walking in on your spouse in bed with your father and your children have been staked to the walls as a sacrifice to Y'glotth. The whole situation is a sick twisted betrayal.
How can the NIST expect anyone to believe that the agency that legally requires them to cooperate in security matters and legally forces its accomplices to lie about complying hasn't forced them to scuttle the standard. I don't think any person or group that has worked with the NSA, by choice or by force, can be trusted anymore.
"I don't think any person or group that has worked with the NSA, by choice or by force, can be trusted anymore."
Well, OK, but that includes everybody who isn't going to risk prison time by disregarding a hush order. Basically, every institution, business and even citizens. It's a deceptive world.
I personally feel until someone pops up with a valid case of misuse, for their particular uses, trust should still be given. What other option do we really have besides breaking down the doors of the Pentagon and finding a naughty list? Until John Doe is mistakenly fingered for "terrorism" when he just downloaded Muslim porn, then I have to believe some credibility is left is institutions. It's either trust no one, or still have trust in entities that clearly are not terroristic.
"I personally feel until someone pops up with a valid case of misuse, for their particular uses, trust should still be given."
How long have you worked for the NSA?
The bottom line is that a new open source open process open vetted encryption system needs to be developed. Preferably using an asymmetric key system.
The fact that the NSA has active plans to subvert NIST standards is quite a strong hint, isn't it? I'd say take the hint and start looking for other partners.
Maybe the Chinese will be happy to offer alternative 'strong' random number generators to add to the Linux XOR slugfest
Instead of blindly trusting institutions that have been shown to be dishonest, how about the government trusting its own citizens (like they're are supposed to be required to do). That would have stopped all of this from ever happening.
No one has to violate their gag orders. I don't think anyone should either. I think that group would draw massive amounts of fire from the government with no positive outcome. Incidentally, I also think it's fairly awful that our government is having to resort to the acts of a despotic regime to keep its own citizens quiet. (Maybe they should order up some of those old "Someone Talked" posters from WWII and post them around).
We've trusted these vendors and standards agencies as partners in delivering products of assured quality. That trust has been broken and until secret government agencies and courts are no longer directly interfering with that circle of trust, they are simply no longer viable partners.
What they've done is absolutely no different than a partner stealing cash from the register or embezzling company funds. As others have stated it is time to look for new partners. Partners that won't (or can't) be manipulated by the government.
Are they paying you or you are being threatened in order to promote trust in those who proved untrustworthy ?
Now that you're saying about breaking down doors it just came to my mind the question of where is the Tea Party now ? They were those who didn't want a government because they couldn't trust it so this story should give them serious ammo so to speak.
It appears here that most of you, but not all, are paranoid as hell. I have to assume that most of you, but not all, were naive enough to believe none of this was happening in the first place. So congratulations, you've just caught up. So just keep on venting paranoia, anger, and distrust every time a Snowden leak occurs.
NSA isn't all bad, if they were, you'd be locked up.
How about this...
NSA is the most supreme agency on the planet. If they say it is so, then so it will be. God bless America, and god bless the NSA! Go Red, White and Blue! Let the eagle soar and don't tread on me!
Hating America is a crime!
"and legally forces its accomplices to lie about complying hasn't forced them to scuttle the standard. I don't think any person or group that has worked with the NSA, "
That's the thing.
It's clear that if they did bow to pressure by the NSA to weaken the algorithm they cannot even say that.
And worse yet they have to lie if directly asked.
What all the chicken little posters on this thread are ignoring is that the NSA, like most government agencies, has a fragmented personality. They aren't all engaged in spying on people. Some significant portion of them are engaged in protecting government assets from being spied on. Their mission is to put out the most secure code possible. And they pursue that as aggressively as the spies pursue theirs.
You are right Tom. They do have fragmented roles and missions.
A schizophrenic rodeo clown also has fragmented roles and missions.
Trusting either is simply too risky as you never know if you are the target of protective measures or exploitative measures nor can you tell if the crazy has kicked in and they can't separate the two things.
The same may or may not apply for various vets of the NSA/GCHQ/etc. out there in the IT industry. If I were running an IT security firm employing these guys, I would probably be talking to HR about how far we can go to screen out any plants.....
"...NIST said that working with the NSA was standard operating procedure; indeed it was required by law to consult with the NSA on security matters. "
We're supposed to understand the legal mandate to have Daddy NSA "consult" as a feature, not a bug.
NSA generously helping us keep our secrets: if it seems too good to be true then it probably isn't true. I love my dog but she's not allowed to guard my bacon.
The challenge is how do you interpret their answers and incorporate that knowledge.
Note from the outline description this algorithm involves both tricky maths and tricky crypto.
So there may be no way to make it both cryptographically strong and fast to execute stably.
Kind of like relying on a processors hardware RNG.
Of one thing we can be sure: It is now illegal in the US to tell the truth about your dealings with the NSA and a lot of other things. The only thing you can do, with impunity, is lie. So, yes, the credibility of every government agency, every American corporation, every American university, and, indeed, every American citizen is shot.
..... they can just, as an industry, come up with a standard answer when responding to questions about their activity with government organisations. If every company responded with 'That would be an ecumenical matter' when questioned we would instantly know they were compromised.
Just because you can't tell the truth doesn't mean you're allowed to lie. If, for example, you are an executive at a corporation, making statements about company activities which are later shown to be objectively false is actually illegal under SEC regulations, and you can end up in prison for that (though more slowly than you might for telling the truth). The only thing that you can do with impunity is refuse to comment.
"Just because you can't tell the truth doesn't mean you're allowed to lie. If, for example, you are an executive at a corporation, making statements about company activities which are later shown to be objectively false is actually illegal under SEC regulations, and you can end up in prison for that (though more slowly than you might for telling the truth). The only thing that you can do with impunity is refuse to comment."
Unless the "refusal to comment" amounts to an implicit affirmative answer, since if they weren't involved, they would be able to answer in the negative. IOW, a "we can neither confirm nor deny" answer basically equates to an answer meaning "we're keeping a secret".
So what if you're caught between two laws, one saying you can go to prison for telling the truth, another saying you can go to prison for lying, the question is a direct yes/no, and vacillating amounts to admission?
Then you won't have many foreign customers, or many foreign CEO's. Americans can write laws all they want for their own people. For everybody else it is safest to deal as little as possible with them. Which includes firing all Americans working in your company.
I agree having 'Americans' working for you guys overseas is a pain in the ass and possibly a security risk but selecting people for termination based on nationality, any nationality, is a really, really, really bad idea.
History has shown that preventing a certain people from working doesn't mean they leave the country (take a look around if you think that's the case). What it does do is force them underground where they, and others like them, build up a social stigma (they took my job, they drive down wages, etc...) After a point the leaders have to do something and putting those people in 'special camps' has a bit of form...
"Silence is Compliance" has a long screwed up history here, even though that thinking goes against the Principals of the Country and Constitution. Assumption of guilt by silence led directly to the (in)famous "can neither confirm nor deny" phase of 'Standard Responses for Bullshitting", then we assumed that was code for "yes" so they just started flat out lying and making others lie for them (via public commentary guidelines and prohibited subject lists).
It is kind if like they decided that since everyone thought they were lying anyway, they would just lie and at least meet expectations. It was the wrong decision though. Misdirection and weasel words are as much of a founding Tradition here as the assumption of innocence and free speech: Everyone expected it since President Washington.
Not many are prepared to accept bald face transparent lies though, and we shouldn't have to. Use your fancy wordsmiths and attempt to assuage 'the people' with idealism, patriotism, nationalism, compassion, strength, etc... if you can't do it that means you failed. That means you stop doing whatever it is. When you have to lie to get it done that's just fucked up: The 'Leaders' of a 'Great Nation' can't rally the very people that elected them? That simply isn't good leadership.
If you are looking for security you want someone who is proven, has the skills and most importantly isnt in doubt. So far the NSA have been caught with their pants down, been photographed and the shocked sheep was not photo shopped! Not only is the NSA's reputation dirt but it stains those it has touched. Especially in an environment such as security.
Exposing the NSA has far reaching consequences for america and it is pretty obvious why the US wanted ed so badly. Since the leak doesnt appear to have any sign of slowing and every revelation causes new upset and more finger pointing I really hope snowden is well protected. He seems to have tore the lid off a huge can of worms
The even sadder thing is one can safely assume there is already at least one shrink-on-duty scribbling volumes on how it would be possible to avoid placing undue pressure / burden on any given agent's conscience in the system in order to prevent them "doing a Snowden", all the while continuing to commit the overall same nasty stuff as before.
This is paranoia. Observers of the tech world getting in a tiz. The NIST process is open. The standards process is open. If you have doubt, you are able to review the standard (and the contemporaneous competing ones), talk to the researchers involved (mainly university professors at the time). You can look to see if any of the many people involved identified problems with the proposed standards at the time (and remember, not all are friends of the US).
Not only does this kind of commentary blacken NIST (and they are fair game) but also the character of the many researchers around the world who were and are involved in designing these standards. If I were such a researcher, I'd be having a word with my lawyers now about the potential for a suit for defamation to authors of posts like this.
The saying is that hindsight is 20/20. I'm sure the long lens of time has revealed potential weaknesses in algorithms designed 20 or more years ago. These are algorithms used like no others so any weaknesses are going to become more evident especially as the computing power to test them increases. But this is not evidence of conspiracy, its evidence that technology progresses and that no one is perfect.
If you have an axe to grind, why not get a PhD in Mathematics with a specialism in number theory and contribute your algorithms to the world. Oh, you can't? It's too difficult is it? Oh, I see, much easier to bray like a sheep and throw shit from the sidelines.
Yes, dumbass, cryptography is is too difficult for most people to do effectively. They can try, but correctly designing and implementing a bespoke system is beyond most. It is a specialization of a small group, that is why that small group MUST have the complete trust and confidence of those who use their work.
The best security in the world is absolutely meaningless if you don't have confidence in its ability. All security (physical, military, computer, etc..,) is 50% technical capabilities and 50% trust. If half of something is gone, then it is broken and only a fool would place their trust in something fundamentally broken.
I need to rephrase what I said above. I wasn't implying that cryptography was simply beyond the skills of intelligent people. I was trying to say that to do it really well, it takes a certain kind of thinking that isn't very prevalent.
Cryptographers and other complex maths adapts are no smarter as a group than any other talented group of specialists, they're just different and uniquely suited to their roles.
"If I were such a researcher, I'd be having a word with my lawyers now about the potential for a suit for defamation to authors of posts like this."
And your lawyers would be laughing at you all the way to the bank as they wonder just how much they can soak you for. Questioning the integrity of any government entity isn't exactly paranoia since government has to be constantly challenged to hold them in check or they will overreach their bounds. Even if NIST does everything perfectly they still require someone to come in and ask questions.
FYI, an appeal to authority is a bit less useful than bat guano or even sheep shit in these parts so try selling that fertilizer elsewhere. Unless you're going to argue that investment bankers are magical specialists who keep the engine of the economy going smoothly and never require an audit once in a while.
But then who do you trust for anything with global relevance? Who's to say YOUR non-US government isn't doing the same thing and just weren't caught doing it? The REAL real problem is we're at a lot point in the world of trust, and trust is an essential part of security. But in terms of security, our trust has become so ephemeral we're almost to the unusable "trust no one" state.
We're floating towards Descartian "Evil Genius" territory, and unfortunately (Sorry, Doc Smith), there is no genuine, imitation-proof symbol of trustworthiness in the universe (at least that we know of).
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
