Like I said before guys, start using end-to-end encryption. Stop talking and start sticking it to the man. If a company cooperates with the government, then don't use their products or services.
Maybe it was just primarily a technology contribution among the nerds at NSA, and not the bureaucrats intended goals?
Really, if you want to point to the NSA/NIST helping to advance the state of cryptography, point to the AES contest.
Here's one summary of the ECC patent situation:
http://cr.yp.to/ecdh/patents.html
ECC is increasingly common in commercial systems. Who's asserting patents against those systems?
When last I checked, the 20-year-old GNFS algorithm was the most efficient way to attack RSA. Yes, this is faster than the best known attacks on ECDLP, but ECDLP attacks are still subexponential. Nothing has changed in the past ten years about the complexity class of ECDLP (it is still both in NP and in coNP).
Really, the future of cryptography is not elliptic curves, it is systems based on lattices, hidden linear codes, and hard learning problems (these are all related). You can do some interesting things with ECC, but there are far more interesting lattice cryptosystems being developed by researchers.
"ECC is increasingly common in commercial systems. Who's asserting patents against those systems?"
Certicom filed this famous lawsuit:
http://www.certicom.com/index.php/2007-press-releases/20-cer...
Really though, Dan Bernstein is not a lawyer, and I would not trust his analysis if I had a business to run. Even if he is right, that does not change the fact that ECC deployment is lagging because of fears about patent suits. The NSA's response to concerns about patents was to get a special license, specifically for government uses of ECC; they did nothing at all to encourage ECC deployment elsewhere, and they did not demonstrate that such deployment was a priority.
Good background on PQ cryptography (McEliece, &c, the stuff you're referring to later in your comment): Bernstein's intro to Post-Quantum Crypto: http://pqcrypto.org/www.springer.com/cda/content/document/cd...
I've never seen anyone use McEliece, NTRU, &c commercially. Unlike ECC, these schemes aren't on the horizon for TLS.
ECC goes back to Lenstra and Koblitz in the mid-80's. I'm not wading into the validity of the patents the way DJB does, just saying, we're coming to the end of their lifespan.
This isn't the cold war anymore.
Why?
There's a logic and motive to state intelligence organizations, it's not just a blind "everything must be readable!"
Instead of rejoicing, the man forced MS to build a backdoor into it.
The man is glad if your valuable communication can't be stolen by some Chinese spies. But you are a good citizen and have nothing to hide from your own government, right?
Beats a compute cluster hands down.
This is why encryption is good against a foreign government, but not as good against your own.
The research community has a thing or two to say about that:
https://www.usenix.org/conference/usenixsecurity12/social-ne...
Under CISPA, there's no longer any legal obligation to protect your information. There is full immunity for not doing so.
If an ISP suffers a breach and coughs up huge amounts of PII that they handled negligently, they are absolutely still liable after CISPA becomes a law.
In my case, as a service provider, we are encrypting as much as we can, so that we can't even read the data even if obliged to. It becomes troublesome for some pieces of data because we need to decrypt it so that it can be displayed in the website. So if we can decrypt it, as a provider, then we would be obliged to decrypt it for government agencies.
It would be interesting to see what can we do as a provider, to protect our own customers without breaking the law.
Also, the so called protections that it must be a cyber-security threat also hold little check and balance, how about an attack just happening when an agency needs information, or waiting for an attack by baiting it, any protection against creating honeypots to bait certain services? Probably not. Everyday servers and systems are attacked, so it is pretty much open season for getting information. There are no checks and balances and 'volunteering' means nothing. Try getting a gov't contract or deflecting problems without volunteering.
I am glad all these freedom giving up people have nothing to hide such as their business ideas, sites they visit, downloads, emails etc will all be tracked now. I am sure they have something to hide from then. All of this will now be stored not only on their computers and their services, but at the ISP and the NSA now as well. Lots more chances, especially at the ISP level, of identity theft and threats.
Crypto products might be a big market after this.
For instance, SpiderOak makes a point of not knowing what their clients store on their servers, because all encryption happens on the client side, and the key never reaches the server side.
The problem with JS is that the browser may be not good enough, failing to prevent certain attacks from other tabs.
The OS may be compromised, too, so that the data is available before encryption, or the key phrase gets stolen and siphoned out by a keylogger. However good your software is, you can't fight against it.
As memory is getting cheaper, running each domain in a different process in a different container or VM becomes more feasible (see Qubes OS). In a well-insulated environment, JS encryption should be as safe as any other.
Nothing is 100% secure, specially in the web, but anything is better that what we have today.
I will start doing some research on the solutions to this. We are going to do for our clients, what I expect my providers do for me.