Crypto chat

Great conversation folks, and good research. My position is that the crypto community is still reeling from the revelations and messing that happened with NIST. I feel there is more doubt over EC encryption than AES, but AES is far from perfect and in some cases is weakened. A few years back a good related key attack was found and Bruce Sheider recommended changing the number of rounds of the algorithm for AES256 from 10 → 14 if I remember correctly. It may have been more rounds, but it was clear the rounds were not as high as you would want for Rijndael. That was suspicious at the time.

I take AES as something that is potentially broken, but less likely than EC (granted different types of encryption). The take away for me is we have reduced and possibly significantly reduced the faith in peer review and years of in the field testing. Look now apparently heartbleed was known for 2 years by the NSA, so the in field testing is very much harmed when this type of action is taken.

It is a real shame as many have spent their career in this crypto and the results, specifications and more cannot now be relied upon. So the normal scientific method at its very core has been what the NSA revelations have damaged. It is now hard to categorise and measure efficiency of algorithms and standards any more. For me this changes the game and makes crypto extremely dangerous as we know we do not have the truth regarding measurements and tests. NIST/NSA have really shot a whole industry in the head here.

So a mix of many schemes is probably best, we should not have to, but I feel its the world we live in, people have messed with the scientific method and the level of this interference is unknown, meaning we cannot trust results as we should be able to.

Those folks are not looking after us the way we think they, so greater care is required.

4 Likes