News for hackers. Stuff that matters.
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by crabbygrabby on Friday August 05, 2022 @03:54PM (#32361165)
Seems like a baaad idea lol.
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by zitterbewegung on Friday August 05, 2022 @03:56PM (#32361202)
He won a case against the government representing himself so I think he would be on good footing. He is a professor where I graduated and even the faculty told me he was interesting to deal with. Post QC is his main focus right now and also he published curve25519.
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by matthewdgreen on Friday August 05, 2022 @04:23PM (#32361540)
He was represented by the EFF during the first, successful case. They declined to represent him in the second case, which ended in a stalemate.
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by throwaway654329 on Friday August 05, 2022 @04:51PM (#32361831)
The full story is interesting and well documented: https://cr.yp.to/export.html

Personally my favorite part of the history is on the “Dishonest behavior by government lawyers” page: https://cr.yp.to/export/dishonesty.html - the disclaimer at the top is hilarious: “This is, sad to say, not a complete list.” Indeed!

Are you implying that he didn’t contribute to the first win before or during EFF involvement?

Are you further implying that a stalemate against the U.S. government is somehow bad for self representation after the EFF wasn’t involved?

In my view it’s a little disingenuous to call it a stalemate implying everything was equal save EFF involved when the government changes the rules.

He challenged the new rules alone because the EFF apparently decided one win was enough.

When the judge dismissed the case, the judge said said that he should come back when the government had made a “concrete threat” - his self representation wasn’t the issue. Do you have reason to believe otherwise?

To quote his press release at the time: ``If and when there is a concrete threat of enforcement against Bernstein for a specific activity, Bernstein may return for judicial resolution of that dispute,'' Patel wrote, after citing Coppolino's ``repeated assurances that Bernstein is not prohibited from engaging in his activities.'' - https://cr.yp.to/export/2003/10.15-bernstein.txt

Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by matthewdgreen on Friday August 05, 2022 @04:55PM (#32361873)
I’m saying that the EFF are skilled lawyers who won a major case, and they should not be deprived of credit for that accomplishment.
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by throwaway654329 on Friday August 05, 2022 @05:06PM (#32361982)
Sure, EFF played a major role in that case as did Bernstein. It made several lawyers into superstars in legal circles and they all clearly acknowledge his contributions to the case.

Still you imply that he shouldn’t have credit for that first win and that somehow he failed in the second case.

EFF shouldn’t have stopped fighting for the users when the government changed the rules to something that was also unacceptable.

Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by matthewdgreen on Friday August 05, 2022 @05:11PM (#32362032)
The original poster said “he won a case against the government representing himself” and I felt that statement was incomplete, if not inaccurate and wanted to correct the record. I’m pretty sure Dan, if he was here, would do the same.
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by throwaway654329 on Friday August 05, 2022 @05:57PM (#32362433)
You appear to be throwing shade on his contributions. Do I misunderstand you?

A stalemate, if you already want to diminish his efforts, isn’t a loss by definition - the classic example is in chess. He brought the government to heel even after EFF bailed. You’re also minimizing his contributions to the first case.

His web page clearly credits the right people at the EFF, and he holds back on criticism for their lack of continuing on the case.

I won’t presume to speak for Dan.

Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by zitterbewegung on Friday August 05, 2022 @05:48PM (#32362353)
Sorry I didn’t know that part. I have only seen Professor Bernstein once (he had a post QC t shirt on so that’s the only way I knew who he was ). I have never interacted with him really. He is also the only faculty that is allowed to have a non UIC domain. Thank you for correcting me .
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by gruturo on Friday August 05, 2022 @04:10PM (#32361397)
Yeah, terrible idea, except this is Daniel Bernstein, who already had an equally terrible idea years ago, and won. That victory was hugely important, it pretty much enabled much of what we use today (to be developed, exported, used without restrictions, etc etc etc)
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by yieldcrv on Friday August 05, 2022 @03:59PM (#32361235)
seems like they just need a judge to force the NSA to comply with a Freedom of Information Act request, its just part of the process

I'm stonewalled on an equivalent Public Record Act request w/ a state, and am kind of annoyed that I have to use the state's court system

Doesn't feel super partial and a couple law journals have written about how its not partial at all in this state and should be improved by the legislature

Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by throwaway654329 on Friday August 05, 2022 @04:17PM (#32361473)
This is part of a class division where we cannot practically exercise our rights which are clearly enumerated in public law. Only people with money or connections can even attempt to get many kinds of records.

It’s wrong and government employees involved should be fired, and perhaps seriously punished. If people at NIST had faced real public scrutiny and sanction for their last round of sabotage, perhaps we wouldn’t see delay and dismissal by NIST.

Delay of responding to these requests is yet another kind of sabotage of the public NIST standardization processes. Delay in standardization is delay in deployment. Delay means mass surveillance adversaries have more ciphertext that they can attack with a quantum computer. This isn’t a coincidence, though I am sure the coincidence theorists will come out in full force.

NIST should be responsive in a timely manner and they should be trustworthy, we rely on their standards for all kinds of mandatory data processing. It’s pathetic that Americans don’t have several IG investigations in parallel covering NIST and NSA behavior. Rather we have to rely on a professor to file lawsuits for the public (and cryptographers involved in the standardization process) to have even a glimpse of what is happening. Unbelievable but good that someone is doing it. He deserves our support.

Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by yieldcrv on Friday August 05, 2022 @06:15PM (#32362592)
> This is part of a class division where we cannot practically exercise our rights which are clearly enumerated in public law. Only people with money or connections can even attempt to get many kinds of records.

As someone with those resources, I'm still kind of annoyed because I think this state agency is playing chess accurately too. My request was anonymous through my lawyer and nobody would know that I have these documents, while if I went through the court - even if it was anonymous with the ACLU being the filer - there would still be a public record in the court system that someone was looking for those specific documents, so that's annoying

Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by throwaway654329 on Friday August 05, 2022 @06:34PM (#32362750)
That’s a thoughtful and hard won insight, thank you.
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by PaulDavisThe1st on Friday August 05, 2022 @04:41PM (#32361739)
Even though I broadly agree with what you've written here ... the situation in question isn't really about NIST/NSA response to FOIA requests at all.

It's about whether the US government has deliberately acted to foist weak encryption on the public (US and otherwise), presumably out of desire/belief that it has the right/need to always decrypt.

Whether and how those agencies respond to FOIA requests is a bit of a side-show, or maybe we could call it a prequel.

Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by denton-scratch on Saturday August 06, 2022 @05:47AM (#32366565)
> the situation in question isn't really about NIST/NSA response to FOIA requests at all.

I disagree. To my mind, the issue is that a national standards agency with form for certifying standards they knew were broken, still isn't being transparent about their processes. NIST's reputation as been mud since the ECDRBG debacle.

People are not at liberty to ignore NIST recommendations, and use schemes that are attested by the likes of DJB, because NIST recommendations get built into operating systems and hardware. It damages everyone (including the part of NSA that is concerned with national security) that (a) NIST has a reputation for untrustworthiness, and (b) they aren't showing the commitment to transparency that would be needed to make them trustworthy again.

Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by throwaway654329 on Friday August 05, 2022 @04:56PM (#32361886)
We are probably pretty much in agreement. It looks like they’ve got something to hide and they’re hiding it with delay tactics, among others.

They aren’t alone in failing to uphold FOIA laws, but they’re important in a key way: once the standard is forged, hardware will be built, certified, deployed, and required for certain activities. Delay is an attack that is especially pernicious in this exact FOIA case given the NIST standardization process timeline.

As a side note, the NIST FOIA people seem incompetent for reasons other than delay.