House Passes Amendments Blocking Funding for Undermining Encryption

NSA would be covered on a separate budget, and in any event there are at least theoretical reason why you'd want the foreign intelligence arm of the nation to be able to weaken encryption abroad, especially when that foreign intelligence agency has the statutory duty to be able to break the codes of the U.S.'s adversaries.

NIST has no such statutory duty, and their budget is handled as part of the normal public Congressional budget process. So what this would do is to prevent the use of NIST-funded activities (e.g. crypto competitions, labor time of NIST employees, etc.) to consult with NSA to deliberately weaken encryption standards.

Even though NSA could fund such actions internally to them, they wouldn't be able to publish such a subverted standard under the imprimatur of NIST the way that Dual EC DRBG was done.

As far as the loophole, the option "Agency A could just claim to be doing legal thing X instead of illegal thing Y" applies to almost all agencies for nearly all illegal things. Fraud is still a crime, even for the NSA; if you're going to assume that NSA will simply break the law then legal changes as a way to stop NSA are irrelevant anyways.

In the case of Dual EC DRBG it appears to have been obvious early on that it was weak and even probably backdoored. Schneier wrote as much about it in a Wired article back in 2007. It's notable that NIST complicity was evident here, which is why something like this amendment is needed. But I can't find anything that claims NSA flat-out lied either, and much of Snowden's own leaks have revealed an NSA studiously trying to stay within (but only barely within) the lines.

> Wouldn't this sort of thing be coming out of the NSA's budget anyway?

In the grand scheme of things, yeah. NSA was spending $250M to undermine cryptography [0]... fucking rats.

But back when all of this was happening, I suspect that NIST actually was the one paying NSA. Reminisce back to when we all assumed that NSA weren't bad actors, do you think that NSA would be able to politically explain funding a partnership with NIST?

Consider that the entire point of spending tax payer money on NIST is that they do research into standards. How could NSA explain to NIST that they randomly feel like spending money from their own budget to help them out? I could be wrong, it's hard to find information on who NIST contracts with, but I think it'd be a very odd situation for NSA to have paid NIST for the opportunity to do their job for them.

The normal operation of NIST is that they give money to consultants in exchange for working on standards, it's unlikely to think it would be the other way around.

> NSA can just claim they are helping to strengthen encryption... in fact that's probably exactly what they did when they first introduced DUAL_EC_DRBG to NIST in the first place.

Nope. NIST was consulting with both NSA and RSA, figuring that they were getting unique opinions from both. Behind the scenes, though, NSA paid RSA $10M to begin using DUAL_EC_DRBG in a few of their products, which is kind of unprecedented because RSA sells a lot to government and NIST approval is required by software used by government. NSA then turned around and pointed at the fact that RSA was already using it, bolstering the argument they'd been trying to make to NIST the whole time. NIST then put it in.

So while Massie's bill doesn't stop NIST from being infiltrated by NSA via NIST contractors, it does stop NIST and NSA from directly consulting and that's a step in the right direction.

[0]: http://www.nytimes.com/interactive/2013/09/05/us/documents-r...

[1]: http://www.reuters.com/article/2013/12/20/us-usa-security-rs...

It might happen, but it won't come from a major established tech company in the Americasphere.