Cryptologist DJB Alleges NSA is Pushing an End to Backup Algorithms for Post-Quantum Cryptography

Cryptologist/CS professor Daniel J. Bernstein is alleging that America's National Security Agency is attempting to influence NIST post-quantum cryptography standards.

Bernstein first emphasizes that it's normal for post-quantum cryptography (or "PQ") to be part of "hybrid" security that also includes traditional pre-quantum cryptography. (Bernstein says this is important because since 2016, "We've seen many breaks of post-quantum proposals...")

"The problem in a nutshell. Surveillance agency NSA and its [UK counterpart] GCHQ are trying to have standards-development organizations endorse weakening [pre-quantum] ECC+PQ down to just PQ." Part of this is that NSA and GCHQ have been endlessly repeating arguments that this weakening is a good thing... I'm instead looking at how easy it is for NSA to simply spend money to corrupt the standardization process.... The massive U.S. military budget now publicly requires cryptographic "components" to have NSA approval... In June 2024, NSA's William Layton wrote that "we do not anticipate supporting hybrid in national security systems"...

[Later a Cisco employee wrote of selling non-hybrid cryptography to a significant customer, "that's what they're willing to buy. Hence, Cisco will implement it".]

What do you do with your control over the U.S. military budget? That's another opportunity to "shape the worldwide commercial cryptography marketplace". You can tell people that you won't authorize purchasing double encryption. You can even follow through on having the military publicly purchase single encryption. Meanwhile you quietly spend a negligible amount of money on an independent encryption layer to protect the data that you care about, so you're actually using double encryption.
This seems to be a speculative scenario. But Bernstein is also concerned about how the Internet Engineering Task Force handled two drafts specifying post-quantum encryption mechanisms for TLS ("the security layer inside HTTPS and inside various other protocols"). For a draft suggesting "non-hybrid" encryption, there were 20 statements of support (plus 2 more only conditionally supporting it), but 7 more statements unequivocally opposing adoption, including one from Bernstein. The IETF has at times said they aim for "rough consensus" — or for "broad consensus" — but Bernstein insists 7 opposers in a field of 29 (24.13%) can't be said to match the legal definition of consensus (which is "general agreement"). "I've filed a formal complaint regarding the claim of consensus to adopt."

He's also written a second blog post analyzing the IETF's decision-making process in detail. "It's already bad that the IETF TLS working group adopted non-hybrid post-quantum encryption without official answers to the objections that were raised. It's much worse if the objections can't be raised in the first place."

Thanks to alanw (Slashdot reader #1,822) for spotting the blog posts.

Yes, NSA is pushing against hybrids

[sinij]

PQ Hybrids, while inefficient, are designed to both defend against QC and traditional attacks by layering traditional and PQ algorithms. Thinking behind it is that PQ algorithms may have yet to be discovered traditional compute weaknesses.

Re:

[XXongo]

PQ Hybrids, while inefficient, are designed to both defend against QC and traditional attacks by layering traditional and PQ algorithms. Thinking behind it is that PQ algorithms may have yet to be discovered traditional compute weaknesses.

Or, worse, may have weaknesses that have been discovered, but have not been disclosed.

Quantify the Dilemma

[kurt_cordial]

If DJB is a preeminent curator of progress, he can do what every other (dis)respected pariah for good does... Invent his own ranking algorithm to expressly represent a scale (1-10). If he was pulled away from tea to discuss the 2030+ agenda, it's only a 1. If the NSA wanted to prioritize open discussion with an idiot, it's a 10.

A question for people familiar with cryptology

[ndsurvivor]

If the Government was able to save all of the transactions from TOR until they built a Quantum Computer that could crack the encryption, would they be able to unlock all interactions in the Dark Web? Is my assumption incorrect that a QC could be made to crack the older encryption methods? Asking for a friend ;-).

Re:

[drinkypoo]

Is my assumption incorrect that a QC could be made to crack the older encryption methods?

If a more powerful quantum computer can be built, then it could do that. But there's no evidence thus far that an actually useful one can be built.

counterpoint

[bart_smit]

Peter Gutmann, CS professor University of Auckland has a different perspective on PQ: https://www.cs.auckland.ac.nz/... [auckland.ac.nz]

Re:

[Shaitan]

In that paper Gutmann argues that the experimental support for the notion quantum can reverse 2 factors is zero alongside time travel, FTL movement, and the startrek transporter while also pointing nearly half of all NIST PQC candidates have been broken and that every other new PKC came with decades of vulnerabilities and attacks.

That doesn't seem like a counterpoint. It seems like a more detailed explanation for the NSA's motive to keep more systems PQ only.

Post-quantum?

[Tony Isaac]

So quantum cryptography has already run its course and we've moved on past it? There must be a gap in my timeline. Perhaps my mind was entangled.

Re:

[XXongo]

So quantum cryptography has already run its course and we've moved on past it? There must be a gap in my timeline. Perhaps my mind was entangled.

The discussion is about quantum computers for cracking cryptography, not about using quantum methods to encrypt. Post-quantum cryptography means cryptography that is not easily succeptible to cracking using a (as yet unrealized) quantum computer.