NSA and IETF: Can an attacker purchase standardization of weakened cryptography?

https://blog.cr.yp.to/20251004-weakened.html

by zdw • 10 months ago

251 109 10 months ago

blog.cr.yp.to

mjg5912• 10 months ago

It's a touch odd to make a big deal of the fact that you've filed a complaint and fail to mention that it was formally rejected three days before you published the post: https://datatracker.ietf.org/group/iesg/appeals/artifact/146

fn-mote• 10 months ago

Lots of respect to both you and the author, but the rejection gives no real response to any of the issues I see raised in the document.

It failed to raise my confidence at all.

The IESG has concluded that there were no process failures by the SEC ADs. The IESG declines to directly address the complaint on the TLS WG document adoption matter. Instead, the appellant should refile their complaint with the SEC ADs in a manner which conforms to specified process.

mjg5912• 10 months ago

I feel like if your argument is that the rules weren't followed, you have a pretty strong obligation to follow the rules in submitting your complaint.

EasyMark2• 10 months ago

It's still nice that it was put up for completeness. And as we know this stuff has a long sordid history of people who are proponents of weakening encryption not giving up easily.

schoen3• 10 months ago

DJB has been complaining about this NSA position since 2022 (I guess long before it was an issue at the TLS WG):

https://blog.cr.yp.to/20220805-nsa.html

I'm actually quite surprised that anyone is advocating the non-hybrid PQ key exchange for real applications. If it isn't some sort of gimmick to allow NSA to break these, it's sure showing a huge amount of confidence in relatively recently developed mechanisms.

It feels kind of like saying "oh, now that we can detect viruses in sewage, hospitals should stop bothering to report possible epidemic outbreaks, because that's redundant with the sewage monitoring capability". (Except worse, because it involves some people who may secretly be pursuing goals that are the opposite of everyone else's.)

Edit: DJB said in that 2022 post

  > Publicly, NSA justifies this by
  > 
  > . pointing to a fringe case where a careless effort to add an extra security layer damaged security, and
  > . expressing "confidence in the NIST PQC process".

tptacek10• 10 months ago

Expand on "recently-developed mechanisms".

schoen3• 10 months ago

I don't have a good sense of what to point to as the "mechanism".

https://en.wikipedia.org/wiki/Lattice-based_cryptography#His...

2005 (LWE), 2012 (LWE for key exchange), earlier (1990s for lattice math in general), 2017 (Kyber submission), later (competition modifications to Kyber)?

I can see where one could see the mathematics as moderately mature (comparable in age to ECC, but maybe less intensively studied?). As above, I don't know quite how to think about whether the "thing" here is properly "lattices", "LWE", "LWE-KEX", "Kyber", or "the parameters and instantiation of Kyber from the NIST PQ competition". Depending where we focus our attention there, I suppose this gives us some timeframe from the 1980s (published studies of computational complexity of lattice-related algorithms) to "August 2024" (adoptions of NIST PQ FIPS documents).

Edit: The other contextual thing that freaks out DJB, for those who might not be familiar, is that one of the proposed standards NIST was considering, SIKE, made it all the way through to the final (fourth) round of consideration, whereupon it was completely broken by a couple of researchers bringing to bear mathematical insight. Now SIKE had a very different architecture than the other proposals in the fourth round, so it seems like a portion of the debate is whether the undetected mathematical problems in SIKE are symptomatic of "the NIST competition came extraordinarily close to approving something that was totally broken, so maybe it wasn't actually that great at evaluating candidate algorithms, or at least maybe the mathematics community's understanding of post-quantum key exchange algorithms is still immature" or more symptomatic of "SIKE had such a weird and distinctive architecture that it was hard to understand or analyze, or hard to motivate relevant experts to understand or analyze it, unlike other candidate algorithms that were and are much better understood". It seems like DJB is saying the former and you're saying the latter.

rainsford• 10 months ago

I'm actually quite surprised that anyone is advocating the non-hybrid PQ key exchange for real applications.

Why is that so surprising? Adopting new cryptography by running it in a hybrid mode with the cryptography it's replacing is generally not standard practice and multi-algorithm schemes are pretty niche at best (TrueCrypt/VeraCrypt are the only non-PQ cases that come to mind, although I'm sure there are others). Now you could certainly argue that PQ algorithms are untested and risky in a way that was not true of any other new algorithm and thus a hybrid scheme makes the most sense, but it's not such an obviously correct argument that anyone arguing otherwise must be either stupid or malicious.

schoen3• 10 months ago

There are probably other periods of time when I might have advocated running hybrids of different families of primitives, although I'm not sure that I was ever following the details closely enough to have actually advocated for that.

The cool thing is the dramatic security improvements against certain unknown unknowns for approximately linear additional work and space. Seems like a pretty great advantage for the defender, although seriously arguing that quantitatively requires some way to reason about the unknown unknowns (the reductio ad absurdum being that we would need to use every relevant primitive ever published in every protocol¹).

I see PQC as somehow very discontinuous with existing cryptography, both in terms of the attacks it tries to mitigate and the methods it uses to resist them. This might be wrong. Maybe it's fair to consider it an evolutionary advance in cryptographic primitive design.

The casual argument from ignorance is that lattices are apparently either somewhat harder to understand, or just less-studied overall, than other structures that public-key primitives have been built on, to the extent that we would probably currently not use them at all in practical cryptography if it weren't for the distinctive requirements of resistance to quantum algorithms. I understand that this isn't quantitative or even particularly qualitative (for instance, I don't have any idea of what about lattices is actually harder to understand).

Essentially, in this view, we're being forced into using weird esoteric stuff much earlier than we'd like because it offers some hope of defending against other weird esoteric stuff. Perhaps this is reinforced by, for example, another LWE submission having been called "NewHope", connoting to me that LWE was thought even by many of its advocates to offer urgently-needed "hope", but maybe not "confidence".

I'd like not to have to have that argument only in terms of vibes (and DJB does have some more concrete arguments that the security of SIKE was radically overestimated, while the security of LWE methods was moderately overestimated, so we need to figure out how to model how much of the problem was identified by the competition process and how much may remain to be discovered). I guess I just need to learn more math!

¹ I think I remember someone at CCC saying with respect to the general risk of cryptographic backdoors that we should use hybrids of mechanisms that were created by geopolitical rivals, either to increase the chance that at least one party did honest engineering, or to decrease the chance that any party knows a flaw in the overall system! This is so bizarre and annoying as a pure matter of math or engineering, but it's not like DJB is just imagining the idea that spy agencies sometimes want to sabotage cryptography, or have budgets and staff dedicated to doing so.

arcfour2• 10 months ago

This is quite concerning, and respect to DJB for fighting against it. However, I have to wonder...who would this actually compromise that matters to NSA?

* Targets with sufficient technical understanding would use hybrids anyway.

* Average users and unsophisticated targets can already be monitored through PRISM which makes cryptography moot.

So...what's their actual end game here?

skissane• 10 months ago

I think the point is... even if you can't get everyone to adopt your backdoored technology, you are much better off if 30% of the market adopts it than if >1%...

Intelligence is a numbers game, they never get everything, but if your net is wide enough and you don't give up, you'll catch a lot of fish over time

tptacek10• 10 months ago

What's quite concerning? Be specific.

arcfour2• 10 months ago

It is concerning that the IETF is moving forward with a proposal that weakens security and is of questionable technical merit, with the most reasonable explanation being that this is the result of efforts by government surveillance agencies to enable or potentially enable monitoring of encrypted communications supposedly protected by this standard; additionally, it is concerning that disagreeing with this decision is being met with censure and outright hostility by leaders of the IETF.

timschmidt14• 10 months ago

Coupled with QUANTUMINSERT, it would enable a https://en.wikipedia.org/wiki/Downgrade_attack even for folks who might otherwise be using stronger encryption methods.

londons_explore3• 10 months ago

The vast majority of organisations just use whatever default security settings their Cisco router or web browser comes with.

The NSA starts by requiring some insecure protocols be supported, and then when support is widespread they start requiring it be made a default by requiring compliance testing be done with default config.

philsnow• 10 months ago

They also historically have extremely deep access to networks, and even if a given corp doesn't allow them to put a box inside the corp's own network, they control / have access to many or all of the links between most corps' datacenters.

From this privileged network position, if both sides support weaker crypto that NSA lobbied for, they can MitM the initial connection and omit the hybrid methods from the client's TLS ClientHello, and then client/server proceed to negotiate into a cipher that NSA prefers.

tgsovlerkhgsel• 10 months ago

99% of global TLS traffic?

EasyMark2• 10 months ago

The mere idea that that they want to do this makes me want a 3rd layer of encryption on top of the other 2.

londons_explore3• 10 months ago

Encryption layers are actually pretty cheap for the vast majority of ciphers and applications.

Seems dumb not to have like 10.

krior• 10 months ago

Nothing is as cheap (and secure at the same time) as hardware-accelerated AES. Thats why its often the only encryption-layer used.

seabass-labrax• 10 months ago

Make sure you absolutely have fresh entropy for all ten of your encryption layers. Re-using secrets and randomness between different encryption algorithms can leak a lot of data!

commandersaki4• 10 months ago

Ah FIPS, the bastion of security standards.

taffronaut• 10 months ago

I misread that as "the bassoon of security standards" and it sent my brain in a whole other direction

zghst• 10 months ago

There is so much here to debate about. A) Never trust the cyber feds. B) The NSA is not the place anyone thinks, it’s a Wild West in the most bizarre of places, trust me from experience. C) Cryptology concerns more of than security and exchanging messages or packets, sometimes you don’t even know what kind of thing (living) can and has been decrypted. D) The NSA plays very, very, very dirty. It is like a digital CIA, they are in everything (i.e. cyber spies in various roles at tech/telecom/manufacturer company xyz). E) NEVER LISTEN TO THE DAMN NSA / DRIVEN BY A CULTURE OF EXPLOITATION

torben-friis• 10 months ago

sometimes you don’t even know what kind of thing (living) can and has been decrypted.

Y_Y• 10 months ago

Ok, aside from not trusting the NSA, could you expand on why someone should trust you?

heresie-dabord• 10 months ago

expand on why someone should trust you

The point is to trust no one and no thing that we cannot examine freely, closely, and transparently. And to maintain healthy skepticism of any entity that claims to have a virtuous process to do its business.

tptacek10• 10 months ago

I used to be such a fan of this guy. But he's turned into Ed Zitron, the same long rambling rants, except about cryptography, and except that he knows what he's talking about, and he knows that you have to know literally nothing at all about the field he's commenting on to associated Dual EC with anything happening in PQ. And if you know anything about the field, trying to compare MLKEM with SIKE is the same deal. It's really sad.

Dual EC wasn't a shockingly clever, CS-boundary-pushing hack (and NSA has apparently deployed at least one of those in the last 20 years). It was an RNG (not a key agreement protocol) based on asymmetric public key cryptography, a system where you could look at it and just ask "where's the private key?" There wasn't a ton of academic research trying to pick apart flaws in Dual EC because why would there be? Who would ever use it?

(It turns out: a big chunk of the industry, which all ran on ultra-closed source code and was much less cryptographically literate that most people thought. I was loudly wrong about this at the time!)

MLKEM is a standard realization of CRYSTALS-Kyber, an algorithm submitted to the NIST PQ contest by a team of some of the biggest names in academic PQ cryptography, including Peter Schwabe, a prior collaborator of Bernstein. Nobody is looking at MLKEM and wondering "huh, where's the private key?".

MLKEM is based on cryptographic ideas that go back to the 1990s, and were intensively studied in the 2000s. It's not oddball weird cryptography. It is to the lineage of lattice cryptography roughly what Ed25519 was to elliptic curve cryptography at the time of Ed25519's adoption.

Utterly unlike SIKE, which isn't a lattice algorithm at all, but rather a supersingular isogeny algorithm, a cryptographic primitive based on an entirely new problem class, and an extremely abstruse one at that. The field had been studying lattice cryptography intensively for decades by the time MLKEM came to pass. That's not remotely true of isogeny cryptography. Isogenies were taken seriously not because of confidence in the hardness of isogenies, but because of ergonomics: they were a drop-in replacement for Diffie Hellman in a way MLKEM isn't.

These are all things Bernstein is counting on you not knowing when you read this piece.

commandersaki4• 10 months ago

To use his analogy though, why remove seatbelts? It's like saying we have IPv6 now, why do we need IPv4 support.

tptacek10• 10 months ago

For the same reason your Toyota Camry doesn't have a roll cage.

I'd use a hybrid if I was designing a system; I am deeply suspicious of all cryptography, and while I don't think Kyber is going to collapse, I wouldn't bet against 10-15 years of periodic new implementation bugs nobody knew to look for.

But I'm cynical about cryptography. It's really clear why people would want a non-hybrid code point.

Let me just say this once as clearly as I can: I sort of don't give a shit about any of this. A pox on all their houses. I think official cryptographic standards are a force for evil. More good is going to be done for the world by systems that implement well enough to become de facto standards. More WireGuards, fewer RFCs. Certainly, I can't possibly give even a millifuck about what NIST wants.

But I also can't be chill about these blog posts Bernstein writes where it's super clear his audience is not his colleagues in cryptography research, but rather a lay audience that just assumes anything he writes must be true and important. It's gross, because you can see the wires he's using to hold these arguments together (yes, even I can see them), and I don't like it when people insult their audiences this way.

procaryote• 10 months ago

As I read it, the point of mentioning Dual EC is to show a previous case where NSA have acted in a way that reduces security for hand-wavy reasons, in addition to the DES case where they did the same.

And now, in a world where QR + pre-QR algos are typically being introduced in a layered fashion, they're saying "let's add another option, to reduce the number of options" which at least looks very suspicious

Practical quantum computers are probably not very close, but you can certainly use the fear of them as a chance to introduce a new back-door. If you did, you'd have to behave exactly as the NSA is doing right now.

h123abfar• 10 months ago

Thanks, I'll use Bernstein's recommendations. His article is not rambling: Mailing list discussions are just tedious to recap.

I wonder what your strategy here is. Muddying the waters and depict Bernstein as a renegade? You have made too many big-state and big-money apologist posts for that to work.

pbsd• 10 months ago

The SIKE comparison is not particularly inconsistent since Bernstein has been banging the drum that structured lattices may not be as secure as thought for years now.

Currently the best attacks on NTRU, Kyber, etc, are essentially the same generic attacks that work for something like Frodo, which works on unstructured lattices. And while the resistance of unstructured attacks is pretty well studied at this point, it is not unreasonable to suspect that the algebraic structure in the more efficient lattice schemes can lead to more efficient attacks. How efficient? Who knows.

tptacek10• 10 months ago

Without wanting to engage much more deeply on this topic let me just say I concede any cryptography point 'pbsd makes.

Thorrez• 10 months ago

Bernstein wasn't the only objector. There were 7 objectors and 20 proponents.

Dual EC isn't the only comparison he's making. He's also making a comparison to DES, which had an obvious weakness: 53 bit limitation, similar to the obvious weakness of non-hybrid. In neither case is there a secret backdoor. At the time of DES, the NSA publicly said they used it, to make others confident in it. Similarly, the NSA is saying "we do not anticipate supporting hybrid in NSS", which will make people confident in non-hybrid. But in the background, NSA actually uses something more secure (using 2 layers of encryption themselves).

philodeon7• 10 months ago

ML-KEM and SIKE were both candidates in the PQ competition which ML-KEM won. SIKE was considered such a strong contender that it was used in production TLS experiments at scale by Google and Cloudflare. (I guess you didn’t read past the second paragraph?)

You find it offensive now to compare ML-KEM and SIKE because SIKE was so thoroughly broken and demonstrated to be worse than pre-quantum crypto. But ML-KEM may already be broken this thoroughly by NSA and friends, and they’re keeping it secret because shipping bad crypto to billions of people enables SIGINT. The idea that your professional crypto acquaintances might be on the NSA’s payroll clearly disturbs you enough that you dismiss it out of hand.

Bernstein is proposing more transparency because that is what was promised after the Dual-EC debacle. Do you disagree with Bernstein because he advocates for transparency (which could prevent bad crypto shipping), or because of his rhetorical style?

tptacek10• 10 months ago

I find the comparison risible because SIKE is based on an entirely different and novel problem class, and the vibe I get from Bernstein is that he thinks lattice cryptography is alien enough to people who don't work in this space that they'll miss the fact that cryptosystems based on ring-LWE hardness have been worked on by giants in the field since the mid-1990s.

greatgib• 10 months ago

For bigger impact, this article would deserve a tldr executive summary at the beginning I think.

logicallee• 10 months ago

I skimmed the article, but it doesn't make too much sense. It says:

Surveillance agency NSA and its partner GCHQ are trying to have standards-development organizations endorse weakening ECC+PQ down to just PQ.

The NSA spends about half of its resources attempting to hack the FBI and erase its evidence against them in the matter of keeping my wife and me from communicating. The other half of the staff are busy commenting online about how unfair this is, and attempting to get justice.

There are no NSA resources left for actions like the one I quoted. I don't think NSA is involved in it.

philodeon7• 10 months ago

According to the New York Times in 2013, based on Snowden documents, the NSA allocates $250 million every year for the actions you quoted. They call it the “SIGINT Enabling Project”.

They are not running out of resources.

alphazard• 10 months ago

It sounds like there is probably some ongoing drama here, but aside from that: this post has convinced me that standards this important need to be decided on by organizations that aren't a government.

I wonder who else could reasonably host a standardization process? Maybe the Linux Foundation? All the cryptography talent seems to be working on ZK proofs at the moment in the Ethereum ecosysetem; I think if Vitalik organized a contest like NIST people would pay attention.

The most important thing is to incentivize attackers to break the cryptography on dummy examples instead of in the wild. Ideally: before the algorithm is standardized. The Ethereum folks are well setup to offer bounties for this. If a cryptographer can make FU money through responsible disclosure, then there is less incentive to sell the exploit to dishonest parties.

bgwalter2• 10 months ago

The chilling part is that a guy named Wouters threatens to ban Bernstein in a characteristically rude CoC message:

https://mailarchive.ietf.org/arch/msg/tls/RK1HQB7Y-WFBxQaAve...

Trust the process!

pluto_modadic• 10 months ago

I think... that's because.. DJB was... (gasp) disobeying the code of conduct. and has been, for a long, long, loooong time.

andai• 10 months ago

The post-quantum algorithm might turn out to be breakable even with today's computers

This implies that what is actually being offered is Security Through Ignorance.

Is this encryption sound? Maybe, who knows! Let's wait and find out!

wartywhoa232• 10 months ago

The same applies to the raving push to replace RSA with ECC. A long trusted algorithm suddenly became ill-trusted, too complex to implement right, too slow, too unfashionable, and the influx of these accusations was too synchronized and templated to look like something organic.

1vuio0pswjnm7• 10 months ago

We need something better than TLS, a non-standard

Maybe an stunnel for CurveCP, or something like PQConnect

History has shown djb is usually right

He has been far more productive at writing software and developing cryptography that has avoided security vulnerabilities than any of the IETF WG members. The best part about his software IMHO is that it is small with low resource requirements and can primarily serve ordinary individual computer users, as opposed to large, complex, steep learning curve software primarily serving corporations like the ones that publish RFCs and send people to IETF meetings

Anyone reading this comment is probably using djb's cryptography in TLS. His contributions to today's internet are substantial

It really says a lot about "IETF" and other Silicon Valley pseudo-governance that a talented and trustworthy author, who has remained an academic when so many have sold out, gets treated like a nuisance

NSA and IETF: Can an attacker purchase standardization of weakened cryptography?

Related Stories