He gave away the source code, not the master keys to unlock every single version of the software. At best, the source allowed the NSA to derive the binary format used by the files. Whoopie.

Not quite. Not that source code secrecy should be relied on, but the source code not being secret increases the changes of e.g. side channels being discovered that jeopardize all the users of the author's software.

The ciphers are public. What the NSA really wanted was the size of file headers, special markers, etc -- so they could skip over the fluff and home in on the juicy stuff. I gave up nothing that would put the product or users at risk.

With due respect, the person you spoke to on the phone didn't really answer your questions, per your post. What leads you to the conclusion? From my perspective, it doesn't sound like you know what they were using it for at all, or even if there was an urgent matter that even required it. For all we know, it was just a Tuesday and they were just hunting for the source of a common encryption utility.

And just because a cipher is public does not mean that there does not exist a side channel in the implementation of the ciphers or a mistake in your usage of them.

> And just because a cipher is public does not mean that there does not exist a side channel in the implementation of the ciphers or a mistake in your usage of them.

And just because they have the source code, doesn't mean they couldn't get it from reverse engineering the binary. I have not seen a binary that was completely resistant to reverse engineering yet.

Likely he was just saving them time.

You seem to be arguing (across multiple comments) that you gave up nothing that would put your product or users at risk though you have no evidence of that. In fact, just the fact that you gave them what they wanted means that it had some impact greater than nothing and it certainly wouldn't be for the positive towards your users or the product. Why did they want it in the first place then?

So one of the many services the NSA offers to the US Government is reverse engineering. Do you really think that his software was so mysterious that they couldn't figure this out eventually?

That's resource intensive. They might have, but it's also entirely possible they would have decided it wasn't worth it. Might as well first see if the author is kind enough to just hand over the source. At the very least, he should have made the code open source after giving it to the NSA so that there was a chance of zero days they discovered getting worked out.

> They might have, but it's also entirely possible they would have decided it wasn't worth it

That's an enormous assumption based on zero evidence. The only resource the NSA is limited by is time. Money and man power (up to diminishing returns) are effectively limitless.

They were trying to skip a step, but there's absolutely no reason to believe they could have (and would have) done without through reverse engineering the binary. The NSA guy implied time was the major factor, and wanting the source certainly implies that was the case.

With source in hand, couldn’t they just distribute backdoored copies of said software?

It seems a little unlikely that the NSA would require the source code of a small shareware utility just to release a backdoored version.

Yeah so if there are any vulnerabilities in his software, he just gave them all they need to exploit them...

You have to take into account the temporal setting of the story. 18 years ago is pre-9/11 and all the reveals that happened between then and now.

The 1990s were the era of the cypherpunks, the Clipper chip, and, as the author alludes to, some fairly inane export restrictions on cryptography. This was not some innocent time.

If you want to go further back, there's the Church Committee (which concluded that security agencies were way out of control and had to be reined in).

You're passing judgement based on a life time of learnings. How much did this person know at the time? Arm chair quarter backs always seem to have the right answers.

If I’m coming across as accusing that he made the wrong decision, I don’t mean to say that. The story he’s telling suggests he made a difficult decision under the impression that it was urgent and important.

What I am saying is that in hindsight, this seems like the wrong decision, and I would hope a maker of crypto software would realize that.

Also, author didn't mention how his programmer securely transmitted source code to NSA. Did NSA publish their public keys anywhere on Contact Us form?