Slashdot Mirror
Distrustful US Allies Force Spy Agency To Back Down In Encryption Fight (reuters.com)
schwit1 shares a report from Reuters: An international group of cryptography experts has forced the U.S. National Security Agency to back down over two data encryption techniques it wanted set as global industry standards, reflecting deep mistrust among close U.S. allies. In interviews and emails seen by Reuters, academic and industry experts from countries including Germany, Japan and Israel worried that the U.S. electronic spy agency was pushing the new techniques not because they were good encryption tools, but because it knew how to break them. The NSA has now agreed to drop all but the most powerful versions of the techniques -- those least likely to be vulnerable to hacks -- to address the concerns.
we give you the 12 we didn't want to keep the 5 we did.
New "ciphers". Same trick. However, ISO committee members didn't just approve the new ciphers like they did dual EC DRBG. They keep getting voted down, as not suitable for publication as an ISO standard, but the US keeps pushing ISO to accept them as an international standard.
" In interviews and emails seen by Reuters, academic and industry experts from countries including Germany, Japan and Israel worried that the U.S. electronic spy agency was pushing the new techniques not because they were good encryption tools, but because it knew how to break them."
The NSA is widely believed to have done exactly this when it recommended particular elliptic curve constants quite a few years back.
Once you've betrayed people's trust, you're going to have a hard time convincing them you're worth trusting with anything that matters ever again.
#DeleteChrome
How so? The NSA exists to penetrate everyone's informational security. Pushing crypto they can break is exactly in line with their purpose.
From what we can see from outside, the NSA firmly believes it's the smartest one in the room, and that no one else can possibly figure out a backdoor it's put in place. They really believe in the 'NOBUS' (NObody But US) theory about certain things.
Couple that with a dual-mission agency (protect 'our' communications, break everyone else's) and you have a recipe for arrogance and disaster.
A thousand pounds of wood moving at 300 feet per minute. Don't get in the way.
To make me trust you, you have to give me a good reason to do so. Unfortunately the NSA has given all sorts of reason to not thrust them with anything. Not as an American, twice not as a foreigner.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Yes. However, given that the key has to be the same length as the cleartext and can never be reused, that makes it an unworkable solution for two-way electronic communications.
It's just barely feasible for things like numbers stations.
The U.S. is spearheading Five Eyes which will propose mandatory backdoors in all strong encryption. I don't think that this is a coincidence.
-- Insert witty one-liner here. --
New "ciphers".
Specifically, two new families of block ciphers called SIMON and SPECK. These ciphers are designed to be extremely fast, which is good because although AES is fairly fast on "big" hardware" or on large quantities of data, it can be a bit sluggish when used in extremely constrained environments on small amounts of data. In particular, its key schedule its heavy, so changing keys is slow. SIMON has been designed to make it particularly cheap in purpose-built hardware while SPECK is designed for very fast software implementations. Both are very, very fast on both hardware and software, though. The 128-bit version (block size and key size) of SPECK, for example, encrypts at about 1.25 cycles per byte on an i5 on long messages, and is almost as good on short messages. That's crazy fast.
Academic cryptanalysis of the ciphers has so far shown them to be quite solid, with a very good margin of security (meaning that cryptanalysts have only been able to break significantly cut-down versions of the ciphers, quite far from full versions).
Same trick.
Possible, but doubtful. In fact, the experience with Dual EC DRBG actually makes it significantly less likely, IMO. They tried to pull the trick with that, but it didn't work because academics discovered the mathematical structure that made the backdoor possible. That has to make them worried that the same thing would happen again, and in fact the trick would be much harder to pull off with symmetric block ciphers. The thing about elliptic curves is that they have rich mathematical structure which can be exploited in clever ways (this is what makes them useful for public key cryptography) by choosing the right curves. But symmetric key block ciphers like SIMON and SPECK don't have that, making it much harder to design back doors in.
It's not impossible that the NSA has some technique that can break these ciphers -- which are actually quite similar to ciphers produced by public cipher designers -- but it really seems unlikely. Nevertheless, once burned twice shy. I don't blame standards bodies for being reluctant and waiting for public cipher designers to produce algorithms with the desirable properties of SIMON and SPECK, but without the concern about origin.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
>The dispute, which has played out in a series of closed-door meetings around the world over the past three years and has not been previously reported, turns on whether the International Organization of Standards should approve two NSA data encryption techniques, known as Simon and Speck.
I was in a couple of those meetings in ISO/IES SG27/WG2.
Indeed, the NSA were there and were pushing Simon and Speck.
Indeed a handful of other countries were arguing against Simon and Speck, but not on the merits of the algorithm, but on the history of the USA in crypto standards and SP800-90A in particular.
They couldn't muster any real criticism of Simon and Speck, and that's because they are excellent algorithms. They are 3X more efficient that AES in whatever metric you choose (size, performance, area, power). They are easily extended to 256 bit block sizes (although NIST and the NSA have declined to do that while leaving obvious holes in the spec where the larger block sizes go. The security analysis is aided by the simplicity of the algorithms - a simple round function iterated many more times than for AES.
ISO is a political organization and the arguments are political. Don't let technical considerations muddy the waters.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
The key doesn't need to be the same length as the cleartext, it can be considerably shorter. This does weaken the encoding, but not fatally. You just need to encrypt the message before you encode it with the one-time pad with a code that's difficult to recognize. The more you shorten the key, the weaker the encoding, but shortening it by 50% is still quite safe if you use a decent encryption of the cargo.
Perfection isn't impossible, but is hideously expensive.
That said, any code that depends on factoring large primes is weak when used against quantum computers. And they may not be here today, but I wouldn't make strong bets about next year in secret government offices. So if it's worth it to you, by all means use one-time pads. And most of the expense of using them is in the transmission of the info, so you might as well use the most secure version. You can get a pretty good set of random numbers by processing a web cam of a candle flame, but turning that into terabytes of good random numbers could take awhile.
I think we've pushed this "anyone can grow up to be president" thing too far.
Even $10 MCU have dedicated AES-256 hardware these days.
Sure, if you can afford such expensive hardware, AES is fine.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Your sig is a lie!!! ;)
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.