Daniel J. Bernstein

Look no further than DJB's troubles: https://blog.cr.yp.to/20260814-update.html Probably best to go to the index and look at part 1 of the saga.

How does this help people who are not following this issue regularly? gpg protected Snowden, and this article promotes tools by one of the cryptographers who promoted non-hybrid encryption: https://blog.cr.yp.to/20251004-weakened.html#agreement So what to do? PGP by the way never claimed to prevent traffic analysis, mixmaster was the layer that somehow got dropped, unlike Tor.

> That OMB rule, in turn, defines "consensus" as follows: "general agreement, but not necessarily unanimity, and includes a process for attempting to resolve objections by interested parties, as long as all comments have been fairly considered, each objector is advised of the disposition of his or her objection(s) and the reasons why, and the consensus body members are given an opportunity to change their votes after reviewing the comments". From https://blog.cr.yp.to/20251004-weakened.html#standards, linked in TFA.

> Great thing about entropy is that adding more never hurts. I used to think the same but here's a counter-example of a (hypothetical) attack based on a malicious entropy source being able to manipulate the hash/PRNG output: https://blog.cr.yp.to/20140205-entropy.html Now, it's not necessarily the most likely attack to materialize, as already pointed out downthread: https://news.ycombinator.com/item?id=43391377.

there are new items in this category every day, but https://blog.cr.yp.to/20240803-clang.html is noteworthy

> There was a study a while back A couple of posts about how poor that paper was: • https://lemire.me/blog/2015/01/14/knauff-and-nejasmic-recommend-bannin… • https://blog.cr.yp.to/20201206-msword.html

> NSA recommended people stop using ECC <384 bits (https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa...). Yet they are still fine with AES-128, even though it is objectively a weaker link in the chain. See https://blog.cr.yp.to/20151120-batchattacks.html

> I don't think this advice is really detailed enough to cover the breadth of the embedded space and/or comes with enough caveats about lack of writeable storage and reused keys. I believe the link I gave is. I highly recommend you read it. It's from a trustworthy author (Daniel Bernstein): https://blog.cr.yp.to/20170723-random.html

The talk about needing to constantly add more entropy or 'manage' it is nonsense. djb says it best: http://blog.cr.yp.to/20140205-entropy.html Briefly, once you have say 256 random bits it is trivial to use AES and CTR mode and turn that into 2^71 random bits until you need to rekey. If you cannot get more entropy in the time it takes to use up all of those numbers something is completely broken. The only problem you can have is not having enough entropy to bootstrap (such as VMs or needing to generate a key at poweron on an embedded device), but this paper gives little more than lipservice to it.

Yes, this is 8 years overdue. As djb points out in a letter to NIST here [1], this is not just about one specific NIST recommendation that had problems. There are problems with the standardization process as a whole. [1] http://blog.cr.yp.to/20140411-nist.html

NIST should get a clue and follow Dan Bernstein's advices: http://blog.cr.yp.to/20140411-nist.html

> On every mainstream OS, including the two mainstream mobile OSs, RDRAND is (at best) one of several sources of entropy. Actually DJB has a pretty interesting post about how RDRAND and microcoded instructions could work together to control the OS's RNG output, even if several sources are mixed in, by monitoring the entropy pool and brute forcing each bit: <http://blog.cr.yp.to/20140205-entropy.html>

FWIW, https://blog.cr.yp.to/20240102-hybrid.html reads to me like a more direct attempt to engage with the counterarguments. I am curious what the costs are seen to be here. djb seems to make a decent argument that the code complexity and resource usage costs are less of an issue here, because PQ algorithms are already much more expensive/hard to implement then elliptic curve crypto. (So instead of the question being "why don't we triple our costs to implement three algorithms based on pretty much the same ideas", it's "why don't we take a 10% efficiency hit to supplement the new shiny algorithm with an established well-understood one".) On the other hand, it seems pretty bad if personal or career cost was a factor here. The US government is, for better or worse, a pretty major stakeholder in a lot of companies. Like realistically most of the people qualified to opine on this have a fed in their reporting chain and/or are working at a company that cares about getting federal contracts. For whatever reason the US government is strongly anti-hybrid, so the cost of going against the grain on this might not feel worth it to them.

"NSA grade" irks me - to think these guys have your best interest at heart. In the 1970's they weakened DES [1]. In 2015 the NSA created a backdoor and pressured companies into installing it [2]. In 2016 you had the leaked tools stolen and used by the Shadow Brokers / Equation Group [3]. More recently the NSA made arguments against double encryption to combat weaknesses in potential quantum-safe encryption algorithms [4]. The point is that "NSA grade" likely means "NSA accessible". The major difference between WPA2 and WPA3 is the individual encryption. My guess would be that there is some backdoor during SAE and they could force a complete reconnect by temporarily jamming/disrupting all users on a network. [1] https://arstechnica.com/information-technology/2013/09/the-nsas-work-t… [2] https://twitter.com/matthew_d_green/status/1433470109742518273 [3] https://en.wikipedia.org/wiki/The_Shadow_Brokers [4] https://blog.cr.yp.to/20240102-hybrid.html

The author proposes a corolarry to Kerchoff's principle: > A cryptosystem should be secure even if all the parameters, except the key, are shared across every user. It seems that if the key counts as a parameter, then surely nonces also count, and we certainly do not want nonces to be reused. This may be why this principle is not best practice. I am quite confident that the author is well aware of this, and I agree with the general thrust of what they're saying... Perhaps another way of saying it is that where parameters CAN be held constant, they should be chosen well, and held constant. Or to quote Daniel J. Bernstein[1] quoting Mark Twain: > Behold, the fool saith, "Put not all thine eggs in the one basket"—which is but a manner of saying, "Scatter your money and your attention;" but the wise man saith, "Put all your eggs in the one basket and—WATCH THAT BASKET." [1]: https://blog.cr.yp.to/20140205-entropy.html

It’s possible that in the specific sense that NIST defined, KYBER-512 isn’t as strong as AES-128. However, that doesn’t mean that it’s less secure in general. E.g. DJB himself wrote a good article[1] on how even though 128-bit AES and 256-bit elliptic curve crypto are thought of as same “security level”, actually there are attacks against AES that just don’t apply to ECC when you consider multi-target security models (i.e., when you consider a population of users not just one). I wouldn’t be surprised if similar things applied to lattice-based crypto, but I don’t know enough about it. And even if we take the reduced security level given by DJB, it still seems big enough to be out of reach to any realistic attack. But by all means feel free to go one bigger and pick KYBER-768, and I believe lots of people do recommend this. Obviously, there is a performance penalty (as there is when moving from AES 128 to 256), and for PQ schemes there is also more importantly also a big increase in the size of bytes on the wire when public keys have to be exchanged (e.g. in TLS) - in this case a jump from 800 bytes to 1,184 bytes (a 48% increase). (Compare this to ECC public keys which are typically around 32-65 bytes, depending on encoding). [1]: https://blog.cr.yp.to/20151120-batchattacks.html

It's disappointing to read this thread. Even tptacek, a prominent speaker on Hacker News, exhibits bizarre ignorance regarding this topic. Generally speaking, it seems to me that much sloppy thinking in the current debate involves the mixture of the following basic errors: 1) Ignorance about biology. Evolutionary biology has been an exceptionally fertile section of science for the last decades, and provided deeper understandings on many biological phenomenon, including human behaviors. The accusers' understanding of biology (e.g. condemning it as "genetic determinism") is at least 50 years behind. 2) Poor understanding of the due process. Calling a random petition to condemn a person publicly is exactly a witch hunt. History proves that it's a very error-prone way to punish someone, and no civilized country accept it as a proper procedure anymore. As to (2) I'd recommend everyone to read DJB's "The death of due process". It is very important, because it may be you (or your family) to be hung by lynch mobs next time. https://blog.cr.yp.to/20160607-dueprocess.html

> this slightly time-saving but potentially dangerous choice? The one and only danger is during the machine's boot process, because while /dev/random and /dev/urandom use the same data: * on linux /dev/random has a silly and unfounded entropy estimator and will block at arbitrary points (used to be a fad at some point, but cryptographers have sworn off it e.g. Yarrow had an entropy estimator but Fortuna dropped it) * also on linux, /dev/urandom never blocks at all, which includes a cold start, which can be problematic as that's the one point where the device might not be seeded and return extremely poor data In fact the second point is the sole difference between getrandom(2) and /dev/urandom. If you're in a steady state scenario (not at the machine boot where the cold start entropy problem exists) "just use urandom" is the recommendation of pretty much everyone: tptacek, djb, etc… https://www.2uo.de/myths-about-urandom/ https://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ http://blog.cr.yp.to/20140205-entropy.html (see bottom of page)

Weighting functions are useless. If you mix entropy properly, in the absence of an _active_ attacker, the output will be no worse than the best entropy source. In the presence of an attacker they're just as useless, if not pernicious. Modern PRNG frameworks moved away from weighting years ago[1] because it not only has dubious benefit, but engineers suck at estimating entropy, so the estimates created a false sense of security. For example, the entropy estimates for hard drives were for a long time based on a single research publication, which as hard drives evolved over the years became increasingly irrelevant--assuming it wasn't irrelevant the day after it was published. Kernel engineers would try to add conservative margins, but if the original quantity has no basis in reality those efforts are just hand-waving. This is pretty much how all entropy estimates go. The research that goes into the estimates can be extremely rigorous and sound. The problem is not only ensuring the estimates are relevant to your mix of hardware, but that they remain relevant over time. New designs and new manufacturing methods come online on an almost daily basis, even for what appear to be identical products. Combined with the dubious benefit at the outset, trying to maintain the integrity of the estimates is little more than a fool's errand. With the exception of first-boot behavior, where you want to ensure there's "enough"[1] initial entropy, even accurate estimates don't provide any…

The best single-web-page treatment I've read is AGL's: https://www.imperialviolet.org/2010/12/04/ecc.html It describes the group mechanics but only briefly and then moves on to how, once you stipulate the group exists and has the operations you expect, you'd actually use it. Another way to frame the critique above is: the tutorial here has pretty basic coverage of the group mechanics and almost no coverage at all of how signing schemes with curves work --- and curve signing is actually pretty interesting! So: you'd kind of want the tutorial to pick one of those things --- the fundamental mechanism of elliptic curves as an abstract algebra concept, or curve crypto signing --- and do a better job on just that thing. For signing, the best I've read on a single page is DJB's: https://blog.cr.yp.to/20140323-ecdsa.html Someone could probably do some good fleshing out each of these sections for laypersons. (I'm spitballing).

DJB wrote a short history of NSA’s malicious meddling in the cryptography we all use, based on a declassified internal history of the NSA. https://blog.cr.yp.to/20220805-nsa.html

> Perhaps they know something we don't Perhaps https://blog.cr.yp.to/20260704-bugs.html#damage

DJ Bernstein seems to agree with you: https://blog.cr.yp.to/20240803-clang.html

The obvious counterexample is NOBUS[0] vulnerabilities, and intentional backdoors like the Clipper Chip[1] or Dual_EC_DRBG[2]: if you genuinely believe you are the only one who could possibly exploit it, there's no reason to avoid using it. A more modern example is probably the NSA aggressively pushing[3] for replacing classical encryption with post-quantum encryption, rather than taking the more conservative and probably-more-secure approach of layering the two - while at the same time mandating the use of two layers of those same algorithms for their own use[4]! [0]: https://en.wikipedia.org/wiki/NOBUS [1]: https://en.wikipedia.org/wiki/Clipper_chip [2]: https://en.wikipedia.org/wiki/Dual_EC_DRBG [3]: https://blog.cr.yp.to/20251004-weakened.html [4]: https://defense-solutions.curtisswright.com/capabilities/technologies/…

The “technical arguments” are documented here: https://blog.cr.yp.to/20260221-structure.html

DJB has for years claimed anyone who disagrees with him is affiliated with the NSA. See for example this post as part of the NIST-PQC competition https://blog.cr.yp.to/20220805-nsa.html > Some people seem to be unable to rationally consider the possibility that NSA is sabotaging post-quantum cryptography. I've heard people saying, for example, that submissions to the NIST Post-Quantum Cryptography Standardization Project (NISTPQC) were publicly designed and evaluated by top experts, and that NSA can't have bribed the submission teams. > > Let's look at the facts. Note that the authors of ML-KEM are overwhelming European.

“Surveillance agency NSA and its partner GCHQ are trying to have standards-development organizations endorse weakening ECC+PQ down to just PQ.”[0] That’s pretty weak just stripping down the hybrid approach. 0. https://blog.cr.yp.to/20251004-weakened.html

I've read the emails on that list in which DJB is accused of unprofessional behavior. Dave's concerns are not only relevant and well considered, he's taken an extraordinary amount of time to outline them and the discussion around them (both pros and cons) which you can see here: https://blog.cr.yp.to/20260221-structure.html He's also responded directly to criticisms: https://nsa.2026.action.cr.yp.to/guide.html By comparison the so-called "unprofessional behavior" cited is the sort of subjective abject procedural bureaucratic bullpucky often used to shut down inconveniently correct criticism.

Another poster has already given a link to the technical arguments of DJB, https://blog.cr.yp.to/20260221-structure.html where he combats very well your argument. For me, his argumentation seems far more grounded in reality than what you have said.

Any sane implementation (like the tool presented here) uses a hybrid scheme with both non-pq and pq combined. But there seems to be some truth to what you’re saying. Story unfolding: https://blog.cr.yp.to/20251004-weakened.html