Trevor Perrin requests removal of NSA from IETF Crypto Review

http://www.ietf.org/mail-archive/web/cfrg/current/msg03554.html

by tptacek • 13 years ago

1056 140 13 years ago

tptacek14• 13 years ago

Two things you did not know before this post but know now:

* The IETF has a dedicated crypto review board, the CFRG, which approves or pokes holes in the cryptography used by other IETF standards.

* The chair of the IETF CFRG is an NSA employee (Kevin Igoe, one of the authors of the SHA1 hash standard).

I just learned these things a couple weeks ago. I am not generally a believer in the theory that NSA actively subverts Internet standards†. But even I think that it's crazy for an NSA employee to chair the CFRG.

In case you're wondering: Trevor Perrin is widely respected professional cryptographer. Most cryptographers work for university math departments. Perrin worked for years as a staffer for Paul Kocher, the godfather of side channel attacks, at Cryptography Research. He's the designer of the new forward secrecy ratchet for OTR (Axolotl) and the TACK TLS extension, and a behind-the-scenes contributor to other IETF crypto standards. Perrin wrote the pure-Python "tlslite" TLS implementation. If you were to draw a "family tree" of crypto know-how in the software security profession, a surprisingly huge chunk of it would be rooted in Perrin (and Nate Lawson and Kocher); for instance, virtually every modern TLS break came from ideas that Perrin popularized. 64 current Matasano Crypto Challenges, probably 50 of them I can trace to Perrin and Lawson. Trevor Perrin is someone you should pay attention to.

† (my best guess is that the standards NSA was actively subverting were about international telephony; subverting the IETF is a little like subverting the Linux kernel --- doable, but bad tradecraft)

tptacek14• 13 years ago

I can give you some of the backstory on Dragonfly, by the way, if enough people are interested.

cpach• 13 years ago

Please do :)

Botnet• 13 years ago

My interest has been piqued.

angersock• 13 years ago

Sure!

cryptbe2• 13 years ago

tlslite is very neat. it must be super hard for me to work on tls without it.

virtually every modern TLS break came from ideas that Perrin popularized

oh i didn't know this. what are the ideas?

tptacek14• 13 years ago

This would be a better conversation for us to have offline. :)

flogic• 13 years ago

It may be bad tradecraft to subvert IETF standards but it would be wholely inline with people trying to padd their yearly performance review. Given the questionable effectiveness of some of the programs, review padding seems very plausible.

salient3• 13 years ago

Even after this you still don't think they're actively subverting encryption standards?

http://www.mail-archive.com/cryptography@metzdowd.com/msg123...

tptacek14• 13 years ago

No. I believe I know the specific people to whom Gilmore is referring, and I believe his observations to be a straightforward result of incompetence. You have to have read the IPSEC working group list posts of the time and see how the group treated real cryptographers to understand how unnecessary it would have been for NSA to have corrupted that standard.

No, I don't think NSA tried to subvert IPSEC, and especially not in the way Gilmore describes.

wwhyte• 13 years ago

_But even I think that it's crazy for an NSA employee to chair the CFRG_

+1. Fine for him to provide individual contributions, not fine at all for him to have a position of responsibility.

dmix• 13 years ago

subverting the IETF is a little like subverting the Linux kernel --- doable, but bad tradecraft

This is a great point. The mailing list and public nature of the standards process makes it very difficult to subvert, without very high risks of getting caught and breaking trust in the community. These agencies need to keep hiring good cryptographers and ideally keep bodies working on standards.

Shows the importance of OSS in security and having people like Trevor Perrin keeping watch.

But at the same time - if the NSA was going to subvert encryption standards - I doubt they would subvert the process with someone who is known to work at the NSA. Intelligence agencies would operate covertly. Most likely by converting someone trusted in the community into an agent, or grooming their own agent straight out of high school/university and getting them to a point of influence in the community (over a long period of time) and only then having them damage crypto standards. < this is standard tradecraft.

FeeTinesAMady• 13 years ago

But if people are going to use the argument that they'd never use an NSA employee to subvert encryption standards, as you are doing here, that clears them to do just that.

Furthermore, before the Snowden revelations, they weren't under suspicion for trying to do that.

Timmmmbob• 13 years ago

Bullshit. Subverting the Linux kernel would easily be within the capabilities of the NSA.

Kernel contributors aren't background-checked so all you need to do is to pay someone to do some legitimate kernel hacking in a sensitive area. Then in one of their commits slip in a backdoor.

"But noooo the many eyes will see the backdoor!" you say.

This is clearly false. If it were true Linux would have no security bugs at all. Since old security bugs continue to be found, it follows that it is possible to have a security bug that goes unnoticed for many years. See also the underhanded C contest.

Hell maybe it has already happened. Who is to say the latest Linux security bug wasn't deliberately introduced by the NSA?

I don't think this is paranoia - it would be fairly easy for the NSA to do, very useful and almost completely deniable. I would do it if I were them. They certainly wouldn't not do it for moral reasons because they've shown they don't really have any.

aragot2• 13 years ago

On the one hand, a background check should reject anyone with such a visible a conflict of interest; On the other IETF is full of U.S. nationals, so it's only trustable for countries with common interests with the U.S. Either way, the IETF reputation will be exactly constant before or after a decision is made.

DanBC• 13 years ago

I am not generally a believer in the theory that NSA actively subverts Internet standards†. But even I think that it's crazy for an NSA employee to chair the CFRG.

I am uncomfortable with the NSA / GCHQ being that closely tied to the standards process.

I'm much happier when they're noodling away with research in the background and providing support to universities.

An example: GCHQ invented PK before Diffie and Hellman. They invented RSA before RSA did. They kept both of these secret for many years. GCHQ's RSA was not revealed until 24 years later. (About 20 years after RSA had been in use).

So, secret government spy agencies keep secrets. I think this is as alarming as secret government spy agencies spy. While they might not actively subvert crypto standards would they allow weaknesses to be implemented without comment?

tytso• 13 years ago

subverting the IETF is a little like subverting the Linux kernel --- doable, but bad tradecraft

... and what kind of tradecraft, pray tell, is subverting a random number generator and planting it inside the BSAFE library after paying off RSA DSI with a $10 million dollar contract?

If the NSA is willing to do something like this, what is would it consider too unethical/immoral/bad tradecraft not to do?

bonemachine2• 13 years ago

subverting the IETF is a little like subverting the Linux kernel --- doable, but bad tradecraft

Unfortunately the fact it might be "bad tradecraft" doesn't seem to be much of an impediment for U.S. intelligence agencies. They seem to have a knack for getting caught with their pants down over stunts that one would think that cooler heads would have prevailed against as being not only reckless, but to have had the potential for, at the very best, marginal tactical benefit.[1],[2]

[1] https://news.ycombinator.com/item?id=6946909

[2] https://en.wikipedia.org/wiki/Abu_Omar_case

RyanZAG• 13 years ago

The next message in the thread is interesting too: http://www.ietf.org/mail-archive/web/cfrg/current/msg03555.h...

A request to replace him with Bruce Schneier.

tptacek14• 13 years ago

Bruce Schneier is not a great pick for this role. The CFRG is an extremely technical working group; the CFRG chair needs to be intimately familiar with a broad selection of modern cryptography. By way of example, Schneier is avowedly unfamiliar with elliptic curve. Schneier is a great popularizer of cryptography, but there are much better choices for the person whose job it will be to spot errors in other standards.

yid• 13 years ago

DJB! If you could get him out of his cave at UIC.

malandrew• 13 years ago

Who would be good choices that aren't already participating?

kro0ub• 13 years ago

I think that Bruce Schneier has in some regards become to HN what "Neil deGrasse Tyson" is to reddit.

Angostura• 13 years ago

Is Dorothy Denning still working actively?

netman21• 13 years ago

I have shared similar concerns about the NSA's involvement with the Trusted Computing Group and called for TCG to repudiate the NSA.

salient3• 13 years ago

What the hell? And people are still skeptical about trusted computing having backdoors?

conformal• 13 years ago

TPM uses 2048-bit rsa keypairs that are hardwired into the hardware. gee, i wonder if someone can get into them...

derp

slashdotaccount• 13 years ago

By the way, this submission is getting up so slowly (despite the upvotes) because its title contains "NSA" (which automatically penalizes the submission as revealed earlier).

tptacek14• 13 years ago

D'oh! I forgot about that.

endianswap• 13 years ago

Can you link to this revelation, please? Thanks!

sp332• 13 years ago

http://www.righto.com/2013/11/how-hacker-news-ranking-really...

It appears that any article with NSA in the title gets an automatic penalty of .4. I looked for other words causing automatic penalties, such as awesome, bitcoin, and bubble but they do not seem to get penalized.

I observed that many websites appear to automatically get a penalty of .25 to .8: arstechnica.com, businessinsider.com, easypost.com, github.com, imgur.com, medium.com, quora.com, qz.com, reddit.com, rt.com, stackexchange.com, theguardian.com, theregister.com, theverge.com, torrentfreak.com, youtube.com. I'm sure the actual list is longer.

bzelip• 13 years ago

and here's the HN post https://news.ycombinator.com/item?id=6799854

grumps• 13 years ago

Normally I'm for this, but this seems to be a valid discussion for HN.

I rarely upvote, but I did this time.

declan• 13 years ago

Perhaps it's time for a new IETF default: No NSA employee should be chair of an encryption-related working group.

If the NSA wishes to change that rule in the future, it can publicly ask Congress to enact a law making it a federal felony for a government employee or contractor to try to subvert, compromise, or weaken public encryption standards. (That would still allow the NSA to subvert, compromise, or weaken proprietary Chinese or Russian military encryption standards, if it is capable of doing so.)

Until the NSA requests such a federal law -- and it's duly enacted -- it seems folly to encourage the participation of its employees in the IETF process, let alone granting them a position as chair of an encryption working group. Put another way, the NSA's signals intelligence mission has eclipsed its information assurance mission.

Even President Obama's NSA review group that came out with a report this week recommended that the agency "should not" weaken commercial encryption software. Why not a "must not?" p36: http://www.whitehouse.gov/sites/default/files/docs/2013-12-1...

treekiller2• 13 years ago

"That would still allow the NSA to subvert, compromise, or weaken proprietary Chinese or Russian military encryption standards"

But would it? How would you distinguish? Why wouldn't they just use whatever is known to be off-limits?

teddyh2• 13 years ago

No NSA employee should be chair of an encryption-related working group.

This makes me think: What is the basis of trusting any organization or person not to have their own agenda, possibly contrary to the group’s ostensible agenda?

The basis is this: We have a tacit assumption that all participants have realized that better standards (and strong crypto, more secure systems) will lead to the betterment of all. This is the default assumption.

However, now that the U.S. government, and the NSA and its collaborators in particular, have been shown to explicitly not have this goal – in fact, their goal has been to strive for less secure systems and more difficult standards – what should be done? The logical thing to do is to exclude any person or organization revealed to have an agenda explicitly contrary to the group.

The same argument could be made (and has been made many times in the past) for Microsoft to be excluded from any and all standardization committees like ISO, IEEE, IETF, etc. for the same reason – their repeated practice of Embrace, Extend & Extinguish among other things shows them to have an agenda contrary to the group, and their participation would therefore be a detriment, not an asset.

bmelton• 13 years ago

I'm as against the NSA's activities as anybody can be, but I don't think this is a fair statement.

their goal has been to strive for less secure systems and more difficult standards

I don't think, specifically, that they're looking for weaker standards. Weaker standards would allow for competing governments to have just as much access as the NSA does. I think they'd prefer stronger standards, but that they _still have the key to_.

In short, I don't think they want cheaper locks, they want better locks, and master keys.

Edit: Everything else you said is spot-on.

pvnick• 13 years ago

It's been interesting watching the reactions to these revelations from the more skeptical folks. Tptacek, have there been any stories (besides this one I suppose) that have really surprised you and struck you as unreasonable overreach?

tptacek14• 13 years ago

Uh, I think pretty much all of it is overreach. The FISA 215 metadata stuff was particularly bad.

The only stuff that doesn't upset me is genuine foreign intelligence. The NSA can listen in on the Israelis as much as they want, as far as I'm concerned; the Israelis sure as shit listen to us.

yeukhon18• 13 years ago

I want to raise an issue that people often ignore. We put the government's fault onto an employee's fault.

But I will state my position clearly: I do think the resignation is a good thing. I don't agree with the word "removal".

The biggest problem to me is not about NSA involvement, it is how WE treat people who work at NSA and other government intelligence agency. If the fear of a single man is what makes the issue hot, I beg to differ. You can disagree with him and not pass the standard. If the whole committee thinks there is something fishy, I see no reason why the proposal would get through the internal draft. It is that distrust.

My school and many schools out there would send out internship notice; if you are a public school one of those would be government internship and among them is NSA and FBI.

How do we treat these kids in the future? How should we treat our future or current co-workers who had worked as contractor or done internship at NSA, FBI and CIA?

Do we trust them?

The fact that "NSA [employees] (edit, response to http://www.ietf.org/mail-archive/web/cfrg/current/msg03556.h...) should not be in any position in the cryto committee" is too far. He should resign in fact, to avoid interest conflict; people don't trust NSA right now. But how are we treating these employees? Have we asked him privately? Should this email be in the public in the first place? Have they ever had a private conservation about this? I think like it is more of an attack and a warning to all NSA-title employees that they should never reveal their affiliations, even on resume.

Since everyone does things differently, some will never join NSA and some will for either money or technical development or patriotism, how do we as people treat these employees?

I am upset that when people look down at them and think they are rat. This is a stronger ethic issue that few notice. The whole "removal" sounds like "one ought not be an NSA employee." Being someone new to security and admire open standard and fear of backdoor, I think it is nicer and professional if that has been raised to Kevin Igoe first privately.

From the way the mail is phrased: it never happened.

semiel• 13 years ago

I'm happy to state it directly:

One ought not be an NSA employee.

yeukhon18• 13 years ago

That's rather radical and unprofessional to say.

One can say such thing to Google, Facebook, Adobe or any company out there if they dislike that company. Any nsa contractor who depends on government contract to feed their families - is it wrong? If I can't find a job at private industry but NSA hired me for 3 months is it wrong that I did it for the money for my family? How would you know that was my story? You won't and you will just penalize me for being a contractor once.

And people have different degree of tolerance and standard for patriotism. i don't endorse what they do, but that's exact false attitude we have toward NSA affiliations. We put government's fault onto the workers and it is wrong.

gohrt• 13 years ago

That just fills the NSA with worse people. If the NSA is broken, it must be fixed or destroyed.

Will draining the NSA of its ethical population improve it? Perhaps -- by hastening its demise -- but that is not the obvious result. Needs further analysis and argument.

a3n2• 13 years ago

I trot this out every few years or so; it's worth thinking about:

A professor of mine who was active in the peace movement in the eighties was talking to me about employment at defense contractors like Boeing or Lockheed. He said "If ethical people always choose to not work for defense contractors, then only non-ethical people will be working for defense contractors. Do you want defense contractors to be composed solely of non-ethical people?"

walls3• 13 years ago

The fact that "NSA should not be in any position in the cryto committee" is too far.

Why? There's absolutely zero reason to allow people taking part in the NSA's antics into groups deciding public policy.

We need to make working for the NSA a big red 'untrustworthy ' flag, regardless of alleged level of involvement.

yeukhon18• 13 years ago

I meant to say NSA employee. My response is directly to this: http://www.ietf.org/mail-archive/web/cfrg/current/msg03556.h...

The moral issue is about someone's affiliation with NSA makes him or her a spy, unworthy in the crypto community.

If people have different opinion when they were young (or in the case of a student who just want a god damn internship), it sounds like we will punish them and discriminate them in the future, given their past involvement with NSA.

bandushrew6• 13 years ago

"The whole "removal" sounds like "one ought not be an NSA employee."

It is not that one 'ought not'. It is that the NSA is spying on us all. It is also lying about what it is doing, and being deceitful about its tactics.

People need to make a choice about where they stand. If they want to stand with the NSA, that is fine.

Unfortunately from a practical POV, it means I cannot trust them.

On the bright side, I cannot think of any reason an ex employee of the NSA would be honest about their previous employment.

discardorama• 13 years ago

The biggest problem to me is not about NSA involvement, it is how WE treat people who work at NSA and other government intelligence agency.

An organization is made up of people. If you don't like what the organization is doing, you start by holding the people accountable. I see nothing wrong with shunning people who, in their professional capacity, are a part of machine that uses said capability to undermine my rights and privacy.

infinity0• 13 years ago

the thread is just warming up... I'm half-expecting Kevin Igoe to "reveal his true form" and turn into that giant NSA octopus clutching a shit load of ethernet cables that they thought it was a good idea to paint somewhere.

wreegab2• 13 years ago

"Not seeing a major conflict of interest is worrying in itself"

The rationalization from some posters in the thread of why he shouldn't be removed is scary.

Maneatingcow• 13 years ago

You've got the meaning of this statement entirely backwards.

Trevor Perrin requests removal of NSA from IETF Crypto Review

Related Stories