Debunking NIST's calculation of the Kyber-512 security level

Re:Debunking NIST's calculation of the Kyber-512 security level by nvy on Tuesday October 03, 2023 @10:03PM (#37760011)

>You mean ANSI/ISO/NIST and Dual_EC_DRBG, that everyone suspected had a backdoor before it was included as one of multiple options?

What's this snarky reply supposed to imply?

>Or the s-boxes in DES, that the NSA suggested to IBM + NIST's predecessor, so as to be resistant to then-not-widely-known differential cryptanalysis?

In your rush to write this oh-so-pithy comment, did you somehow get mixed up and think that when I wrote "Dual EC", I somehow meant s-boxes?

[ Parent | on HN ]

Re:Debunking NIST's calculation of the Kyber-512 security level by bonzini on Wednesday October 04, 2023 @01:11AM (#37761061)

He/she means that there is good things coming out of the NSA/NIST collaborations (another example of SHA0->SHA1, introducing a "mysterious" left shift that made SHA1 much stronger), and the bad ones are caught quickly.

[ Parent | on HN ]