[flagged]
His 'tantrums' led to Bernstein v. United States, which established source code as speech.
He’s drawing unfounded conclusions to discredit the work of other cryptographers whose work was chosen over his own.
So the issue is that once NIST did that the irrevocably destroy any basis to say "you can trust us". Hence they cannot have anything that they cannot document the source for. e.g. any non-trivial numbers have to have a documented generation path, and any non-trivial numbers in those steps also have to have a documented generation path.
Let's assume for now NIST is being 100% honest, and there's no attempted subterfuge. How can we distinguish that from them intentionally hiding subterfuge? Even though in this hypothetical where we're assuming no corruption, we have no way to know unless we have everything.
It's not reasonable for anyone at this point to have an algorithm that has any unexplained numbers, but for an organization that is again documented as having sabotaged standards it's absurd.
And, to that, I say: hell yes. Cryptographic standards are, in my view, a force for evil. Nobody uses Blake2 because it's "standardized"; they use it because there's a rough consensus of credible, credentialed cryptographers that it's strong, and it's obviously fast. We can do Internet cryptography without entities like NIST and the IETF.
This is something Bernstein believes as well; he's said it before (I have my view on standards in part because of his own). But he's not being honest about that here: had his submission won, he'd have endorsed the competition, even though the exact same logic holds --- he should, by this logic, trust his own submission less if it wins.
But I also want to be especially candid here: this "NIST is acting as the catspaw of NSA by selecting the weakest standard" argument is also the standard rhetorical fallback for arguers who have just this instant learned that NIST didn't itself design CRYSTALS-Kyber, but don't want to surrender their credibility by admitting it.
The impression I have right now is that they made some mistakes and in response to having those pointed out went "well, that's just like, your opinion, man" instead of explaining why it's not a mistake, or fixing it, or something.
That's what makes me suspicious, anyway.
This is precisely not what I'm saying (and isn't what's happening here). What I'm saying is that given the evidence presented about NIST repeatedly changing evaluation methods, incorrectly calculating the strength of the Kyber, and refusing to clarify any of the above, it really looks like NIST had an outcome that they wanted to reach and took the actions necessary to reach that outcome. It's also really weird to say "it's not enough that almost every participant in the competition agrees that it was well conducted" in response to the lead designers of one of the two primary algorithms saying that the competition wasn't well conducted. With a competition like this, you do expect some people to think that the decision criteria weren't quite the right ones or something like that, but here there's a very clear accusation that NIST either just lied about the security of Kyber or messed it up and refused to correct it when it was pointed out to them.
As in: I'm sure he probably personally feels emotional about that aspect of it, but the fact that he may have a personal emotional motivation does not make untrue any of the points he may be raising.
But no disparagement to your point, I mean this sincerely: it is good work on that ad hominem if your goal is to dismiss the concerns. Because that "ulterior motivation" ad hominem is a fairly effective way to dismiss it, unless you want to look a little deeper to the real issues. Well done! I mean that, seriously.
From outside it could be hard to tell what's true, so it's worthwhile to consider all the options. He's essentially trying to make allegations about a "black box" process (black in the sense that the NSA is not publishing its calculus and activities on these matters), so who do we trust? It seems it could be unclear right now.
For instance, "showing your work" around the development of SHA0, or showing your internal research and attacks for CK.