Your Cryptography Conspiracy Theory Is Wrong
56 points by fanf
56 points by fanf
People Can’t Be Normal About This
Conspiracy theories are not about the people who allegedly conspire. They're about the accuser. They're largely narcissism, that (as the accuser), I'm so much better than you sheeple, because I understand things that you don't.
The truth is, no government agency cares enough about some random person to do anything to them. If they do want to "get" you, they will. If you're not on their radar, it's because you're one of the masses of steaming peasants, and are lost in the mob.
And that's the problem: I'm not one of the mob, I'm important. They are coming after me, specifically.
No, no they're not. You're not special.
the ability for the NSA to subvert cryptography is concerning to me, even if it is not necessarily used against me specifically. if you have any care at all for the people of the world, the united states having yet another weapon to deploy against their victims is indeed a concern. why is the NSA so special? why do we strictly need to follow their recommendation? it is disingenuous to call putting that into question a conspiracy theory, whether or not you think that it is a forgone technical conclusion that malfeasance is impractical. NOBUS is a documented occurance, so it is dismissive and absurd to characterize the idea that the NSA could want to do that again as conspiratorial thinking. if bush was evidenced to have previously orchestrated a terrorist attack, then 9/11 conspiracy theories would not be so absurd.
I do not like the idea that people in general do not benefit from strong cryptography. if you are part of any vulnerable class of person, you may be targeted by the police at any time. no, they do not expend effort on you specifically at all times, but they can leverage anything they can against you if the sights randomly fall upon you. it's a panopticon. this is why the first thing cops do when they arrest you is snatch your smartphone.
this is not necessarily applicable here, but this is one of the many reasons that strong cryptography is important.
Our whole culture is getting very conspiracy-brained right now.
At this point, I feel pretty edgy and counter-cultural by wanting evidence.
Having read at least a few of Bernstein's posts on the subject of the TLS Working Group's proposed standardization, this article doesn't really assuage my concerns. I'm not a cryptographer, nor am I even that familiar with the subject matter, but i can definitely understand Bernstein's skepticism around the process, and the OP here doesn't do much to argue against many of Bernstein's points on the matter.
Now don't get me wrong: he doesn't have evidence that something malicious is going on, and to my knowledge such evidence does not exist publicly. But absence of evidence does not imply absence of evidence, and it does seem weird for the NSA faction to be pushing for this as hard as they can; I think his skepticism towards the NSA here is not unreasonable.
Since the OP didn't mention too much about the specifics of what Bernstein is opposed to, I'll quote him on the subject matter:
It's normal for post-quantum cryptography to be rolled out as an extra layer of security on top of traditional pre-quantum cryptography, rather than as a replacement.
For example, Google's CECPQ1 experiment was double encryption with traditional pre-quantum ECC (specifically X25519) and post-quantum NewHope1024. CECPQ2, a joint experiment between Google and Cloudflare, was ECC+NTRUHRSS701. CECPQ2b was ECC+SIKEp434. Ten SSH implementations support ECC+sntrup761. Today's usage of post-quantum cryptography by browsers is approaching half of the connections seen by Cloudflare, where 95% of that is ECC+MLKEM768 and 5% is ECC+Kyber768.
If post-quantum cryptography is designed to be super-strong, so strong that it even survives future quantum computers, then why are we keeping the ECC layer? Same reason that you wear your seatbelt: in the real world, cars sometimes crash, and seatbelts reduce the damage.
[...]
The problem in a nutshell. Surveillance agency NSA and its partner GCHQ are trying to have standards-development organizations endorse weakening ECC+PQ down to just PQ [in the context of TLS].
So even if the OP's alternate conspiracy theory is true (that the NSA has a quantum computer that can break currently available ECC encryption), that is not a good reason for them to be forcing exclusively PQ crypto. In the universe where practical quantum computers exist, ECC+PQ is exactly the same level of secure as just PQ (unless they also have some secret cryptanalysis that shows that combining a particular secure PQ encryption scheme with ECC makes it structurally weaker). Bernstein is not opposed to PQ crypto, nor even the particular scheme being chosen for standardization.
Bernstein has argued, effectively in my eyes, that the TLS Working Group is eager to push through these changes despite concrete opposition, and is trying to change the rules of how these decisions are made. (He spells these points out better than I can; for more details, he has now written 9 blog posts on the topic.) His position is that if we read into the motivations of what is causing them to push this so hard, it implies that they think that PQ crypto (or perhaps this PQ crypto) is easier to break and also they don't have a quantum computer capable of breaking ECC. If they did have such a computer, from the SIGINT perspective, ECC+PQ is no more or less secure than just PQ, so why would they be pushing so hard to make sure that the standard is only ECC+PQ instead of just PQ?
You are arguing against something that isn’t happening:
that is not a good reason for them to be forcing exclusively PQ crypto.
Hybrid PQ remains the mainstream option. PQ-only is also an option for use by feds. Non-PQ remains an option. No-one is forcing exclusively PQ crypto.
DJB doesn’t understand the IETF process: he thinks that votes matter, and as I wrote earlier that’s the kind of mistake that’s almost perfectly aimed to annoy the people he says he wants to persuade, especially when those people know DJB has been around long enough that he should know better. The IETF still loves the catchphrase “rough consensus and running code”, but what Dave Clark originally wrote was:
We reject: kings, presidents and voting.
We believe in: rough consensus and running code.
And Clark’s first sentence is still kept in mind even though it’s less frequently quoted out loud than the second sentence.
Hybrid PQ remains the mainstream option. PQ-only is also an option for use by feds. Non-PQ remains an option. No-one is forcing exclusively PQ crypto.
Its existence as an option is the whole problem though, according to Bernstein, is it not? Having a less-secure option --- especially one that a government wants and that companies seeking to comply with said government would need to implement --- means that the defaults can end up less secure than they might otherwise have been.
The IETF still loves the catchphrase “rough consensus and running code”, but what Dave Clark originally wrote was:
We reject: kings, presidents and voting.
We believe in: rough consensus and running code.
And Clark’s first sentence is still kept in mind even though it’s less frequently quoted out loud than the second sentence.
Rejecting voting while believing in rough consensus is contradictory in spirit at least, even if one wishes to weasel out of formal voting and instead go with rough consensus vibes. In any case, the working group did crunch votes^W numbers, specifically in order to ignore folks new to the discussion (like myself) and in order to establish that such a rough consensus had been formed. They also have not, last I checked, released those numbers, instead saying "We do not intend to release any further detailed analysis including 'numbers' or 'weights/methods'".
Having seen this movie before --- ECHELON, Clipper Chip, PATRIOT Act, Snowden --- I'm not terribly surprised. But I am still disappointed.
I've been following Bernstein's criticism of PQ-only TLS on the IETF mailing lists and on his blog for some time now. IMO I can't help but to feel that the cryptography community only benefits from having figures like him around, despite his communication strategy being... abrasive at best.
I feel a similar way about people like Stallman and Kobeissi tbh
His impact in cryptography has been mainly in specing algorithms that are performant in software, which is valuable but not as fundamental.
I think secretbox is the most valuable contribution in my mind because of the ease of use, but he wasn’t the first one to spec something like it (Schneider + Ferguson had a similar interface quite a bit before iirc).
So I agree, but he’s not at such a level above others that everyone should just bite their lip and ignore any diva behavior.
I don't know djb personally, have not participated in IETF stuff in about 20 years. I like his technical work, but he's well known for being abrasive. I've read the threads, and my perception is he comes across as someone trying to bully / lawyer people who are volunteers with better things to do, because he always believes his own things are the best possible solution, even after people have patiently explained the places where it doesn't hit broader requirements.
The more he tries to fight, the less people want to listen to anything he brings to the table, even though his work is generally excellent.
I dealt with NSA cryptographers a bit 20 years ago, and definitely got the sense then that academia advanced right past their knowledge. I figured then that there was a small chance that one or two people were that good and were so driven by love-of-country that they'd be willing to not be known and work for 1/4 of what they'd make anywhere else. But after Snowden, it definitely felt unlikely.
It's still possible, but the Claude ECC reveal has hammered most of the nails in the coffin of that assumption.
And any edge they could possibly have would only be in public key crypto, hash functions, or some side channel advantage, because the theory world has done such a good job the standard model that it's hard to believe any reasonable modern cipher like AES would have a simple distinguisher from a PRP, leaving side channels that end-run the model the only imaginable advantage they could possibly have.
It would be more useful the the Conspiracy Theorists to have a checklist (or better yet, an algorithm) to make better conspiracy theories. This post only points out where Cryptography Conspiracy Theories go wrong, or can be logically dismantled. I don't care about that, I want to know how to construct a better theory.