Hacker News Reader

Comment by jloughry | Hacker News Reader

NSA is really two organizations in one. One side of the house is tasked with Information Assurance (IA), i.e., protecting the U.S. government's information. The other side of the house is tasked with interception. Cryptanalysis folks at NSA straddle both activities, necessarily.

View on HN

Sure, but I just can't understand why they would be recommending to the general public that they improve their crypto, as it goes directly against the NSA's interests.

Now that they are in the domestic surveillance game, they have contradictory interests. They were originally intended to jointly ensure the security of U.S. interests while breaking the security of everyone else. So it made sense to advocate improved crypto for, say, U.S. businesses, because that would benefit the U.S. in general by preventing the intelligence agencies of other countries from stealing U.S. corporate secrets.

To take it further, I suppose they want to protect US citizens, companies and government from crypto attacks while using US laws to snoop on them easily. That way, they prevent foreign threats by making it very hard for everyone to break any system in the US. And on the other hand, they can still read everything by issuing subpoenas to any company and ISP they feel like (with borderline constitutional legality in some cases).

Because the NSA's task is twofold: protect US govt interests by conducting SIGINT on foreign govts, and protect US govt interest by keeping US company trade secrets and infrastructure secure.

Worse than the NSA being unable to break network traffic is foreign govts being able to break US network traffic.

Breaking crypto is the hard way to get information. Way easier to get it at one of the endpoints. (Industry lingo would say: attack data at rest, not data in transit.)

Poison RNGs, get backdoors into the biggest services and software, and you have the majority of what you could need with almost no computing power.

Reply on news.ycombinator.com