NIST may not have you in mind

Re:NIST may not have you in mind by m0nastic on Sunday October 21, 2012 @02:41PM (#4680398)

I wouldn't expect the NSA to be involved with sourcing of hardware for the rest of the federal government (unless the continued fear around supply chain management completely takes over, which I suppose is possible, as it's probably the number one concern presently among a lot of agencies).

While they exert a disproportionate amount of guidance to other agencies, that is generally orthogonal to their primary motivations.

You can certainly make a case that NSA pushes NIST towards making guidelines for things that they favor, but I don't seriously believe that's at the expense of weakening other agencies (at least not as a goal).

As to classified and up information, the NSA can't get enough ECC, and many of the Suite B implementations of other standards are just a version of the standard that works (and is "certified") to use Elliptical Curve Cryptography (like TPM Suite B, which we work on).

[ Parent | on HN ]

Re:NIST may not have you in mind by dfc on Sunday October 21, 2012 @03:38PM (#4680540)

I apologize for not being clearer about NSA's motivations. I did not mean to imply that there was any malicious intent when it comes to weakening federal IT standards. (It seems that NSA would be aware of the negative side effects of their recommendations.)

Could NSA's hardware centric recommendations be motivated by an interest in leveraging economies of scale (due to the size of federal IT procurement) and purchasing COTS hardware that was optimized for AES?

[ Parent | on HN ]

Re:NIST may not have you in mind by m0nastic on Sunday October 21, 2012 @03:46PM (#4680559)

It's possible (although they're already procuring hardware at GSA-approved rates, so I'm not sure if there's the same economies of scale that you see in the commercial realm).

[ Parent | on HN ]