Hacker News Reader

Comment by craftyguy | Hacker News Reader

> Sometimes even speck may be the right tool for the job.

I disagree. Proliferation of very-likely-backdoored crypto is dangerous. By using it you're demonstrating that it is OK to use crap the NSA is pushing. If it gains in popularity, you'll have people trying to use it for sensitive communications, etc, without understanding why it is a terrible idea.

View on HN

It is extraordinarily unlikely that Speck is backdoored, since it's a (deliberately) simple ARX block cipher transform, a close cousin to a variety of other block cipher designs from academic cryptography.

Yeah, https://lwn.net/Articles/762152/ has a full source code to Speck. It's like - OK, where is the backdoor, is eight the backdoor, or is three? Did the NSA sneak a backdoor into the idea of binary arithmetic when that was invented?

If people want to pick fights with the NSA, fine, but this may have been the dumbest possible fight to pick.

How does the implementation of HPolyC look in terms of whether I would notice if you hid something naughty in there?

Speck was announced to the world in a paper with design documentation, diagrams, and source code. Just read the Shors paper.

https://eprint.iacr.org/2017/560

Nobody is hiding anything in HPolyC either.

My concern wasn't with speculating that anybody is hiding anything in HPolyC but with the comparable amount of code amongst which naughty things might be hidden, today or in future, in Linux, or more likely, in something else.

Unfortunately HPolyC is _much_ bigger and more complicated. I'm sure it gets Google's job done, but I think overall purging Speck because of people's weird paranoia about the NSA was an unforced error and we'll regret it.

HPolyC is "bigger" but is built out of cryptographic components you generally already have to trust: the Poly1305 MAC and the XChaCha cipher. It's a construction, not a new block cipher transform. So obviously it takes more lines of code to run it. But it introduces fewer new primitives.

There's nowhere to hide a backdoor in TEA either.

There isn't, though misuse of TEA helped break the XBox security model.

Even if it comes from the NSA it doesn't necessarily mean it's backdoored. Speck is a good algorithm for performance constrained devices. It was removed from the kernel since it couldn't be included into Android systems due to political reasons, and the authors of the module wrote an implementation of an alternative algorithm for this use-case.

> Even if it comes from the NSA it doesn't necessarily mean it's backdoored

I suppose you could say the same thing about someone with a history of robbing banks.. just because they walked into your bank doesn't mean they are about to rob it (but it's highly likely they are).

If someone with a history of robbing banks arrived at my bank with a ski mask and a bulging duffle bag, I would say "go away, bank robber". The analogy to cryptography would be the NSA proposing yet another PKRNG, of any kind.

On the other hand, if someone with a history of robbing banks called me on the phone and asked me what the interest rates on my checking accounts were, I would tell them, because they can't rob my bank over the phone. The analogy here would be to the NSA suggesting a streamlined, simplified ARX block cipher transform, a backdoor in which would imply some fundamentally unknown property of block ciphers that would presumably jeopardize a whole variety of other academic ciphers, and would not accomplish the NOBUS property that NSA requires of backdoors in things they encourage USG assets to use themselves.

The NSA actually has a history of solid block cipher and hash function proposals:

https://en.wikipedia.org/wiki/Data_Encryption_Standard

https://en.wikipedia.org/wiki/SHA-1

https://en.wikipedia.org/wiki/Skipjack_(cipher)

I understand and respect your viewpoint. I even agree in most ways. But due to my particular limitations it was speck or nothing.

I have read the paper for speck. The actaully cipher is very unlikely to have been back doored. The only isue I have is the mode of operation with 64 bit blocks and short keys. In my opinion just ignore the 64bit variants and keys less than 96 bits in lenth. The cipher is rather simple so hiding a back door would require a method of attack not known to anyone publicly. Theres just too small of a surface, and uses pretty stanard operations.

...very-likely-backdoored...

This may be a silly comment but I'm glad you made it. It inspired more interesting and informative response than TFA and all the rest of this page.

Reply on news.ycombinator.com