The NSA has had a large hand in the design of at least two significant encryption standards: the Digital Encryption Standard, and its successor, the Advanced Encryption Standard.

Because of their involvement, there is much speculation of backdoors. Setting aside our tinfoil hats for a moment, have there been any official statements by the NSA or other involved organizations as to why the NSA have had a part in the encryption standards?

Why it is in their interest to support the encryption of data? Especially when the usage of the encryption standards can't be enforced; the algorithms can be (and are) used by countries and corporations outside of the United States.

  • 9
    I mentioned it in the question, but I'll say it again, I'm looking for official and verifiable information released by the NSA or involved organizations, not speculation or guesswork.
    – IQAndreas
    Commented Oct 26, 2015 at 16:34
  • 49
    It's a public part of the mandate of the NSA: nsa.gov/about/mission/index.shtml
    – schroeder
    Commented Oct 26, 2015 at 16:46
  • 19
    in short: it's their job to define crypto standards
    – schroeder
    Commented Oct 26, 2015 at 16:46
  • 3
    Let's also not forget that the exportation of cryptography was banned up until about a decade ago. The export grade ciphers continue to exist and be used (For some god awful reason). Ciphers were originally a matter of national defense and the NSA most likely remains due to a carry over of that responsibility. NIST may validate ciphers for public use, but the NSA has the added responsibility to concur that the ciphers can be used in government machines. Government machines must abide by FIPS 140-2.
    – pr-
    Commented Oct 26, 2015 at 17:04
  • 8
    Don't forget that the NSA is the largest employer of mathematicians and cryptographers in the world. I'de want that defining the standards. Commented Oct 26, 2015 at 21:02

2 Answers 2


The NSA is a composite organization, that comprises several sub-entities called "directorates" with various scopes and goals. The NSA, as a whole, is supposed to have a multitude of roles; its signal intelligence role (often abbreviated as SIGINT, i.e. spying) is the one most people talk about, and is supposed to be handled by the SID (as "Signal Intelligence Directorate"). However, NSA is also supposed to ensure the information safety of US interests, and as such should help federal organizations and also big US private companies apply proper encryption, where encryption is needed. This defensive role falls largely within the scope of the IAD (Information Assurance Directorate).

It is true that within the NSA, the balance of power substantially shifted towards SID after September 2001, but they still maintain a non-negligible defensive role. In any case, both DES and AES were standardized before that date.

In the USA, federal standards are edited and published by a specific agency called NIST. NIST is not the NSA. However, when the NIST people deal with some cryptographic algorithms, they like to get inputs from the NSA because that's where the US government keeps its crypto-aware thinkers. The NSA itself likes to be consulted by NIST because they want to keep track of published cryptographic algorithms, both for attacking and defending (they want to know what algorithms they will be faced with when trying to eavesdrop, and they also want to know what algorithms they should advise big US companies to use to thwart foreign evildoers).

On that subject, you may want to read this article which is about elliptic curves and "post-quantum crypto", and what the NSA says and thinks about it. It highlights that NSA is, first and foremost, a big governmental organization, and thus tends to behave like big governmental organizations do; in particular, some or even most of its actions are related to its own internal politics.

There is quite a gap between "being involved" and "having a part". According to Don Coppersmith (one of the DES designers), the NSA, at some point, interacted with the IBM team, under the avowed goal to strengthen the algorithm. The NSA, at that time, still employed a substantial proportion of available cryptographers (this is no longer true), and had some knowledge of an as yet unpublished attack method, namely differential cryptanalysis. The NSA wanted to make sure that the new algorithm would resist such attacks. It turned out that the IBM team had also conceived the idea of differential cryptanalysis, and had already strengthened their design against it. So the NSA involvement reduced to asking the IBM researchers not to publish their findings.

(As Leibniz would have put it, scientific discoveries are floating in the air, and when you have a new idea, chances are that several other people have the same idea at the same time. It is thus pretty hard to keep ahead of the rest of the World in scientific areas.)

For the AES standardization process, NIST deliberately organized the whole competition as being very open; submitters were encouraged and even requested to publish all design criteria of their candidates. While one cannot logically preclude the possibility of bribery to inject a backdoor in one candidate, because it is very hard to prove a negative (that's the point about conspiracy theories: they cannot be rationally denied because they are beyond logic), most candidates, including the one finally chosen (Rijndael), had all their design elements fully explained, with no undisclosed dark area. Thus, NSA input in that matter was mostly a statement that they found nothing wrong with any candidate.

(Cryptographers are also human beings and, as such, may occasionally indulge in gossip. At that time, the gut feeling of most of them was that if there was an NSA-sponsored candidate, then it was MARS, mostly because that was Don Coppersmith and IBM again. In any case, that algorithm was not very popular because it was overly complex and hard to fathom. Rijndael's structure was a lot more simpler.)

  • 2
    Would it be worth noting the concept of a "nothing-up-my-sleeve" number? Such things may not allay conspiracy theories, but they do make them a lot less tenable.
    – supercat
    Commented Oct 27, 2015 at 21:07
  • 1
    NSA also talked IBM into reducing DES's key size, but that's a front door, not a backdoor. It's as overt as possible. en.wikipedia.org/wiki/… Commented Oct 28, 2015 at 4:46
  • @supercat: The concept of "nothing-up-my-sleeve" numbers has some subtleties. I am not overly fond of NUMS numbers because they seem to provide more security than they actually do. Commented Oct 28, 2015 at 16:59
  • @ThomasPornin: It's hard to judge the size of pool from which an NUMS number/sequence was chosen, but something like the fractional parts of the cube roots of primes starting with 2 doesn't seem like something that would have been drawn out of a very large pool of candidates, nor like something that would inherently have an exploitable structure. In any case, it might be worth mentioning the concept.
    – supercat
    Commented Oct 28, 2015 at 19:57

Back in late 1980s the NSA had a branch called the National Computer Security Center (It may still exist today). The job of this "center" was to help enterprises on the budding forefront of information technology stay secure. Some of the main things they did were: test hardware of major vendors for defects that could leave them vulnerable, test software of major vendors for vulnerabilities, and develop encryption techniques for use in the industry. Some of the encryption technology developed by this branch is still in use today. It is also important to note that this branch of the NSA is completely declassified. I highly recommend reading: The Cuckoo's Egg by Clifford Stoll as it goes very far in depth on how this branch of the NSA came about.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .