Slashdot Mirror
Distrustful US Allies Force Spy Agency To Back Down In Encryption Fight (reuters.com)
schwit1 shares a report from Reuters: An international group of cryptography experts has forced the U.S. National Security Agency to back down over two data encryption techniques it wanted set as global industry standards, reflecting deep mistrust among close U.S. allies. In interviews and emails seen by Reuters, academic and industry experts from countries including Germany, Japan and Israel worried that the U.S. electronic spy agency was pushing the new techniques not because they were good encryption tools, but because it knew how to break them. The NSA has now agreed to drop all but the most powerful versions of the techniques -- those least likely to be vulnerable to hacks -- to address the concerns.
we give you the 12 we didn't want to keep the 5 we did.
This is the same crap about the Dual EC DRBG. Really NOTHING new to see here. Everybody knows not to use this, most software has already had it removed. Yawn.
" In interviews and emails seen by Reuters, academic and industry experts from countries including Germany, Japan and Israel worried that the U.S. electronic spy agency was pushing the new techniques not because they were good encryption tools, but because it knew how to break them."
The NSA is widely believed to have done exactly this when it recommended particular elliptic curve constants quite a few years back.
Once you've betrayed people's trust, you're going to have a hard time convincing them you're worth trusting with anything that matters ever again.
#DeleteChrome
an algorithm with a novel quantum solution, or some other machine that the NSA already has functioning, would make any "version" of the techniques just as susceptible to cracking.
perhaps the quantum machine is actually made easier as the encryption becomes "more powerful".
you're all idiots.
OK, if the NSA is pushing encryption techniques that are easy to break, or have known vulnerabilities, then they lose the "S" in their Acronym.
diversity is good, everyone using the same technology means there is just less technological development and less local development.
The more types of encryption or encryption techniques there exist the better for the economy etc...
To make me trust you, you have to give me a good reason to do so. Unfortunately the NSA has given all sorts of reason to not thrust them with anything. Not as an American, twice not as a foreigner.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Considering that the US has finally outed itself as a fascist oppressor out to rape murder and enslave all non-white and non-Christian people, the US is a nation to be feared and never trusted
The world would do well to unite and destroy it
Fuck algorithm based encryption. If you want to secure your data use massively long one time pads.
There's a reason numbers stations exist and will continue to exist.
I was unaware of anyone that trusts the NSA.
No one inside or outside of the USA trusts america anymore, you don't have any friends you have allies that are compliant out of fear and nothing else. ask anyone in Canada or the UK, your closest allies, and closest cultural parallels how they feel about the united states, and you'll find that it is almost invariably, disgust.
I first ran across them in the early 80s when I needed a clearance. Back then they were "No Such Agency". Given that, why would they and their research be deemed the golden standard? They're a spy agency ffs!
How is it there wasn't a community of, I dunno, open source crypto developers, paid for by, I dunno, college research grants across the globe to figure this stuff out?
tl;dr You rely on a spy agency for 30 years for your crypto protocols, don't be surprised they cheated. One word: Sucker!
The U.S. is spearheading Five Eyes which will propose mandatory backdoors in all strong encryption. I don't think that this is a coincidence.
-- Insert witty one-liner here. --
SIMON and SPECK are simple block cipher designs. You don't need an ISO for that. What's next? An ISO for HTML header tags?
>The dispute, which has played out in a series of closed-door meetings around the world over the past three years and has not been previously reported, turns on whether the International Organization of Standards should approve two NSA data encryption techniques, known as Simon and Speck.
I was in a couple of those meetings in ISO/IES SG27/WG2.
Indeed, the NSA were there and were pushing Simon and Speck.
Indeed a handful of other countries were arguing against Simon and Speck, but not on the merits of the algorithm, but on the history of the USA in crypto standards and SP800-90A in particular.
They couldn't muster any real criticism of Simon and Speck, and that's because they are excellent algorithms. They are 3X more efficient that AES in whatever metric you choose (size, performance, area, power). They are easily extended to 256 bit block sizes (although NIST and the NSA have declined to do that while leaving obvious holes in the spec where the larger block sizes go. The security analysis is aided by the simplicity of the algorithms - a simple round function iterated many more times than for AES.
ISO is a political organization and the arguments are political. Don't let technical considerations muddy the waters.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Use all encryption methods from all countries on top of each other. That way no one entity can unwrap the whole thing. Only the person with all 190+ keys.
Twinstiq, game news
Not so. Their name is the "National Security Agency". Their purpose is "National Security", not "Pushing crypto they can break". The latter is a policy that the NSA has adopted, an interpretation of their purpose. It is not the purpose itself.
Why does this matter? I mean, if the NSA believes their interpretation of their purpose is correct, what difference does it make? The difference is, policy can change.
This issue is not changed even when you account for the fact that the NSA is the signals intelligence branch. Sure, they'd like to break all crypto. But if unbreakable crypto was the norm and that regime provides national security, then the NSA is still meeting their mandate.
Isn't this just intellectual navel gazing though? Well, not really. Unbreakable crypto is, in fact, becoming the norm. Intelligence agencies all over are bemoaning the fact of the "dark web", which in this context means crypto they cannot break.
The NSA got addicted to easy signals intelligence. They don't want that system to change but honestly, it's not up to them. I expect them to keep trying to penetrate cryptographic communications, asking for back doors, asking for iPhone hacks and all the rest. However I don't equate "the NSA can read all of my communications, and everyone else's," with "security for me." Instead that's just one step forward on a 20 step march towards 1984.
An international group of cryptography experts has forced the U.S. National Security Agency to back down over two data encryption techniques it wanted set as global industry standards, reflecting deep mistrust among close U.S. allies.
The first sentence is already ambiguous. Which "it" refers to in this case? An international group of cryptography experts OR the U.S. National Security Agency?
Denial to prevent cognitive dissonance.
"Trump!!", the new Godwin.
...at least, according to DJB.
I do understand, however, that it is difficult to produce an implementation of any of the NIST curves that are invulnerable to side-channel exploits.
I am betting that NTRU Prime will likely be the post-quantum asymmetric winner of the NIST competition.