Trevor Perrin requests removal of NSA from IETF Crypto Review

> Kernel contributors aren't background-checked so all you need to do is to pay someone to do some legitimate kernel hacking in a sensitive area

People vastly overestimate the worth of background checks, and underestimate the effect of current hardship.

So there's nothing which keeps you from assuming Linux kernel wouldn't be backdoored by NSA, right?

I see what you're saying, but it still doesn't make sense not to use someone with no visible ties. If you're going to go that deep, you would use the official employee as a red herring. You don't even want people to think about the possibility of your real guy being an agent, even in this weird convoluted way.

So, Dragonfly is a PAKE.

PAKEs ("password authenticated key exchanges") are a kind of public-key algorithm.

When two people use public key crypto to exchange a key in public, they need a way to "break the tie" in case of a MITM attacker. The conventional way to do this is with a certificate; that's how TLS works.

A PAKE uses instead a password; it does that by baking the password into the public/ephemeral key generation process. Alice & Bob can't agree on a MITM'd key if the MITM doesn't know the password; they just won't come up with the same numbers.

Dragonfly is a PAKE designed by Dan Harkins a bunch of years ago. Harkins got Dragonfly added to LEAP, the extensible authentication framework for 802.11 networks. He would very much like it added to TLS as well.

The trouble with that is, nobody knows why we would want to add Dragonfly to TLS. TLS already has a PAKE option, SRP. SRP is better than Dragonfly; it's designed to make it hard for an attacker who seizes a server to collect a database of passwords. SRP is also well-studied and well-understood; if it isn't particularly beloved of academic cryptographers, well, Dragonfly doesn't score any better. But more importantly, nobody uses TLS-SRP. No browser implements it. The demand for PAKE authentication in TLS is not strong.

It gets worse for Dragonfly. The protocol has problems. I'm going to get myself into a little bit of trouble summarizing, but here goes: Dragonfly can be made to work with elliptic curve key exchange. The process for mixing a password into an ECC key exchange involves a trial-and-error process for finding a valid curve point; a loop runs conducting these trials. A passive attacker could, in an earlier version of the Dragonfly protocol, discern how many iterations through the loop had happened to find a valid point given a password. Dragonfly is randomized: a nonce is mixed into every exchange. As a result, the same password might take a different number of loop iterations on every login attempt.

Net result: given a corpus of 232 passwords, 32-and-change passive observations of the key exchange might uniquely identify the password used!

Modifications to the protocol were proposed, some in the CFRG process, but they in turn resulted in a protocol with a side-channel weakness: the process of computing parameters for the key exchange leaks timing information.

Dragonfly has one sponsor that we know of: Kevin Igoe on the CFRG.

Trevor Perrin broke this down in amazing detail, mining posts out of several IETF mailing lists. Probably nobody is ever going to use Dragonfly in the real world, but watching people pick apart a new crypto protocol in public is amazing and hugely educational. I highly recommend reading this post:

http://www.ietf.org/mail-archive/web/tls/current/msg10962.ht...

I dunno. Packing standards bodies with incompetents and then suggesting things to those incompetents that are apparently sensible but weaken security seems like a perfectly plausible way of subverting cryptographic standards to me. Also, it probably wouldn't be terribly hard to seed a culture of disdain for real cryptographers.

Why do you think John Gilmore is incompetent? He's very well regarded by many technologists. toad.com is probably older than many HN readers.

Edit: I may have misunderstood who was being accused of incompetence. My apologies.

A lock to which someone unauthorized has the master key is a weak lock. A cryptosystem which the NSA has access to is a weak cryptosystem.

Second DJB! Would be the perfect choice, especially now that more and more cryptographers are looking to his curves and protocols, so he already knows what the vision for the future of IETF should be. I'm actually quite excited about the possibility of him being named chair at IETF.

As IETF chair he may be even bring us the elusive "secure by default Internet" with his CurveCP protocol or a future evolution of it. The secure by default Internet has actually been declared one of the main goals of IETF at their recent meeting:

http://www.ietf.org/live/

http://curvecp.org/

http://www.youtube.com/watch?v=K8EGA834Nok

The irony of Daniel Bernstein chairing the IETF crypto review board is so potent that I got a small nosebleed just thinking about it. But, nomination emphatically seconded.

For what it's worth, Bernstein spends most of his time in Europe these days.

Now there is a true mathematician and technologist all rolled into one!

+1

Phil Rogaway.

Matt Green.

Daniel Bernstein.

Kenny Paterson.

Paulo Barreto.

Scott Fluhrer.

Tanja Lange.

Of that list, looking at it now that I've written it, I think Kenny Paterson might be my favorite choice; he's done very important recent work on (breaking) TLS and is an eloquent and convincing writer and translator of the cryptographic literature.

In my personal opinion, that's just something that will have to happen before engineers start taking the subject seriously.

If a year or two of NSA interns have to learn the hard way that they'll never find employment anywhere else afterwords, too bad. You can bet your ass that, by the third year, nobody will be accepting those positions without fully intending on being there forever, and committing to the degradation of privacy.

I dont think we will punish them. We simply cannot trust them.

If they want to be trusted, they need to stand apart from the people who are lying and deceiving us about their tactics and their data gathering.

The man in question, and the employees in general, have unfortunately been tainted by the behavior of their employer.

For the moment, until or unless there's a sea change of public accountability and trust with respect to the NSA (which would likely take years if not generations), it's safest and most sensible to treat these employees as potentially suspect in any area where their employer has been shown to be an adversary.

"That's rather radical and unprofessional to say."

In what sense is it unprofessional?

"Any nsa contractor who depends on government contract to feed their families - is it wrong? "

in a moral sense? who knows. but from a practical sense it genuinely does mean I cannot trust you. hey, I understand what you are saying - and I sympathise, but at the end of the day there are clear, solid reasons why I cannot trust an ex NSA employee.

"And people have different degree of tolerance and standard for patriotism. i don't endorse what they do, but that's exact false attitude we have toward NSA affiliations."

working for the NSA is not patriotic. it is the opposite of patriotic. it is associating with sneaky people who deceive and lie.

> Any nsa contractor who depends on government contract to feed their families - is it wrong?

Anyone who chooses to work (directly or indirectly) for the Government should realize that the public good (not to be confused with "good for the government") must come above "feeding the family".

It is very easy to fall into atrocities and "following orders" when you do things in the name of "feeding the family". For example, spend a few hours playing "Papers, Please"[0] (or, even better, watching other people play it) and you'd be surprised how easily people start looking at the characters crossing the border as adversaries.

[0] http://papersplea.se/ (It's on sale in the Humble store for $4.99 USD.)

> That's rather radical and unprofessional to say.

Radical, certainly. Unprofessional? Professions usually have ethical codes of conduct. If you violate those ethics, you're not a professional. We don't have a unified professional ethical code, but ethics is absolutely an important part of professionalism.

Just like Google or Facebook, or any other organisation that you might care to mention, the NSA is a group of people, human beings, and fellow travellers on our annual circumlocution of Sol. I don't want to spit vile hatred, nor make any man my enemy, but I do want to communicate the depth and breadth of my concern for the things that we do, and the situations that we end up sleep-walking into. These matters are serious enough that I would implore individuals to consider their own position, and to deeply reflect on what their actions mean in a broader context; to step outside their mental comfort zone and seek another - any other - perspective with which to view their actions. If such reflection reinforces their sense or purpose, and the righteousness and justice of their mission, then so be it. If it causes them to question, and to ponder, and to debate, then so much the better. It is too much to ask for people to turn through 180 degrees - and perhaps the wrong direction to pick, also, but it is not too much to ask for a conversation that goes beyond mutual recrimination and hatred.

That's rather specious reasoning.

Any employment-offering entity (EOE) $foo can be substituted in the pace of Boeing or Lockheed in that argument: "the mob", "the Stasi", "revenge porn sites", etc.

So it really does boil down to intrinsics, after all. If we're going to commit ourselves to ending perennial abuses perpetrated by EOEs that seem entrenched and averse to wisdom and self-reflection (like large military contractors, or our so-called intelligence agencies)... then perhaps it should no longer be socially acceptable to work for them.