Re: [Cfrg] New red herring from NSA on cryptographic algorithms

[Phillip Hallam-Baker <[e-mail]>]

On Thu, Jan 28, 2016 at 11:25 PM, Peter Gutmann
<[e-mail]> wrote:
> Phillip Hallam-Baker <[e-mail]> writes:
>
>>On the QC stuff. Of course we have to start looking at that now. But I think
>>we need to look at the problem on two separate tracks:
>>
>>1) Find a public key algorithm that resists QC using Shorr's algorithm.
>>2) Find a mechanism that makes symmetric key feasible in place of public.
>
> You forgot step 0:
>
> 0) Figure out whether any of this stuff is actually necessary
>
> This is just a bunch of random numbers pulled out of thin air, just as Suite B
> was in its day, and CCEP was before that.  There's no empirical argument
> supporting any of this, just a huge what-if.  For all we know the entire
> document could have come about from a barroom bet, "Well Bill, you had them
> chasing the Suite B white elephant, Dave got them really good with Dual-EC,
> now it's my turn to see how high I can make them jump.  And best of all, TAO
> will love me for it because they'll have to throw out most of their already-
> deployed, partially-patched-up infrastructure and start again, leading to lots
> of new exploitable mistakes and errors".
>
> If you're worried about QC, why aren't you worried about TWINKLE/TWIRL, which
> is at least as feasible, if not more so, than QC, and has been around much
> longer?

TWINKLE/TWIRL is an attack we are concerned about. Hence the move to EC.

But you are right that the bigger problem is the lack of
infrastructure. Hence my Mathematical Mesh proposal.

Cryptography today is just too hard to get working. And getting it
right is harder still. Take a look at 'getting started' guides on the
net for SSH. They all have to get around the bootstrap problem of how
do you SSH to a terminal using public key auth before you have public
key auth in ugly and insecure ways. Either I am the only person
developing code who uses multiple machines or people solve the
usability problem by using the same private key on all their machines.
That would be OK if it was on a token but I kinda suspect most don't
do that.

I don't think you have quite got the NSA position right either. I
think this is a part of a realignment that Snowden has forced onto
them. The systemic problem in the agency is that it is 90% civilian
but the senior management is entirely composed of military officers
who will be sacked if they don't get a promotion every 18 months. Up
or out is a really shitty way to run any company, And not just because
of the cost to employees. It means that you are guaranteeing that the
senior management who should be the ones thinking about the long term
are focused like a laser on the short. Bad enough in industry, when
90% of your workforce is tenured civil service, its catastrophic.

What Snowden revealed was a bunch of Powerpoint slides made by Majors
trying to make Colonel. And they were dressing everything they could
up in aggressive terms because all Alexander was interested in was
attack. US has not been forced to fight a defensive war in over a
century. What all the Senators most likely to come to the defense of
the agency on PRISM etc. have in common is that they are due for
retirement.

So now the agency has to face the real possibility that its main
reason for being will vanish. They will probably be able to do some
surveillance in the future but it won't be pervasive. So they have to
find a new relevance and they are getting serious about the
cyber-engagement risks if they are going to maintain their funding in
the long term.