sweis

Yes. I did speak to a cryptographer.

A buddy did it with Claude, so zero time.

Yep.

NIST closed it: https://www.muckrock.com/foi/united-states-of-america-10/ori...

NSA ignored it: https://www.muckrock.com/foi/united-states-of-america-10/ori...

I think part of it is I don't know how to write these FOIA requests in the right way they can comply with it. I think you need to be more specific.

I have seen nothing that would make me believe there is a "[gag] by the NSA" preventing frontier labs from publishing cryptographic results.

We published HAWK and McEliece attacks no problem.

I think they legitimately did not know. The person who worked on it directly, Jerry Solinas, did not remember and gave an explanation that turned out to be wrong. In his defense, multiple people told the same story about hashing a phrase that was wrong.

If they did know, they could have handed over these timestamps 15 years ago and put the issue to bed.

Some previous discussions started based on these posts: https://blog.cryptographyengineering.com/2015/10/22/a-riddle... https://eprint.iacr.org/2015/1018

The two people were Bob Reiter and Jerry Solinas. Jerry wrote in a 2015 email to Daniel Bernstein that he thought it was a hash of the passphrase. I corroborated that story with 4 people, including two ex-NSA folks off the record.

Everyone was wrong!

I wasn't able to reach Bob. He was working in private industry as of 2018, but never responded.

13 years of tinfoil hats for srand48(time(NULL)

Yep, they ran on some newer GPUs so were able to use fewer. Their implementation was faster than mine on RSA-260. For RSA-896, mine improved the performance a bit and selected a good polynomial.

I’ll post more details once I get a chance. I wanted to publish as soon as I had the factors because I was beat by 48 hours last time.

I misspoke and corrected down thread.

The HAWK attack was on a 3rd round PQC candidate that had been under adversarial review by experts for 3 years. It is an outlier and most vulnerabilities are easier to find.

The NSA is not trying to weaken ML-KEM. The IETF TLS working group is simply trying to publish a pure ML-KEM specification. It does not impact the hybrid ietf-tls-ecdhe-mlkem specification at all.

The context of this is that D.J Bernstein has been moderated 7 times from the mailing list for repeated unprofessional and disruptive behavior: https://mailarchive.ietf.org/arch/msg/tls/lON9lKptnJ6ccq2-I1...

“ There was a bug in an OpenPGP library which finally gave us an excuse to tear encrypted email via PGP to shreds. Our special guest William Woodruff joined us to help explain the vuln and indulge our gnashing of teeth on why email was never meant to be encrypted and how other modern tools do the job much, much better.”

I dug into this once and the "theoretical ideal" of 3 originated in a 1950s paper about vacuum tube computers, which itself immediately backed off and said the choice of base 2 is frequently justified.

https://sweis.medium.com/revisiting-radix-economy-8f642d9f3c...

In this case, the context are {-1, 0, 1} weights in a LLM model, which I don't think is being used for any hardware efficiency argument. I think it's just quantizing weights into 3 states.

The video of the talk is online now too: https://www.youtube.com/watch?v=7VWNUUldBEE

The best estimate I've seen is that we need about 5-7 orders of magnitude more qubits and 1-2 orders of magnitude lower error rates: https://sam-jaques.appspot.com/quantum_landscape_2023

Rambus bought Cryptography Research about 12 years ago: https://www.rambus.com/rambus-completes-acquisition-of-crypt...

NIST P-256 curve seed came from the X9.62 specification drafted in 1997. It was provided by an NSA employee, Jerry Solinas, as an example seed among many other seeds, including those provided by Certicom. Read this for more details: https://eprint.iacr.org/2015/1018

"High q-bit proprietary technology" and "specialized de-latticing algorithms" are made up terms that nobody uses.

A post talking about how Jerry Solinas provided the NIST ECDSA curve parameters and anecdotes of how they were chosen.

NIST post-quantum standards resulted from a 8+ year process and public competition: https://csrc.nist.gov/projects/post-quantum-cryptography

The record quantum computers can factor is 21 -- and that is by cheating by already knowing the factors are 3 and 7. There are other results that use special form composites which don't count.

So a QC can factor a 5 bit number with Shor's algorithm in 2023 (with some cheating). That record has not changed for 10+ years.

I publicly bet 8 years ago that nobody would factor the number 35 by 2030. I hope I'm proved wrong.

This is appearing at Crypto'23: https://crypto.iacr.org/2023/program.php

Video of a previous lecture is here: https://www.youtube.com/watch?v=4xNk3B-4TKs

Is this using unauthenticated AES-CTR mode?

https://github.com/meshtastic/Meshtastic-device/blob/0447808...

https://github.com/meshtastic/Meshtastic-device/blob/0447808...

https://github.com/meshtastic/Meshtastic-device/blob/285413c...

The record for factoring using a quantum computer is 21. Don't read that as 21 bits. 3*7. This has been the record for 12 years and that is arguably a result that is "cheating" with a priori knowledge of the factors.

There are some other examples of people factoring special-form composites that are particularly easy to factor on quantum computers, but those are basically stunts with no impact.

To threaten RSA, quantum computers need to increase the number qubits 6 orders of magnitude and improve the error correction at least 2 orders of magnitude. Check out this blog post for an illustration of where we are at: https://sam-jaques.appspot.com/quantum_landscape

Oded Goldreich's "Foundations of Cryptography" books are the rigorous, theoretical oriented books used in many grad-level crypto courses: https://www.wisdom.weizmann.ac.il/~oded/foc-book.html

Neil Koblitz has "A Course in Number Theory and Cryptography", which I haven't read, but is often used: https://www.amazon.com/Course-Number-Cryptography-Graduate-M...

Also, Boneh and Shoup is good and mentioned in other comments: https://toc.cryptobook.us/

You can't just base a business in a QOZ and call it a QOZB. It needs to generate 50% of its gross income from within the zone and 40% of its intangible property (e.g. software) must be used for business within a zone.

Further, there are restrictions on what kind of business it can be. It can't be, for example, a golf course or a liquor store.

I think we are many, many years away from a quantum computer being able to break 256-bit ECC:

https://sam-jaques.appspot.com/quantum_landscape

https://www.bsi.bund.de/EN/Topics/Cryptography/QuantumComput...

The current record in factoring with Shor's algorithm is 21. Yes. 3*7. That record has stood for 12 years and arguably is not even running Shor's because it required a priori knowledge of the factors.

Even with "cheating" by using knowledge of the factors, in 20 years we have seen seen a single bit of improvement.

None of the new quantum computers from IonQ, Google, or QuEra with 32-256 qubits are even able to even replicate those early results. D-Wave claims 5000 qubits, but that is for adiabatic QC, which to my knowledge, cannot run Shor's algorithm.

To be a threat, QCs need millions of qubits and orders of magnitude better error correction. I think people make the mistake of looking at the speed of progress of classical computers and thinking it applies to QC. It's just not happening.

I don't think QKD is practical, yet there are constantly companies trying to sell it. I don't really understand who is the market -- not big companies and not the US government.

The NSA recently issued guidance to government agencies that it "does not consider QKD a practical security solution for protecting national security information".

https://media.defense.gov/2021/Aug/04/2002821837/-1/-1/1/Qua...

A quantum computer is not "infinitely parallel" and though it's still an open problem, it's considered unlikely that that quantum computers can solve NP-complete problems in polynomial time.