Cryptography Mailing List

NTRU Prime was written by Dan Bernstein, who also had a strong hand in the creation of ed25519 elliptic curve keys, and the chacha20-poly1305 AEAD cipher. https://news.ycombinator.com/item?id=37520065 https://www.metzdowd.com/pipermail/cryptography/2016-March/028824.html The first version of NTRU Prime in an SSH server was implemented in TinySSH and later adopted by OpenSSH. Bernstein provided new guidance, and OpenSSH developed an updated algorithm that TinySSH implemented in return. The NIST approval process was fraught, and Bernstein ended up filing a lawsuit over treatment that he received. I don't know how that has progressed. https://news.ycombinator.com/item?id=32360533 While Kyber may have been the winning algorithm, there will be great preference in the community for Bernstein's NTRU Prime.

The classic metzdowd cryptography list is generally good reading: https://www.metzdowd.com/mailman/listinfo/cryptography Another good fly-on-the-wall place to see what's going on in a specific tech niche is the dns-oarc operations list: https://lists.dns-oarc.net/mailman/listinfo/dns-operations

> "DJB monoculture" Original post: https://www.metzdowd.com/pipermail/cryptography/2016-March/028824.html LWN: https://lwn.net/Articles/681615/ Funnily it was Peter Gutmann who wrote this, who also has a big influence in cryptography (on the other hand, he was the creator of the widely-misunderstood "Gutmann method" in erasing disks to the point that he himself now recommends just destroying the disks if you're that paranoid).

I’ve been noticing this sort of comment a lot in discussions of cryptocurrencies. Take for instance the following response to the Ray Dillinger’s email: Internet also became a disaster. We're very far from original ideas: Uncensored, decentralized ideals are forgotten. I remember, in the beginning, governments were really afraid of people's reactions, even to make small regulations. Today, we don't even discuss before accepting any regulation about Internet. Infrastructure is almost completely controlled/owned by governments or cartels. [1] That is so far beyond reality that it’s hard to believe this person was there “at the beginning”. The Internet, after all, started as a DARPA project... 1. https://www.metzdowd.com/pipermail/cryptography/2020-December/036515.h…

Cryptography/Security: * General cryptography http://www.metzdowd.com/mailman/listinfo/ * SSL/TLS news https://www.feistyduck.com/bulletproof-tls-newsletter/ * Cryptography concerns for ops (typically TLS) https://lists.eff.org/mailman/listinfo/crypto-ops * General cryptography https://lists.randombit.net/mailman/listinfo/cryptography I stopped following a bunch of cryptography twitter feeds, because the Bulletproof TLS newsletter was lower volume and higher signal.

From the same thread (Peter Gutmann, Fri Feb 24 00:42:36 EST 2017): "After sitting through an endless flood of headless-chicken messages on multiple media about SHA-1 being fatally broken, I thought I'd do a quick writeup about what this actually means. In short: Reports of SHA-1's demise are considerably exaggerated. What CWI/Google have done is confirmed what we've known for a long time, that SHA-1 is shaky. Using a nation-state's worth of resources and a year of time (https://security.googleblog.com/2017/02/announcing-first-sha1-collisio… they've shown that, with a very carefully-crafted document, you can create a collision. Their presentation of the results is detailed and accurate, it's the panicked misinterpretation of those results that are the problem." Continues here: http://www.metzdowd.com/pipermail/cryptography/2017-February/031604.ht… [edit: typo]

I always found it interesting to read the initial announcement and follow up emails on the Cryptography Mailing List by Satoshi in 2009. Hal Finney responds relatively quickly to Satoshi’s email, whilst the rest of the mailing list is embroiled in a hash algorithm discussion (TLS/MD5/SHA1/SHA256). Finney goes into some detail suggesting to me that he already knew beforehand what Bitcoin was about and how it could work and change the world. Of course parts of Bitcoin were based on his RPOW paper as well as building on much of the developments in digital cash up to then. Much of the feedback was negative (without it seems testing it) and based on the concept of digital cash in general and POW. Ironically it was also pointed out by another member that Bitcoin’s proof of work would require a lot of energy and have negative effects on the environment if successful. But most of the discussion and pro-side was promoted by both Finney and Satoshi. It almost seems “sock-puppet-esque”, or at a minimum Finney was already invested in the idea. https://www.metzdowd.com/pipermail/cryptography/2009-January.txt

I remember Peter Gutmann posting about this on the metzdowd cryptography mailing list in March. Fun to see this a few months later. It starts here: https://www.metzdowd.com/pipermail/cryptography/2025-February/038625.h… This part is from farther down thread: "Just as a thought experiment, what's the most gutless device that could perform this "factorisation"? There's an isqrt() implementation that uses three temporaries so you could possibly do the square root part on a ZX81, but with 1k of RAM I don't think you can do the verification of the guess unless you can maybe swap the values out to tape and load new code for the multiply part. A VIC20 with 4k RAM should be able to do it... is there a programmable calculator that does arbitrary-precision maths? A quick google just turns up a lot of apps that do it but not much on physical devices. Peter."

My only source so far is this anonymous mailing list post. https://www.metzdowd.com/pipermail/cryptography/2025-April/038780.html

A working paper framing Bitcoin as genetic code. Announced on the Cryptography mailing list 31 Oct 2024 (https://www.metzdowd.com/pipermail/cryptography/2024-October/038556.ht… to coincide with the 16th anniversary of the Bitcoin Whitepaper announcement (https://www.metzdowd.com/pipermail/cryptography/2008-October/014810.ht… To support future research, you can buy the working paper using Bitcoin: https://canonic.xyz/p/19REK14thnY5Y2b8MfnBmaQs6G3VHoY9oQ

Is this not just related to the Dual_EC_DRBG and other tainted RNG issues we've known about, and mitigated, for years? You can see discussion on this going on as far back as 2015, explicitly in regards to what "SIGINT enabled" means and Cavium: https://www.metzdowd.com/pipermail/cryptography/2015-December/027657.h… Am I missing something here? People are talking as if there is some new backdoor that's somehow avoided detection. Did everyone just miss this discussion in 2015? Discussion of the "Sigint Enabling Project" goes as far back as 2013 on HN itself.

> This is arguably the safest library you can use if you are adopting crypto. The documentation is a delight to read and the abstractions make it difficult to make mistakes. Its Daniel J Bernstein's world, we merely live in it: - http://www.metzdowd.com/pipermail/cryptography/2016-March/028824.html - https://cr.yp.to/highspeed/naclcrypto-20090310.pdf

Yep, here's[0] Hal Finney describing how rentier-ism was built into the network that he worked out just as it was released. [0]: https://www.metzdowd.com/pipermail/cryptography/2009-January/015004.ht…

There's some more discussion of ipsec in the thread https://www.metzdowd.com/pipermail/cryptography/2020-July/036077.html I'd be interested to see references to SSL too (from a historical perspective)

pthread_atfork functions aren't called if the application calls the clone syscall directly. The right solution is MADV_WIPEONFORK on Linux, or MINHERIT_ZERO on OpenBSD: https://www.metzdowd.com/pipermail/cryptography/2017-November/033133.h…

>This article is terrible honestly. Statements like "tracing a cryptocurrency that once seemed untraceable". Excuse me what? Who thought this? Idiots at three letter agencies? Pedophiles and drug dealers? There's often a disconnect on HN between what HN users collectively know by virtue of this being their field of trade, and what the average non-tech person is aware of. It's this latter group of people that, by and large, as Bitcoin started to become popular, were under the impression that it was anonymous. Edit: It doesn't help that, as the article states, Satoshi even said, "Participants can be anonymous," back in 2008[1]. To your point, he did say this as he linked to the white paper you mentioned, but average users are less likely to read the white paper than we are. [1]https://www.metzdowd.com/pipermail/cryptography/2008-October/014810.ht…

> Bitcoin really needs some kind of SSL or way of getting a verified address from a particular organisation or person. https://www.metzdowd.com/pipermail/cryptography/2022-March/037752.html

Yes. He chose to design his system with no ability to migrate and use a hash algorithm that was already known to be flawed. https://www.metzdowd.com/pipermail/cryptography/2017-February/031623.h…

> It never was meant to be, and it never advertised itself as such. Totally untrue. Read Satoshi's emails--it was in the title of his first email about Bitcoin, and the first sentence in the whitepaper! The current bitcoin core devs took over from Gavin who also shared the "cash" vision. They booted everyone with plans for making it cash, and censored or blocked everyone in the bitcoin subreddit who said anything about cash or large block sizes. https://www.metzdowd.com/pipermail/cryptography/2008-October/014810.ht…

Ray Dillinger was there in bitcoin's early days. He recently wrote this: https://www.metzdowd.com/pipermail/cryptography/2020-December/036510.h… > The pseudonymity of coins being owned by the bearer of some cryptographic key is a failure; > People have been eavesdropping and aggressively analyzing the block chain from day 1. > And the block chain will always be there, it will always be public, and it will always be subject to further analysis. > And we are learning that analysis of that record is sufficient to destroy any pretense of anonymity or pseudonymity.

Oh, speaking of cryptocurrencies I recently came across with this article. https://www.metzdowd.com/pipermail/cryptography/2020-December/036510.h…

Interesting reading Deryk Makgill's response: https://www.metzdowd.com/pipermail/cryptography/2020-December/036512.h… and then Ray's response back: https://twitter.com/wakgill/status/1344760972116942850

Apparently, was more than just a rumor. https://www.metzdowd.com/pipermail/cryptography/2002-June/002456.html https://wiki.c2.com/?MicrosoftPalladium

This was pointed out to Linus right at the beginning of GIt development [1]. SHA-256 was available and SHA-1 weaknesses were known. Unfortunately he chose to ignore it. [1] https://www.metzdowd.com/pipermail/cryptography/2017-February/031623.h…

Yes, you can read it from the horse's mouth: https://www.metzdowd.com/pipermail/cryptography/2008-November/014849.h…

Thanks for sharing this. Of all the Sathoshi candidates, Hal Finney seems to be the closest (Not my analysis, but I tend to concur). Although he always denied it. When I read this[1] early reply by him, he seems to totally grok it. [1] http://www.metzdowd.com/pipermail/cryptography/2009-January/015004.htm…

Equally elucidating are the responses on the Cryptography List from other cryptographers[1], plus the responses a few months later when Bitcoin 0.1 was released[2]. You can pretty easily tell which cryptographers read the whitepaper and which ones did not. :) [1]: http://www.metzdowd.com/pipermail/cryptography/2008-October/thread.htm… [2]: http://www.metzdowd.com/pipermail/cryptography/2009-January/thread.htm…

If you work on crypto, or any application where sensitive data is handled, then this short post on the WIPEONFORK option may be interesting: http://www.metzdowd.com/pipermail/cryptography/2017-November/033133.ht…

Satoshi's original posts to the cryptography mailing list, and its members' responses are also of tremendous value. The chain starts at: http://www.metzdowd.com/pipermail/cryptography/2008-October/014810.htm…

> experienced C programmers don't C leaves a lot undefined. These were tiny examples, and many were undefined for more than one reason. Experienced C programmers rely on undefined behavior all the time: http://www.metzdowd.com/pipermail/cryptography/2015-October/026841.htm…