News for hackers. Stuff that matters.

A comment on Mythology About Security. Parent comment

Re:Mythology About Security by lordofmoria on Monday April 09, 2018 @11:30PM (#16798799)
I would argue that usually it doesn’t matter because of the reasons you mentioned, but in this particular case it really did. The US government, and the NSA in particular, made it a matter of explicit policy to delay and discourage commercial crypto research and development in the US. Off hand, I’d guess this delayed crypto by 10 years. Imagine if 10 years ago, we had today’s understanding of crypto. I’d wager TLS would look better.

I’ve been reading Crypto by Steven Levy, it’s on exactly this topic, and I’m astounded by how actively the NSA discouraged commercial research, and how early on it happened: mid-1970s.

[ Parent | on HN ]
Re:Mythology About Security by mashedvikings on Tuesday April 10, 2018 @01:09AM (#16799110)
One of the greatest heroes we have to thank are Diffie and Hellman who put up a fight when US government went against their research on public key cryptography.

But I suppose the reason NSA was delaying was they had to develop a workaround for the encryption. Remember, while public key crypto got strong in 1996 when the key lengths ended Tailored Access Operations (NSA's hacking team) was created in 1998, before DES was replaced with AES in 2001.

Now obviously it's not that simple. Phasing out weak standards has taken very long. Personally, I would love to understand what goes on in the heads of developers who still use age old primitives like MD5 and RSA-1280 (iMessage).

[ Parent | on HN ]
Re:Mythology About Security by acqq on Tuesday April 10, 2018 @01:28AM (#16799180)
> I suppose the reason NSA was delaying was they had to develop a workaround for the encryption

No. Their primary purpose was never to protect anybody else but their own operations (the concept "Nobody but us" is older and broader than Wikipedia currently knows https://en.wikipedia.org/wiki/NOBUS ) especially not "common citizens". The NSA is mainly a military institution. Had they been able to get by with nobody being allowed to use crypto but they, they would have done that and continue doing.

Bonus: this is directly from the NSA:

https://www.nsa.gov/resources/everyone/digital-media-center/...

Covered here:

https://www.dailydot.com/layer8/cryptokids-nsa-foia/

[ Parent | on HN ]
Re:Mythology About Security by acqq on Tuesday April 10, 2018 @01:21AM (#16799150)
To help other possible readers: it's "Crypto: How the Code Rebels Beat the Government -- Saving Privacy in the Digital Age" by Steven Levy, from 2001.
[ Parent | on HN ]
Re:Mythology About Security by geerlingguy on Tuesday April 10, 2018 @09:00AM (#16800997)
Strong recommendation to read this book; it's a pretty approachable introduction to modern cryptography and the people we have to thank for where we are today.
[ Parent | on HN ]