Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What is the opinion of scholars, cryptographers on NSA Suite A? Containing unpublished algorithms. Could it really be that much better than the published algorithms besides being obscure and not documented publicly?

share|improve this question
add comment

4 Answers

up vote 12 down vote accepted

I don't believe in security by obscurity in general, but in case of crypto it's actually worse, because it violates Kerckhoffs Principle

So is it better? Maybe. Is it different? Sure. Is it necessary to hide the algos? If your crypto was good to begin with, you would not need to hide the algorithms, just the keys.

On the other hand, you have the 'many eyeballs make all bugs shallow' idea. However, in case of crypto, there are not too many (well educated) eyeballs to actually point out bugs in crypto algos. So one possible explanation for the hiding would be that the NSA makes the bet that there is a higher chance of another (not friendly) nation state having more and/or better eyeballs, as opposed to the benefits of potential improvement coming from opening algos to the community. Or maybe it's not the probabilities of bug-finding, but the impact that finding a vulnerability would have on the information they use their Suite A to protect. Either way, we will not know, because they will Never Say Anything ;)

share|improve this answer
6  
I think you're misunderstanding, or maybe misapplying Kerchoffs's Principle. "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge." just means that you shouldn't be relying on the secrecy of the algorithm for security. Keeping the algorithm a secret may (or may not) increase security, but it can't be required for a particular level of security. NSA designs their algorithms under the assumption that opponents know how they work. They don't publish them so as to not make it any easier on the bad guys than they have to. –  Mark Bessey Sep 20 '12 at 19:48
2  
Also, the NSA probably has the capability to hire many cryptographers for review work, and also has the power to forbid them to publish the details. Most other people do not; thus, obscure algorithms are likely to be very weak. –  user54609 Feb 20 '13 at 22:29
add comment

My opinion (and I am a cryptographer -- I have a shiny diploma which says so) is that:

  • We cannot speculate on unknown algorithms, because they are, well, unknown.
  • NSA is like all secret services in the World, they really love secrecy and will practice it for the sake of it. So the fact that their algorithms are not published is in no way indicative of some particular strength or weakness of the said algorithms.
  • It is entirely plausible that the unpublished algorithms are indeed distinct from publicly known algorithms such as AES or RSA.
  • It is also entirely plausible that "Suite A" and "Suite B" are, in fact, identical. At some point, to use some algorithms, you must have implementations, and these things do not grow on trees. Having your own algorithms is thus expensive.
  • If I were a US taxpayer, I would be slightly dismayed at the misuse of my tax money, if it turned out that NSA spent it on developing and maintaining custom algorithms instead of reusing perfectly fine ones like the AES.
  • There most probably are some people with power to decide a lot of things in the NSA, who believe that not publishing algorithms increases their security. Such people exist everywhere. It does not make them right, though.
  • There is no better security than "cannot break it", which is what we already have with (properly used) AES, RSA, DH, ECC... The NSA could know of faster algorithms which are as secure as the public ones; however, it would be hard to beat the performance of hardware-accelerated AES, unless they have their own CPU foundry.

The danger in security by obscurity is in believing that it works well. It may induce people to feel safe with homemade algorithms, because they would assume that the obscurity will hide the weaknesses of their algorithms. However, if you use good algorithms with published and well-studied protocols (i.e. AES, SSL...) then there is no harm done in not saying that you do.

share|improve this answer
1  
Finally it's entirely plausible that they just happen to be implantations of well known algorithms too, ultimately we don't know. –  ewanm89 Sep 20 '12 at 13:16
2  
Re 5th point: I don't mind if NSA develops algorithms. Even if other algo's work, I have no problem if a trivial slice of tax money goes to the NSA to do crypto algorithm research some of which results in new secret algos. You pay someone to research stuff in the number theory, cryptography, etc and they may just come up with a new algorithm even if that wasn't the original goal. Re: 6th, their boss may want to keep it secret not to increase security, but to make it so rivals don't have the algorithm/math to use themselves or are a few years behind (and not let flaws be publicly revealed). –  dr jimbob Sep 21 '12 at 5:24
add comment

On the other hand, it could well be that such agencies have certain knowledges far ahead of the public. One example, if I don't err, would be the case of public key crypto, where the British agency kept their knowledge from the public for quite a time.

share|improve this answer
add comment

An interesting data point here is the DES s-box constants. Wikipedia NSA Wikipedia DES

NSA recommended changes in the S-box constants to make DES resistant to differential analysis, which was unknown in the academic and commercial cryptography world at the time.

In that case, they were able to make that improvement in a way that was opaque to the users of the algorithm. It's possible that publishing the algorithms for secret crypto systems would reveal some other technique used to counter another attack that's not well-known outside their community yet.

share|improve this answer
    
Great point! Very salient here. –  adric Sep 20 '12 at 20:53
3  
I was thinking about the same thing! The tl;dr version is that the NSA was about 20 years ahead of academia (and possibly still is) WRT cryptoanalysis. They secretly showed IBM in 1975 how to modify DES to resist differential cryptanalysis, which wasn't officially discovered until around 1990. –  tylerl Sep 21 '12 at 6:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.