I'll also add that BULLRUN clearly stated they were backdooring cryptographic standards. At that point, any NSA connection is suspect. Personally, I thought it was brilliant attempt at a NOBUS attack. NOBUS is rarely achievable in practice while simultaneously being deniable.

I'll note as well that you've been on plenty of threads that contradict the account 'nullc provided here, but appear happy to let it go in the service of whatever weird point you're trying to make here. Gross.

I was corroborating the backdoor point. I didn't read the rest of the comment cuz I was too busy going through a ton of threads in prolly 15 minutes. Also, I stayed rate limited voluntarely from way back to deal with being on social media too much. By default, I don't comment or elaborate most of the time in case more important stuff comes up needing my commemts.

It did. There were two chances in that timeframe to do some good. One was a set of comments on robust software at 4-5pts with a two follow-ups in comments who plan to learn more. Another was necessary reminder banks can themselves cut funding off opponents like they did Wikileaks. That was 5pts with 2 supporting comments. Whatever you expected me to reply to was presumably going to use up my few comments to do less social good.

I figured I'd throw one your way since you or anyone following this may not know why I don't comment as much in situations with lots of back and forth style discussion. It use up all my comments for probably nothing. Now you know why I didn't reply to several of yours done in that way. Just the rate limit doing its job, Sir. ;)

Edit: I'm keeping everything but "sophistry" I edited out. Although sleepy as hell from 13hr days, I checked out your other comments in that thread. My memory is too bad to know what NSA programs you were calling or not calling in the past. That commenter might be full of shit about that. Original comment stands since it was just as a corroboration they were doing it regardless of what you said.

> He's spent countless hours tirelessly denying the existence of programs that have subsequently been proven to exist.

Any chance you could list an example or two?

This comment is gross.

I've repeatedly acknowledged the existence of USG surveillance programs, including Dual-EC. I believe the "hours" I've spent discussing Dual-EC and PKRNGs in general are also straightforwardly countable; just use the search box:

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

What you're doing here is deceptively reframing a subtle nerd technical argument as a normative argument about USG surveillance. In particular: at no point have you or anyone else ever witnessed me arguing that Dual-EC was okay; rather, my argument was that Dual-EC was so batshit, and such poor tradecraft, that it was unlikely to be a serious NSA program. My argument at the time mirrored that of Bruce Schneier: "never use this, no competent engineer would". My twin mistakes: I overestimated both NSA and the industry, in particular vendors like Juniper, which did in fact implement this standard.

What's even dumber about this comment is that you're making it in support of an argument virtually nobody in the field supports, which is that the NIST P-curves are somehow "backdoored". As you know, or at least should know before talking about this stuff, there is virtually no relationship between the P-curves and Dual-EC. But you're happy to exploit the general lack of understanding about the distinction to score points on HN, even if means dumbing the whole thread down.

To head off some other comment you'll write 6 months from now without me noticing: you can easily peruse the site history and see me consistently arguing against use of the P-curves (in fact, I cite the P-curves is a damning failure of DNSSEC, which you'll no doubt find some fig leaf some years from now to claim I also support). But not because the curves are "backdoored"; rather, because modern curves are misuse-resistant.

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

Since I'm assuming you have at least the ability to Google, I'm expecting you to cite Bernstein's analyses of the flexibility NSA's generation process provided for hunting for vulnerable curves. To see that outré claim rebutted, here's another Google search for you: [koblitz menezes enigma curve]. Happy to help.

Meanwhile, your message betrays no evidence of understanding what misuse-resistance in curves means, though you've been happy to preen about cofactors and Schnorr signatures on other threads; you depict the choice between 25519 and P-384 as one between a "suspicious generation mechanism' and an "immature" alternative. Of course, that's not why serious designs use 25519; rather, it's because 25519 is less susceptible to curve point validation vulnerabilities and is designed to be straightforwardly implemented without side channels.

Your comment is one of the most gratuitously uncivil and mean-spirited things I've had directed at me on this site, and I have been the target of a lot of mean-spirited bullshit here.

I already feel stupid about using P-256 a few years ago!