Is this true? The NSA pushed for weaker cryptography it could break versus stronger cryptography our adversaries couldn't?
Is this true? The NSA pushed for weaker cryptography it could break versus stronger cryptography our adversaries couldn't?
https://en.wikipedia.org/wiki/NOBUS
note that there is no even candidate way the NSA would have a NOBUS-type vulnerability for ML-KEM. DUAL_EC_DRBG was known to plausibly have a NOBUS-style backdoor prior to standardization, provided you used a certain "default" generator (vs freshly generating your own). It was later discovered that the NSA payed RSA (the company) to do this.
While this payment was private, the possibility of a back door was publicly known. There are no publicly known candidate backdoors for ML-KEM. The broad design of an ML-KEM-like scheme permits one ("static" matrix A), but ML-KEM was specifically designed to make this impossible ("ephemeral" matrix A).