Hacker News Reader

Comment by tptacek | Hacker News Reader

Which other cryptographers agree with him about this?

He has repeatedly collaborated with Tanja Lange who is also credited as working on the original NTRU Prime design. The other collaborators (all respected cryptographers) presumably think the scheme is sound as well.

The developers of OpenSSH agree enough to use this scheme in OpenSSH.

DJB is high profile enough that all of his stuff gets a lot of cryptanalysis from experts. This isn't a rando proposing a scheme that no one can follow, and no one can be bothered to review. He consistently designs cryptographic systems which perform better and are less error prone to implement than systems designed by committees of people.

CRYSTALS-Kyber had the same team structure; neither was more "designed by a committee" than the other. Can you articulate what would make Bernstein's team more credible than the Kyber team?

I promise you, CRYSTALS-Kyber does not lack for expert analysis.

I ask all this because there's a pretty big "Schneier Facts" vibe to anything that involves Bernstein, and because I don't think you'll find many cryptographers --- probably even including on the NTRU Prime team --- that would sign off on his critique of Kyber and the NIST process. I could be wrong, but if I am, could you tell me how?

Also, CRYSTALS-Kyber was a finalist in NIST's PQCrypto competition:

https://csrc.nist.gov/Projects/post-quantum-cryptography/sel...

Well, right, the subtext here is Bernstein's rejection of that result.

> […] Bernstein's rejection of that result.

Some previous discussion on this from 2022 and 2023:

* https://news.ycombinator.com/item?id=32360533

* https://news.ycombinator.com/item?id=37756656

> The developers of OpenSSH agree enough to use this scheme in OpenSSH.

Or simply because it was the most convenient algorithm at the time (2022).

There may also be regulated industries where Officially Approved™ algorithms need to be used, and if you're not on the list you're not going to be enabled, so if the developers of OpenSSH want to protect their users in those situations, then they're going to have to offer something on the list (even if it's not enable by default, or further down the preference ranking in the default settings).

* https://ubuntu.com/blog/ubuntu-22-04-fips-140-3-modules-avai...

* https://www.stigviewer.com/stig/canonical_ubuntu_22.04_lts/2...

* https://www.stigviewer.com/stig/red_hat_enterprise_linux_9/2...

* https://support.apple.com/en-ca/guide/certifications/apc35eb...

> DJB is high profile enough that all of his stuff gets a lot of cryptanalysis from experts. This isn't a rando proposing a scheme that no one can follow, and no one can be bothered to review. He consistently designs cryptographic systems which perform better and are less error prone to implement than systems designed by committees of people.

So in my opinion, NTRU Prime is a good cryptosystem. But it's not particularly better than Kyber: each has small advantages and disadvantages, and both got a ton of expert review (Kyber even more than NTRU Prime), and they will probably stand or fall together depending on improvements in lattice cryptanalysis.

I also don't think Kyber suffers from design-by-committee. There are a zillion small choices to make in these lattice schemes, and while some choices are definitely wrong, both the NTRU Prime and Kyber teams made reasonable ones. The same goes for SABER and regular NTRU.

DJB and Tanya operate as a unit. Saying Lange agrees with DJB is like citing Clark as support of Lewis.

Reply on news.ycombinator.com