Cryptologist DJB Alleges NSA is Pushing an End to Backup Algorithms for Post-Quantum Cryptography (cr.yp.to)
- Reference: 0179760428
- News link: https://it.slashdot.org/story/25/10/12/0751230/cryptologist-djb-alleges-nsa-is-pushing-an-end-to-backup-algorithms-for-post-quantum-cryptography
- Source link: https://blog.cr.yp.to/20251004-weakened.html
Bernstein first emphasizes that it's normal for post-quantum cryptography (or "PQ") to be part of "hybrid" security that also includes traditional pre-quantum cryptography. (Bernstein says this is important because since 2016, "We've seen [3]many breaks of post-quantum proposals ...")
"The problem in a nutshell. Surveillance agency NSA and its [UK counterpart] GCHQ are trying to have standards-development organizations endorse weakening [pre-quantum] ECC+PQ down to just PQ."
> Part of this is that NSA and GCHQ have been endlessly repeating [4]arguments that this weakening is a good thing ... I'm instead looking at how easy it is for NSA to simply spend money to corrupt the standardization process.... The massive U.S. military budget now publicly requires cryptographic "components" to have [5]NSA approval ... In June 2024, NSA's William Layton [6]wrote that "we do not anticipate supporting hybrid in national security systems"...
>
> [Later a Cisco employee [7]wrote of selling non-hybrid cryptography to a significant customer, "that's what they're willing to buy. Hence, Cisco will implement it".]
>
> What do you do with your control over the U.S. military budget? That's another opportunity to "shape the worldwide commercial cryptography marketplace". You can tell people that you won't authorize purchasing double encryption. You can even follow through on having the military publicly purchase single encryption. Meanwhile you quietly spend a negligible amount of money on an independent encryption layer to protect the data that you care about, so you're actually using double encryption.
This seems to be a speculative scenario. But Bernstein is also concerned about how the Internet Engineering Task Force handled two drafts specifying post-quantum encryption mechanisms for TLS ("the security layer inside HTTPS and inside various other protocols"). For a draft suggesting "non-hybrid" encryption, there were 20 statements of support (plus 2 more only conditionally supporting it), but 7 more statements unequivocally opposing adoption, including one from Bernstein. The IETF has at times said they aim for " [8]rough consensus " — or for " [9]broad consensus " — but Bernstein insists 7 opposers in a field of 29 (24.13%) can't be said to match the legal definition of consensus (which is "general agreement"). "I've filed a formal complaint regarding the claim of consensus to adopt."
He's also written a second blog post [10]analyzing the IETF's decision-making process in detail. "It's already bad that the IETF TLS working group adopted non-hybrid post-quantum encryption without official answers to the objections that were raised. It's much worse if the objections can't be raised in the first place."
Thanks to [11]alanw (Slashdot reader #1,822) for spotting the blog posts.
[1] https://en.wikipedia.org/wiki/Daniel_J._Bernstein
[2] https://blog.cr.yp.to/20251004-weakened.html
[3] https://cr.yp.to/papers.html#qrcsp
[4] https://blog.cr.yp.to/20251004-weakened.html
[5] https://web.archive.org/web/20221022163808/https://www.jcs.mil/Portals/36/Documents/Library/Instructions/CJCSI%206510.02F.pdf?ver=qUEnOsWpGPcGGMFTb4yYVA%3D%3D
[6] https://web.archive.org/web/20250613195524/https://mailarchive.ietf.org/arch/msg/tls/ESCdYNwVeF4VkvoORFJLJk_87VU/
[7] https://web.archive.org/web/20250613195524/https://mailarchive.ietf.org/arch/msg/tls/S9Mwv28VEHrG189ZtoubUani7J8/
[8] https://web.archive.org/web/20250603130154/https://www.ietf.org/about/introduction/
[9] https://web.archive.org/web/20250528213926/https://www.ietf.org/blog/ietf-llc-statement-competition-law-issues/
[10] https://blog.cr.yp.to/20251005-modpod.html
[11] https://www.slashdot.org/~alanw
A question for people familiar with cryptology (Score:4, Informative)
If the Government was able to save all of the transactions from TOR until they built a Quantum Computer that could crack the encryption, would they be able to unlock all interactions in the Dark Web? Is my assumption incorrect that a QC could be made to crack the older encryption methods? Asking for a friend ;-).
Re: (Score:1)
> Is my assumption incorrect that a QC could be made to crack the older encryption methods?
If a more powerful quantum computer can be built, then it could do that. But there's no evidence thus far that an actually useful one can be built.
Re: (Score:2)
Very likely not. The sheer volume would prevent that. Also, if they have all transactions from TOR, they can do other pretty bad attacks. There is no indication they are even remotely on that level. They may occasionally, with high effort, have something when they know both endpoints, but even that may not work out. It seems all the takedowns of TOR servers done come back to rather conventional vulnerabilities in the applications being run there.
counterpoint (Score:2)
Peter Gutmann, CS professor University of Auckland has a different perspective on PQ: [1]https://www.cs.auckland.ac.nz/... [auckland.ac.nz]
[1] https://www.cs.auckland.ac.nz/~pgut001/pubs/bollocks.pdf
Re: (Score:1)
In that paper Gutmann argues that the experimental support for the notion quantum can reverse 2 factors is zero alongside time travel, FTL movement, and the startrek transporter while also pointing nearly half of all NIST PQC candidates have been broken and that every other new PKC came with decades of vulnerabilities and attacks.
That doesn't seem like a counterpoint. It seems like a more detailed explanation for the NSA's motive to keep more systems PQ only.
Re: (Score:2)
Not actually. Gutmann says PQ does not matter. That is very likely correct. It would mean however that the NSA very likely knows this and uses PQ as an attack vector against crypto it cannot work. DJB says to make sure any encryption also includes what is known to be secure when QCs are not a factor.
These points are really not at odds with each other.
Post-quantum? (Score:3)
So quantum cryptography has already run its course and we've moved on past it? There must be a gap in my timeline. Perhaps my mind was entangled.
Re: (Score:3)
> So quantum cryptography has already run its course and we've moved on past it? There must be a gap in my timeline. Perhaps my mind was entangled.
The discussion is about quantum computers for cracking cryptography, not about using quantum methods to encrypt. Post-quantum cryptography means cryptography that is not easily succeptible to cracking using a (as yet unrealized) quantum computer.
Re: (Score:2)
Yes, I know what it means. I'm poking fun at the English, which doesn't really match the meaning.
this has happened before (Score:2)
anyone remember the Dual_EC_DRBG controversy?
DJB's code (Score:2)
a long time ago i had a chat with someone who had looked at the source code for qmail and djbdns and the takeaway was that all DJB's code is post-quantum
Just the usual enemies of freedom at work (Score:2)
Same old, same old, nothing to see here.
DJB's Not Wrong (Score:2)
In the US, the push for non hybrid is all coming from the NSA.
The NIST people know this but can't say it publicly.
There was a pretty much unanimous consensus for hybrid schemes at the most recent ICMC.
I've been saying this since it became a thing which was pretty much at the last ICMC where NIST announced the deprecation of hybrid schemes.
What are the odds that they have a classical break of ML-KEM, or ML-DSA? SIKE was a finalist a fell to a classical attack.
The is the Dual-EC-DRBG all over again. It's good
Yes, NSA is pushing against hybrids (Score:5, Insightful)
PQ Hybrids, while inefficient, are designed to both defend against QC and traditional attacks by layering traditional and PQ algorithms. Thinking behind it is that PQ algorithms may have yet to be discovered traditional compute weaknesses.
Re:Yes, NSA is pushing against hybrids (Score:4, Informative)
> PQ Hybrids, while inefficient, are designed to both defend against QC and traditional attacks by layering traditional and PQ algorithms. Thinking behind it is that PQ algorithms may have yet to be discovered traditional compute weaknesses.
Or, worse, may have weaknesses that have been discovered, but have not been disclosed.
Re: (Score:2)
The other thing is that they are not really that inefficient. It likely does not matter at all in the greater scheme things and is just another fake "argument" being pushed.