7 ms·

The NSA being the good guys for once feels strange. Especially caring for public interest.

by dtx1 2y ago

aftbit 2y ago
That used to be the norm! My personal favorite story along those lines was how they proposed changes to DES S-boxes without any detailed explanation. The open community was skeptical but it later turned out that the changes they proposed protected against differential cryptanalysis[1], which was at the time not known outside the intelligence community. That said, they did cut the key size dramatically which ended up weakening DES to the point that it could be trivially brute forced by the early 2000s, which led to 3DES and AES. 1: https://www.schneier.com/blog/archives/2004/10/the_legacy_of_d.html https://www.schneier.com/blog/archives/2004/10/the_legacy_of...
- adastra22 2y ago
  Yeah they unfortunately abused the good will they got from that. Once differential cryptanalysis was known and it was clear the NSA had strengthened the DES S-boxes, people started trusting them. And they started making lots of suggestions to various standards. Only now they were inserting back doors. It wasn’t until Snowden that the pendulum of public paranoia swung back the other way.
  - tptacek 2y ago
    You're using the plural for "backdoors" there; what's the other one you're aware of?
    - dekhn 2y ago
      the morris hexabox shunt
    - adastra22 2y ago
      https://www.atlasobscura.com/articles/a-brief-history-of-the-nsa-attempting-to-insert-backdoors-into-encrypted-data https://www.atlasobscura.com/articles/a-brief-history-of-the...
      - tptacek 2y ago
        Unless you count Clipper as a "backdoor", this article asks the same question I am. The whole point of Clipper, of course, was that keys were escrowed.
        adastra22 2y ago
        Clipper was deliberately backdoored (the key exchange had a trap door), with that backdoor only publicly found after its release. This was more the a just key escrow. Why would that not count?
        tptacek 2y ago
        The entire point of Clipper was to field cryptography that NSA could break. That wasn't a later revelation. It was the understanding at the time. It's why there were "the crypto wars".
- kragen 2y ago
  they did strengthen the s-boxes against differential cryptanalysis, yes, but since 02004 we have evidence that they also sabotaged it as part of a deliberate policy they'd put in place in 01968: https://blog.cr.yp.to/20220805-nsa.html https://blog.cr.yp.to/20220805-nsa.html
  - tptacek 2y ago
    The sleight of hand here is to equate publicly reducing the key size, which was known (presumably at the time as well) to be a weakening of the system, with a supposed weakness injected cryptically into the S-boxes --- which we now know is the opposite of what happened. Further, the truncated version of DES that got standardized far outlasted its expected lifetime --- the National Bureau of Standards expected DES to have a useful lifetime of about 5 years. And even at the time it was understood that you could expand the keysize by tripling up the DES core. I think there's a really big difference between publicly weakening a standard, in effect telling the world "we want a standard that is adequate for commercial purposes but inadequate for military purposes, so as to retain our national edge", and doing what they did with Dual-EC, where it was impossible (apparently) for people to reason about what NSA was up to.
    - philodeon 2y ago
      > and doing what they did with Dual-EC, where it was impossible (apparently) for people to reason about what NSA was up to. Schneier was clearly able to reason about what NSA was up to, and told everyone in 2007 not to use Dual-EC, 6 years before the Snowden revelations. I believe you have admitted that you thought that “Dual-EC has a backdoor” was a wild conspiracy theory until the Snowden revelations? Which makes the “impossible (apparently)” part a classic case of projection.
      - tptacek 2y ago
        The (apparently) was a dunk on me. (I thought nobody should use Dual EC! But that was my reason for thinking it wasn't an NSA backdoor, because it was too dumb to be one. I underestimated the industry's capacity for "dumb". Also: I was dumb! I am dumb a lot.)
reaperducer 2y ago
The NSA being the good guys for once feels strange. Especially caring for public interest. Only if everything you know about the NSA comes from the evil, cackling, mustache-twirling caricatures of it promulgated by angry people on the internet. Once you look beyond the politics, propaganda, and axe-grinding that is endemic to the online world you find out all sorts of fascinating things about the U.S. government.
- snapcaster 2y ago
  You think the dominant propaganda in the US is _against_ the US war state and intelligence community?!
  - nullityrofl 2y ago
    It depends on the circles you run in. If you consume news primarily from, say, Hacker News, then sure.
    - deleted 2y ago
      [deleted]
  - jknoepfler 2y ago
    I don't think the Federal government has had much control over public perception of itself for quite some time now. We're not living in an age of manufactured consent in which the dominating central tendency is more or less obvious.
    - DiscourseFan 2y ago
      The concept of manufactured consent always felt a bit suspect, but Kamala Harris' presidential candidacy has been covered by say, the NYTimes and The Guardian with little to no criticism, and they seem to be intentionally masking the fact that she has no real policies or any sort of platform. What else, if anything, points you towards the image of a state in whose operations it wants to appear as ambiguous as possible? The real threat, the known threat to state security is Trump, because he and his followers are crazy. If the NSA, and other intelligence agencies, had any influence on the election, why wouldn't they do exactly what it would appear they are doing now and get a milquetoast liberal elected to office who will easily capitulate to their demands?
TiredOfLife 2y ago
https://en.wikipedia.org/wiki/Ghidra https://en.wikipedia.org/wiki/Ghidra
HybridCurve 2y ago
With the type of work the NSA does, I can't imagine many of the didn't know who Grace Hopper was. I expect they did it out of respect for her, rather than for the benefit of the general public.

The NSA being the good guys for once feels strange. Especially caring for public interest.

by dtx1 2y ago

The NSA being the good guys for once feels strange. Especially caring for public interest.

That used to be the norm! My personal favorite story along those lines was how they proposed changes to DES S-boxes without any detailed explanation. The open community was skeptical but it later turned out that the changes they proposed protected against differential cryptanalysis[1], which was at the time not known outside the intelligence community. That said, they did cut the key size dramatically which ended up weakening DES to the point that it could be trivially brute forced by the early 2000s, which led to 3DES and AES. 1: https://www.schneier.com/blog/archives/2004/10/the_legacy_of_d.html https://www.schneier.com/blog/archives/2004/10/the_legacy_of...

adastra22 2y ago
Yeah they unfortunately abused the good will they got from that. Once differential cryptanalysis was known and it was clear the NSA had strengthened the DES S-boxes, people started trusting them. And they started making lots of suggestions to various standards. Only now they were inserting back doors. It wasn’t until Snowden that the pendulum of public paranoia swung back the other way.
- tptacek 2y ago
  You're using the plural for "backdoors" there; what's the other one you're aware of?
  - dekhn 2y ago
    the morris hexabox shunt
  - adastra22 2y ago
    https://www.atlasobscura.com/articles/a-brief-history-of-the-nsa-attempting-to-insert-backdoors-into-encrypted-data https://www.atlasobscura.com/articles/a-brief-history-of-the...
    - tptacek 2y ago
      Unless you count Clipper as a "backdoor", this article asks the same question I am. The whole point of Clipper, of course, was that keys were escrowed.
      - adastra22 2y ago
        Clipper was deliberately backdoored (the key exchange had a trap door), with that backdoor only publicly found after its release. This was more the a just key escrow. Why would that not count?
        tptacek 2y ago
        The entire point of Clipper was to field cryptography that NSA could break. That wasn't a later revelation. It was the understanding at the time. It's why there were "the crypto wars".
kragen 2y ago
they did strengthen the s-boxes against differential cryptanalysis, yes, but since 02004 we have evidence that they also sabotaged it as part of a deliberate policy they'd put in place in 01968: https://blog.cr.yp.to/20220805-nsa.html https://blog.cr.yp.to/20220805-nsa.html
- tptacek 2y ago
  The sleight of hand here is to equate publicly reducing the key size, which was known (presumably at the time as well) to be a weakening of the system, with a supposed weakness injected cryptically into the S-boxes --- which we now know is the opposite of what happened. Further, the truncated version of DES that got standardized far outlasted its expected lifetime --- the National Bureau of Standards expected DES to have a useful lifetime of about 5 years. And even at the time it was understood that you could expand the keysize by tripling up the DES core. I think there's a really big difference between publicly weakening a standard, in effect telling the world "we want a standard that is adequate for commercial purposes but inadequate for military purposes, so as to retain our national edge", and doing what they did with Dual-EC, where it was impossible (apparently) for people to reason about what NSA was up to.
  - philodeon 2y ago
    > and doing what they did with Dual-EC, where it was impossible (apparently) for people to reason about what NSA was up to. Schneier was clearly able to reason about what NSA was up to, and told everyone in 2007 not to use Dual-EC, 6 years before the Snowden revelations. I believe you have admitted that you thought that “Dual-EC has a backdoor” was a wild conspiracy theory until the Snowden revelations? Which makes the “impossible (apparently)” part a classic case of projection.
    - tptacek 2y ago
      The (apparently) was a dunk on me. (I thought nobody should use Dual EC! But that was my reason for thinking it wasn't an NSA backdoor, because it was too dumb to be one. I underestimated the industry's capacity for "dumb". Also: I was dumb! I am dumb a lot.)

reaperducer 2y ago

The NSA being the good guys for once feels strange. Especially caring for public interest. Only if everything you know about the NSA comes from the evil, cackling, mustache-twirling caricatures of it promulgated by angry people on the internet. Once you look beyond the politics, propaganda, and axe-grinding that is endemic to the online world you find out all sorts of fascinating things about the U.S. government.

snapcaster 2y ago
You think the dominant propaganda in the US is _against_ the US war state and intelligence community?!
- nullityrofl 2y ago
  It depends on the circles you run in. If you consume news primarily from, say, Hacker News, then sure.
  - deleted 2y ago
    [deleted]
- jknoepfler 2y ago
  I don't think the Federal government has had much control over public perception of itself for quite some time now. We're not living in an age of manufactured consent in which the dominating central tendency is more or less obvious.
  - DiscourseFan 2y ago
    The concept of manufactured consent always felt a bit suspect, but Kamala Harris' presidential candidacy has been covered by say, the NYTimes and The Guardian with little to no criticism, and they seem to be intentionally masking the fact that she has no real policies or any sort of platform. What else, if anything, points you towards the image of a state in whose operations it wants to appear as ambiguous as possible? The real threat, the known threat to state security is Trump, because he and his followers are crazy. If the NSA, and other intelligence agencies, had any influence on the election, why wouldn't they do exactly what it would appear they are doing now and get a milquetoast liberal elected to office who will easily capitulate to their demands?

TiredOfLife 2y ago

https://en.wikipedia.org/wiki/Ghidra https://en.wikipedia.org/wiki/Ghidra

HybridCurve 2y ago

With the type of work the NSA does, I can't imagine many of the didn't know who Grace Hopper was. I expect they did it out of respect for her, rather than for the benefit of the general public.