Comment by tptacek | Hacker News Reader

Comment by tptacek | Hacker News Reader

Parent Full thread

For the same reason your Toyota Camry doesn't have a roll cage.

I'd use a hybrid if I was designing a system; I am deeply suspicious of all cryptography, and while I don't think Kyber is going to collapse, I wouldn't bet against 10-15 years of periodic new implementation bugs nobody knew to look for.

But I'm cynical about cryptography. It's really clear why people would want a non-hybrid code point.

Let me just say this once as clearly as I can: I sort of don't give a shit about any of this. A pox on all their houses. I think official cryptographic standards are a force for evil. More good is going to be done for the world by systems that implement well enough to become de facto standards. More WireGuards, fewer RFCs. Certainly, I can't possibly give even a millifuck about what NIST wants.

But I also can't be chill about these blog posts Bernstein writes where it's super clear his audience is not his colleagues in cryptography research, but rather a lay audience that just assumes anything he writes must be true and important. It's gross, because you can see the wires he's using to hold these arguments together (yes, even I can see them), and I don't like it when people insult their audiences this way.

> For the same reason your Toyota Camry doesn't have a roll cage.

It does though. It's just been engineered integral to the unibody. And there are crumple zones, airbags, seat belts, ABS, emergency braking systems, collision sensors, and more layered defenses in addition.

No sane engineer would argue that removing these layers of defense would make the car safer.

If you remove enough of them, then the car is much lighter: in some scenarios (such as when the car has no occupants), that makes it much safer. Of course, these scenarios are relatively rare – but a "sane engineer" could easily make an argument along these lines.

Strong disagree. Best practice is to evaluate the likelihood of scenarios along with potential negative impacts and your contrived scenario fails on both counts. It would not survive review. If you are lucky, your senior engineer may consider it a joke. Unlucky and you might be the joke for suggesting it. Either way you'd be liable for such a decision, were it to make it into a production vehicle and result in a death.

Which is why many engineers wear the ring.

Folks do love to argue though.

It's really clear why people would want a non-hybrid code point.

To me it really isn't. TLS has no need for it. But let's focus the context for some US government organisations that want this for their FIPS maturity level they're aiming for. Why would these organisations want a weaker algorithm for TLS than what is standardised; more importantly how does it benefit deployment except save a tiny bit of computation and eliminate some ECC code. I'm not going to jump the shark and say it is nefarious, but I will throw in my 2 cents and say it doesn't help security and is unnecessary.

And this gets back to the Dual-EC argument, right? Dual-EC was standardized as this weird government thing that maybe you technically need for FIPS, but obviously if you're seriously designing a cryptosystem you wouldn't choose it. And that seems to be GP's position on non-hybrid PQ as well -- just that the reason for not choosing it is "it introduces risk for very little benefit" instead of "it is obviously a bumbling attempt at introducing a backdoor".

> Dual-EC was standardized as this weird government thing that maybe you technically need for FIPS, but obviously if you're seriously designing a cryptosystem you wouldn't choose it.

Unless NSA pays you $10 million, as they did to RSA, to make said obviously bumbling attempt the default in their security products.

https://en.wikipedia.org/wiki/Dual_EC_DRBG#Timeline_of_Dual_...

https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9...

Or unless the presence of such less secure options in compliant implementations enables a https://en.wikipedia.org/wiki/Downgrade_attack

Yeah. Like, the argument here is that the reason government agencies push stuff into standards is because they do in fact want people to use it. "Well government purchasing is just Like That, surely no one will actually use this option in the real world" is an even weaker counter-argument if the option is not obviously backdoored.

Also: https://eprint.iacr.org/2016/376.pdf

You're arguing against deliberate cooperation.

Reply on news.ycombinator.com