Hacker News Reader

Comment by garbageman | Hacker News Reader

I trusted them to at least pick an encryption that only they could break...rather than one that other nation states may be able to crack as well.

View on HN

If it's breakable by them, it's breakable by anyone. Full stop. It is not possible to create an encryption scheme only breakable by NIST (or NSA, or whatever 3-4 letter agency).

really? it seems to me like it should be theoretically possible in some cases for the same reasons public/private key cryptography is possible.

Have people forgotten about this already?

https://en.wikipedia.org/wiki/Dual_EC_DRBG

It's not at all impossible to put a backdoor in a protocol which requires knowledge of a key in order to exploit. This isn't even the only example where this is thought to have occured.

I haven't forgotten about it, no, and I stand by my original comment.

If you introduce a deliberate weakness to your encryption, the overall security is reduced to the security level of that weakness.

Relying on NOBUS ("nobody but us") is hubris (see shadow brokers, snowden, etc.).

This just doesn't make technical sense. I completely agree that backdooring encryption standards is a bad thing. But Dual EC DRBG is a clear example of a NOBUS backdoor actually being that. The backdoor is equivalent to "knowing" a private key. The weakness is not some sort of computational reduction. Using this logic, you would say that no encryption method is possibly secure because you can't rely on its security once the key is exposed.

The reason it remained a "NOBUS" backdoor is because the whole world noticed something was funky with it pretty much immediately (even prior to standardization), and security researchers loudly told people not to use it. At that point the value of cracking open the backdoor is reduced significantly. It was standardized, and barely used except where mandated by governments, for less than 10 years.

There's no reason to think it would have remained a "NOBUS" backdoor forever. Especially if it was more widely used (i.e. higher value), and/or used for longer.

>Using this logic, you would say that no encryption method is possibly secure

I mean, to an extent that a little waterboarding will beat any encryption method, yes I would say that.

But, for 99.99% of people, your data isn't worth the waterboarding. On the flipside, a backdoor to, say, all TLS communication, would be very worth waterboarding people.

Heh. That's fair.

I wonder what other countries do? Do their agencies trust NIST or they recommend their own and run their programs for algorithms. I am thinking of say Germany, France, Britain etc.

They have their own agencies responsible, but take note of what NIST says (especially the UK).

https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisati...

https://cyber.gouv.fr/sites/default/files/document/pqc-trans...

https://www.ncsc.gov.uk/whitepaper/next-steps-preparing-for-...

Thank you. It seems they sort of follow NIST's guidelines mostly:

> The NCSC recommends ML-KEM-768 and ML-DSA-65 as providing appropriate levels of security and efficiency for most use cases.

Reply on news.ycombinator.com