Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

For those who didn't notice yet, in the USA, the National Institute of Standards and Technology(NIST) has been shut down temporarily because of the poor fiscal situation of the USA.

The text at their site reads:

NIST Closed, NIST and Affiliated Web Sites Not Available

Due to a lapse in government funding, the National Institute of Standards and Technology (NIST) is closed and most NIST and affiliated web sites are unavailable until further notice. We sincerely regret the inconvenience.

The National Vulnerability Database and the NIST Internet Time Service web sites will continue to be available. A limited number of other web sites may also be available.

Notice will be posted here (www.nist.gov) once operations resume. You may also get updates on NIST's operating status by calling (301) 975-8000.

Conferences and other events scheduled during the shutdown are postponed or cancelled. Even after NIST reopens, some NIST events may need to be rescheduled. Once access to NIST Web sites resumes, please see the Conferences and Events (http://www.nist.gov/allevents.cfm) list for updated information on specific events.

Here's a screenshot of the NIST website (2013-10-02T12:00:00Z):

NIST website at 2013-10-02T12:00:00Z

On the positive side, I could imagine more people coming to Crypto.SE as a result of that.

Anyway… even though it was tempting, I want to avoid "asking for opinions" so I am not going to ask how reliable and trustworthy NIST is, when looking at the fact that government funding obviously has a huge impact on them. Still, a question remains:

What impact will the closure have on the future of cryptography? (think: "crypto-development")

share|improve this question
8  
I would be worried if it had shut down permanently, but given that it will likely reopen in less than a month, I don't think there is much to worry about. But I would be interested in reading different perspectives on the matter. –  Thomas Oct 2 '13 at 12:26
1  
@Thomas As they say: "These are interesting times we live in…" I just hope no one takes my question as a chance to post a paranoia-filled rant against governmental institutions or something. –  e-sushi Oct 2 '13 at 12:40
3  
At least they didn't shut down their NTP server. That would have been embarrassing. –  CodesInChaos Oct 2 '13 at 12:51
4  
i.imgur.com/LO4yypb.png –  hunter Oct 2 '13 at 14:53

3 Answers 3

up vote 10 down vote accepted

This closure is a rather stupid thing, because the Web site is not closed: indeed, there still is a machine, somewhere, which responds to HTTP requests and returns the "we are closed" page. It would have cost zero effort, and zero extra money, to simply let the Web site run and keep on serving PDF files.

For crypto development, this means that until the US Republicans and Democrats finally agree on who is the Alpha Male, developers will need to find the relevant standards and test vectors elsewhere. A lot of the information is duplicated elsewhere; e.g. FIPS 180-4, which defines the SHA-* functions, has also been copied as RFC 6234, which is still available. Also, many people already have copies of the documents they are working on (I know that my "Downloads" directory must have a lot of NIST pdf files in it).

In any case, crypto development, by necessity, works at the pace of research, with a lot of thinking. Thinking has not stopped. Publication of documents, writing of standards, organization of meetings... operates on a time scale counted in weeks or months, not days. A few days of bureaucratic-induced closure is not enough to show up on the big picture of cryptographic advances.

share|improve this answer
4  
This is apparent a protest: if the website would keep serving the documents, it would cause no inconvenience at all. Now they want to inconvenience users of the website so that there is some effect from the hassle. I have downloaded quite a few documents as well. The ones I have not, I found today from Wayback Machine. –  user4982 Oct 2 '13 at 14:40
2  
"Thinking has not stopped." At least not everywhere. –  mikeazo Oct 2 '13 at 19:58

This closure could have an unintended effect on security. If a researcher was attempting to use a NIST resource, he or she might turn to a third party due to the unavailability of the NIST site. This may spur awareness, interest, or growth in other international standards bodies, such as ISO, or even to form an ECRYPT-III effort.

If that third party turns out to be a trustworthy, useful, and reliable source, and is one that the NSA has not clouded with suspicion, today's researchers may have no reason to return to NIST in the future.

share|improve this answer

I cannot see it having a negative effect, only a positive effect.

Let's look at the Reddit AMA of Glenn Greenwald and the relevant comment:

There are hundreds of encryption standards compromised by the program the Guardian, NYT and PP all reported on. I have never seen any list of those standards and don't have it. If I did have it, I would publish it immediately. As a result, the reasoning went (as I understand it), publishing one or two examples would be unhelpful if not misleading as those are tiny fractions of the overall compromised standards.

To be clear: if encryption standards are compromised by the NSA, I do not think it's valid to conceal that on the ground that it will enable Terrorists or other Bad People to avoid using those standards. But as I understand it, that wasn't the rationale for the redactions; it was that publishing one or two would do not do any real good and could affirmatively create the misleading impression that other (unnamed) compromised standards are solid.

If I could inform the world about exactly which standards have been compromised by the NSA, I would.

So NIST have been colluding with the NSA have been propagating backdoored/weakened cryptography and security standards for the benefit of US intelligence. Let's be clear here. There's not a few bad standards, there's many bad standards. They could all be compromised in some way.

The partial shutdown of NIST is a good thing. People will get their information from other potentially more reliable sources and avoid the bad standards. Perhaps now people should move to the originally designed algorithms before NIST/NSA got their hands on them and "tweaked" them e.g. Rijndael, Keccak etc. However in each round of the competition the contestants update their algorithms. The contestant's could have been advised to subtely weaken the algorithms under the guise of improving them earlier in the process.

Unfortunately NSA and NIST have not been faithful stewards of the internet. It's time to forget American cryptography standards and work on strong international based cryptography standards for the benefit of all mankind. Not weak standards that only benefit America and their surveillance state. We need to start again from scratch unfortunately.

I issue a challenge to the NSA employees here, of which there are many. What are you doing with your life? Take a good look at yourself. Why are you wasting your life working for the NSA to produce weak standards, subvert cryptography and undermine the freedoms and liberties of everyone on the planet? Is your nation's security so important that you're willing to even sacrifice your own freedoms in the process? Are your country's citizens more important than every other citizen on the planet? I invite you to read the Universal Declaration of Human Rights.

Here is Article 1:

All human beings are born free and equal in dignity and rights. They are endowed with reason and conscience and should act towards one another in a spirit of brotherhood.

This is not the America your founders envisaged when they built your country. You think Edward Snowden is a traitor? He is a hero, you are the traitor. It's time to turn from your ways and help humanity rather than oppress it.

share|improve this answer
3  
Avoiding NIST standards just because they come from NIST isn't that useful. We need to understand why they're broken. Without that understanding we can't know if alternatives aren't just as bad. –  CodesInChaos Oct 4 '13 at 9:12
1  
The world is not a democracy (thank god) and all human beings are certainly not equal. Citing this as an argument only weakens your case - like saying "since you're christians why do you go to war". Further, it's a nations job to consider its citizens more important than others, so yes. That's from a pragmatic standpoint. wrt. the rest, you're right, we need an international crypto body, but there's absolutely no reason to assume it won't also produce corrupt standards (in fact I'd expect the opposite to be true). –  rath Oct 4 '13 at 10:44
    
Actually, rath, there is every reason to believe that an international standards publication would be preferable to NIST/NSA; but only in the ideal case. Ideally, the standards would be published to the entire population of "good guys" with the hope that either: 1. such a publication could be designed such that "bad guys" are not able to access them, or 2. the "good guys" will be equipped with better manpower and/or expertise to stay ahead of the bad guys, given access to the best available standards. –  user8788 Oct 8 '13 at 11:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.