20 votes

How Far Ahead of Academia Are Government Agencies?

Disclaimer: This post is possibly opinion based. How far ahead (if at all) are governmental agencies of open source (specifically academic) research? This question is impossible to answer. By ...
Biv's user avatar
  • 9,979
19 votes
Accepted

Why does BCRYPT_RNG_DUAL_EC_ALGORITHM get removed from CNG API on Windows 10?

The Government's elliptic curve backdoor is real, isn't it? We don't know for sure, but there are indicators into that direction. More importantly though, yes, you can backdoor the RNG, as was ...
SEJPM's user avatar
  • 46k
15 votes

How Far Ahead of Academia Are Government Agencies?

Fundamentally, I do not believe you can compare them specifically because they tend to have different behaviors. I am an academic who does the non-classified work in conjunction with government teams;...
b degnan's user avatar
  • 4,820
9 votes

I can divide a very large integer - did I discover anything?

Unfortunately you haven't made a scientific discovery. One of the places where large integer division is required is when testing for prime values. Primality tests are required to find real prime ...
Maarten Bodewes's user avatar
  • 92.6k
8 votes

Security of RSA-3072 with public exponent $2^{16}+1$

is it safe enough to do it with the above exponent (of 2^16+1), and are there any known vulnerabilities for scheme EMSA-PSS (RFC8017) or for scheme RSAES-PKCS1-v1_5 done with this signature system? ...
poncho's user avatar
  • 147k
7 votes
Accepted

NSA removed EC-256 and SHA-256 from CNSA recently--should we be alarmed by this?

NSA removed EC-256 and SHA-256 from CNSA recently--should we be alarmed by this? No. There is one overwhelming reason why, as stated in the document: The cryptographic systems that NSA produces, ...
Richie Frame's user avatar
  • 13.1k
5 votes

Why did the NSA create SHA?

This question is asking a bunch of things, I will try to sort things out. Hash functions were around long before SHA-0. The popular hash before SHA-1 was MD5 which shares a lot with SHA0–2 but there ...
Meir Maor's user avatar
  • 11.8k
4 votes

Is it true that AES initialization constants, which are supposed to be random numbers, were in fact chosen by the NSA?

The conspiracy theory in the question is nonsense: none of the constants in Rijndael are supposed to be random (nor are they initialization constants). They all have a precise justification, making ...
fgrieu's user avatar
  • 141k
3 votes
Accepted

Cryptographic algorithms compromised and alternatives?

Should you pick AES, Twofish, AES(Twofish) or Twofish(AES)? You should pick AES. Also if you should choose Twofish, is it post-quantum computer algorithm proof? There's no current publicly ...
SEJPM's user avatar
  • 46k
3 votes

Why did the NSA create SHA?

The NSA created SHA (quickly replaced by SHA-1 to fix a security issue that remained unpublished for years) because they/the US government needed a 160-bit hash function, so that it has 80-bit ...
fgrieu's user avatar
  • 141k
3 votes
Accepted

Aside from DES, has the NSA ever strengthened algorithms?

Almost certainly, at least once. It is a mistake to think of the NSA merely as a SIGINT (signals intelligence) operation. They also do defense, especially at the Information Assurance Directorate (...
Patriot's user avatar
  • 3,132
3 votes

Who uses Dual_EC_DRBG?

On the Practical Exploitability of Dual EC in TLS Implementations by Stephen Checkoway et al. (Usenix 2014) is some research that has been done on how much this NSA backdoor has affected the internet. ...
David Schumann's user avatar
3 votes
Accepted

Who originally generated the elliptic curve now known as P256/secp256r1

Jerry Solinas, an NSA employee, definitely provided the seeds. This has been confirmed by one of the authors of the ANSI X9.62 ECDSA standard (Alfred Menezes), who is also an author of a paper called '...
samuel-lucas6's user avatar
2 votes
Accepted

What is required to use a cryptographic algorithm backdoor?

in both of the cases (Dual EC and Streebog/Kuznyechik s-box) what is the information that allows the expotaition? In the case if Dual EC, it is essentially a private key. Dual EC has two internal ...
poncho's user avatar
  • 147k
2 votes

HMAC-Ripemd-160 in TrueCrypt

The use of RIPEMD-160 is not a cause for concern. It's the relatively small number of PBKDF2 iterations which is problematic. More than a decade ago, the minimum recommended number of iterations was ...
forest's user avatar
  • 15.3k
2 votes

What are the relations between cryptanalysis of block ciphers such as AES and Kendall's tau coefficient?

Here is a wild guess as to what this reference may actually mean. TL;DR; The Kendall $\tau$ can be used to measure how close different rankings of key guesses resulting from stages of the attack are, ...
kodlu's user avatar
  • 22.5k
1 vote

Why did the NSA create SHA?

Note, this answer is short and a mix of historical information and opinion, covering only the first half of your question, as the 2nd half deserves its own. SHA0 and the Secure Hash Standard was ...
Richie Frame's user avatar
  • 13.1k
1 vote

How Far Ahead of Academia Are Government Agencies?

From a slightly more esoteric perspective, I'd be surprised if governments are much further ahead of the public these days. As we all pass through time, we leave our fingerprints on our surroundings. ...
Paul Uszak's user avatar
  • 15.4k
1 vote

How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?

This question has wonderful answers, but I think I can add another perspective. In game theory, it can be said that the intelligence community (IC) strictly dominates public cryptography because they ...
forest's user avatar
  • 15.3k
1 vote

How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?

The way to reason about the cryptographic capabilities of any entity-- a national-level agency, a large corporation, other non-state actors-- is to avoid conjecture and search for evidence, of which ...
Patriot's user avatar
  • 3,132

Only top scored, non community-wiki answers of a minimum length are eligible