go on...

▲ thayne 2 hours ago | parent | next [-]

There is some evidence that they have done it becore.

Specifically, that they had a backdoor for Dual EC DRBG[1], and pushed for a shorter key lenghth for DES, to intentionally weaken it.

It is, obviously, controversial. But I think there is certainly enough there that I wouldn't be confident that the NSA wouldn't recommend something they knew to be weak in some way, even to other government organizations.

[1]: https://en.wikipedia.org/wiki/Dual_EC_DRBG

▲ tharkun__ 5 hours ago | parent | prev [-]

3DES...

▲ djohnmustard 4 hours ago | parent [-]

What about it?

▲ tharkun__ 3 hours ago | parent [-]

It was widely used, even in government and military. Who knows if they actually used the same as everyone else in actuality. I guess none of this is proven beyond doubt, given the nature of all this?!

    Reporting on declassified history says the NSA pushed for a shorter DES key; the compromise was 56 bits

    NSA and a suspected cryptographic backdoor: the Dual_EC_DRBG random-number generator was the subject of reporting about an NSA backdoor and an alleged payment to RSA. RSA denied knowingly weakening its products.

    TLS 1.0’s CBC chaining made IVs predictable and enabled the BEAST attack. That’s a documented protocol weakness, allegedly put in there by US state actors on purpose.

YMMV but none of this would surprise any reasonable person given Snowden's revelations.

▲

tptacek an hour ago | parent | next [-]

This CBC chaining thing is my all-time absolute favorite cryptography conspiracy theory, because on the IETF list where it happened (it happened for IPSEC, not for TLS, for what it's worth) Phil Rogaway pled with long-time standards body people --- even took up a petition of cryptographers, including Rivest --- and was openly and viciously mocked for the attempt.

The US government had no need to corrupt IPSEC standardization. The IETF did the work for them without prompting.

▲

duskwuff 2 hours ago | parent | prev [-]

> TLS 1.0’s CBC chaining made IVs predictable and enabled the BEAST attack. That’s a documented protocol weakness, allegedly put in there by US state actors on purpose.

This is errant nonsense. At the time SSL/TLS were designed, using CBC with block ciphers was generally considered best practice - it was not at all an unusual choice.

	▲	tptacek an hour ago \| parent \| next [-]
		Using CBC is fine. TLS and (prior to that) IPSEC set the CBC IV of messages to the last ciphertext block of the previous message --- pretending as if they were encrypting one long stream, rather than discrete messages. That's never been OK, and cryptographers warned about it at the time.
	▲	robrain 2 hours ago \| parent \| prev [-]
		Arrant nonsense, surely?