Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the main stream crypto algorithms that have been designed without known involvement from the NSA?

I know that twofish has been designed by Bruce Scheier, but which are the other independently developed algorithms?

Note that this is not a subjective question

share|improve this question

closed as too broad by Xander, Adi, Terry Chia, Gilles, Iszi Oct 6 '13 at 19:51

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

This question appears to be off-topic because it is about the history of cryptography in itself, not about its application to security. – Gilles Oct 6 '13 at 19:11
The Caesar cipher, the Vigenère cipher and Enigma were designed without involvement from the NSA. The morality: “designed without involvement from the NSA” is not a good criterion to select an encryption scheme. – Gilles Oct 6 '13 at 19:13
@Gilles "The Caesar cipher, the Vigenère cipher and Enigma were designed without involvement from the NSA" [Citation needed] – CodesInChaos Oct 7 '13 at 9:08
@CodesInChaos I forgot to mention the assumption that the NSA has no access to a time machine. As far as I know, the lizard people who secretly control the NSA have not granted them access to their time machine, because the guy in the pub down the road who secretly controls the lizard people wouldn't allow them to. – Gilles Oct 7 '13 at 9:47

How do you know that ole' Bruce Schneier was not covertly paid by the NSA to inject weaknesses in his designs ?

If you take the paranoid stance that NSA is powerful, aims at making encryption systems weak, and may resort to tinkering and bribery to that effect, then claiming that any specific system author is immune and obviously clean from such interference, is pure wishful thinking. For that matter, it would make more sense to believe that the AES itself, i.e. Rijndael, is "unmodified by NSA", for the basic reason that the Rijndael authors are not American, and thus less susceptible to NSA leverage than Bruce Schneier.

Note that I do not claim that Bruce was bought off; Heavens forbid that I accuse without any proof someone whose appearance is so uncannily similar to that of Chuck Norris. But I mean that you are not thinking your own question through. If your enemy can manipulate algorithms to include weaknesses "in plain sight", that hundreds of trained cryptographers miss, then you cannot trust any algorithm, regardless of its purported authors.

Now if you really want raucous gossip, rumour was, at the time of the AES competition, that the NSA candidate was MARS. Cryptographers did not like it, not because of its purported ascendancy (Don Coppersmith is a highly respected cryptographer) but because it was internally too complex, somewhat "inelegant", compared to nice regular structures like Rijndael or Serpent, where proper Science could be made much more easily.

share|improve this answer
+1 that was hilarious. Not as good as the chimps though. – Johan Oct 7 '13 at 12:42

While not subjective, it's nonetheless impossible to answer.

If the NSA wanted to sabotage a process that they weren't invited to, they could do so by sending someone to act without disclosing their affiliation. The agency has enough knowledge of cryptography that someone they sent would be taken seriously at such a process.

share|improve this answer

It's hard to prove that the NSA wasn't involved in any of these, but given their development history, it seems unlikely. There's no documented "tweaking" by NIST/NSA, and most of the authors of these algorithms are outside the USA.

share|improve this answer
For the case of SOSEMANUK, I may challenge the assertion that there "may be weaknesses" (especially since I am one of the authors). The so-called "weaknesses" which have been reported are mostly of the reading disorder type: a 128-bit security level is claimed, and someone came up with an "attack" with a cost of 2^224, i.e. way beyond the announced security level. The Wikipedia page is very misleading in its presentation, I shall correct it ASAP. – Thomas Pornin Oct 6 '13 at 14:56

If you prefer the involvement of the opposite of the NSA, you could try Russia's GOST cipher.

Which raises an interesting point - as GOST is considered of the same class of Feistel Network as DES, then derivatives such as 3DES could be considered "NSA neutral" otherwise Russia would not have created a block cipher so similar to DES*.

* The "Soviets stole American technology" doesn't fly for cryptographic products as you would never introduce a stolen cipher you didn't trust; and the USSR had many very skilled mathematicians, especially from Poland.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.