What is the opinion of scholars, cryptographers on NSA Suite A? Containing unpublished algorithms. Could it really be that much better than the published algorithms besides being obscure and not documented publicly?

  • 1
    The decision may be related to economic attrition. The NSA spent a bunch of money on mathematical research to develop Suite A cryptosystems, why give that research to your adversaries for free by publishing? Make the adversary pay for it through reverse-engineering, espionage, diplomacy, etc. Commented Jun 17, 2015 at 16:06
  • It is entirely possible that China or Russia have have already obtained those algorithms through hacking cyber-attacks or espionage attacks. I mean we also lost a supposedly top secret drone over Iran, such should not come as a surprise. But that doesn't automatically means that US military comms have been compromised, as security lies in the key size and complexity, rather than alogrithms, as many users have noted. Until their cryptographers or cryptanalysis have found a way to break down every round, nothing has changed. But don't expect an equally culpable US govt to reveal this publicly.
    – Nederealm
    Commented Oct 28, 2016 at 19:07
  • I wouldn't be surprised if it used RC6 (or a minor tweak of RC6) instead of Rijndael/AES. Commented Oct 29, 2016 at 8:56
  • @CodesInChaos There was a report somewhere, a few years ago (around the time of the initial Snowden revelations) about some NSA exploit code containing RC6 constants. That doesn't have to mean anything at all, and of course even if it does, then using RC6 (which was already public) might simply have been a way to not risk any of their own crypto in case of a compromise.
    – user
    Commented Oct 29, 2016 at 11:56
  • @MichaelKjörling I was under the impression that they chose RC6 because the constants are less likely to set off IDS alarms for encryption signatures, while still being cryptographically secure.
    – forest
    Commented Jan 28, 2018 at 23:20

5 Answers 5


I don't believe in security by obscurity in general, but in case of crypto it's actually worse, because it violates Kerckhoffs Principle

So is it better? Maybe. Is it different? Sure. Is it necessary to hide the algos? If your crypto was good to begin with, you would not need to hide the algorithms, just the keys.

On the other hand, you have the 'many eyeballs make all bugs shallow' idea. However, in case of crypto, there are not too many (well educated) eyeballs to actually point out bugs in crypto algos. So one possible explanation for the hiding would be that the NSA makes the bet that there is a higher chance of another (not friendly) nation state having more and/or better eyeballs, as opposed to the benefits of potential improvement coming from opening algos to the community. Or maybe it's not the probabilities of bug-finding, but the impact that finding a vulnerability would have on the information they use their Suite A to protect. Either way, we will not know, because they will Never Say Anything ;)

  • 17
    I think you're misunderstanding, or maybe misapplying Kerchoffs's Principle. "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge." just means that you shouldn't be relying on the secrecy of the algorithm for security. Keeping the algorithm a secret may (or may not) increase security, but it can't be required for a particular level of security. NSA designs their algorithms under the assumption that opponents know how they work. They don't publish them so as to not make it any easier on the bad guys than they have to. Commented Sep 20, 2012 at 19:48
  • 6
    Also, the NSA probably has the capability to hire many cryptographers for review work, and also has the power to forbid them to publish the details. Most other people do not; thus, obscure algorithms are likely to be very weak.
    – ithisa
    Commented Feb 20, 2013 at 22:29
  • 4
    Also, if the NSA has developed a new and more secure system, they may not want to release details so no one else can use it. Releasing the details of a system doesn't just let others analyze it, it lets others use it, which is generally a bad thing if you want to read their mail.
    – cpast
    Commented Sep 23, 2014 at 17:46
  • 2
    @MarkBessey That is correct (in that is the NSA's thinking) but it is also a fallacy. Is Suite A secure? Maybe. There is no provable security so the best defense against compromise is to put it out there and let millions of people TRY to break it. In the case of Suite A that won't happen until the obscurity is broken at which point either it is still secure or it will break horribly. If it is the former nothing is lost by making it public now, if it is the later then it really is only secure through obscurity. Commented Jul 3, 2015 at 17:01

My opinion (and I am a cryptographer -- I have a shiny diploma which says so) is that:

  • We cannot speculate on unknown algorithms, because they are, well, unknown.
  • NSA is like all secret services in the World, they really love secrecy and will practice it for the sake of it. So the fact that their algorithms are not published is in no way indicative of some particular strength or weakness of the said algorithms.
  • It is entirely plausible that the unpublished algorithms are indeed distinct from publicly known algorithms such as AES or RSA.
  • It is also entirely plausible that "Suite A" and "Suite B" are, in fact, identical. At some point, to use some algorithms, you must have implementations, and these things do not grow on trees. Having your own algorithms is thus expensive.
  • If I were a US taxpayer, I would be slightly dismayed at the misuse of my tax money, if it turned out that NSA spent it on developing and maintaining custom algorithms instead of reusing perfectly fine ones like the AES.
  • There most probably are some people with power to decide a lot of things in the NSA, who believe that not publishing algorithms increases their security. Such people exist everywhere. It does not make them right, though.
  • There is no better security than "cannot break it", which is what we already have with (properly used) AES, RSA, DH, ECC... The NSA could know of faster algorithms which are as secure as the public ones; however, it would be hard to beat the performance of hardware-accelerated AES, unless they have their own CPU foundry.

The danger in security by obscurity is in believing that it works well. It may induce people to feel safe with homemade algorithms, because they would assume that the obscurity will hide the weaknesses of their algorithms. However, if you use good algorithms with published and well-studied protocols (i.e. AES, SSL...) then there is no harm done in not saying that you do.

  • 1
    Finally it's entirely plausible that they just happen to be implantations of well known algorithms too, ultimately we don't know.
    – ewanm89
    Commented Sep 20, 2012 at 13:16
  • 5
    Re 5th point: I don't mind if NSA develops algorithms. Even if other algo's work, I have no problem if a trivial slice of tax money goes to the NSA to do crypto algorithm research some of which results in new secret algos. You pay someone to research stuff in the number theory, cryptography, etc and they may just come up with a new algorithm even if that wasn't the original goal. Re: 6th, their boss may want to keep it secret not to increase security, but to make it so rivals don't have the algorithm/math to use themselves or are a few years behind (and not let flaws be publicly revealed).
    – dr jimbob
    Commented Sep 21, 2012 at 5:24
  • 2
    "It would be hard to beat the performance of hardware-accelerated AES, unless they have their own CPU foundry" - they do, of course. Or rather, they have military contractors who produce their hardware designs, for DOD secure communication sets and the like. Commented Mar 31, 2017 at 13:50
  • 2
    Suite A and B are not identical. The public information we do have shows that some of the ciphers have properties that do not match any public cipher (whether due to a strange key size or a non-flat keyspace where control bits determine things like the number of rounds). It's possible that it is based off of public primitives, but I don't think it's possible that they are identical.
    – forest
    Commented May 25, 2018 at 4:17

An interesting data point here is the DES s-box constants. Wikipedia NSA Wikipedia DES

NSA recommended changes in the S-box constants to make DES resistant to differential analysis, which was unknown in the academic and commercial cryptography world at the time.

In that case, they were able to make that improvement in a way that was opaque to the users of the algorithm. It's possible that publishing the algorithms for secret crypto systems would reveal some other technique used to counter another attack that's not well-known outside their community yet.

  • Great point! Very salient here.
    – adric
    Commented Sep 20, 2012 at 20:53
  • 5
    I was thinking about the same thing! The tl;dr version is that the NSA was about 20 years ahead of academia (and possibly still is) WRT cryptoanalysis. They secretly showed IBM in 1975 how to modify DES to resist differential cryptanalysis, which wasn't officially discovered until around 1990.
    – tylerl
    Commented Sep 21, 2012 at 6:15
  • @tylerl and possibly still is They haven't been for decades. Universities have not only caught up, but greatly exceeded the amount of mathematicians being used for things like cryptography. It has been a long time since the NSA could boast that they hired the most cryptographers in the world. Now granted, many universities work on classified stuff, but so much of it is public that the secret work is dwarfed in comparison. They were certainly ahead of us in '75, but now?
    – forest
    Commented Jan 28, 2018 at 23:24

On the other hand, it could well be that such agencies have certain knowledges far ahead of the public. One example, if I don't err, would be the case of public key crypto, where the British agency kept their knowledge from the public for quite a time.


I'm not a professional cryptographer, however I can think of several reasons why the NSA would want to keep their algorithms secret.

  1. If an attacker has to guess how the algorithm works, that puts an enormous obstacle in their way.

  2. If the NSA published their algorithms, that would enable attackers to discover the bugs; one would assume that they have large teams of cryptographers that work hard to eliminate bugs. Public domain cryptgraphy has to rely on the publishing an algorithm so that the wider community can discover the bugs.

  3. The NSA may have discovered weaknesses in the some of the publicly available algorithms which they want to exploit. If they reveal their algorithms (which will not have such weaknesses), they might give clues about those weaknesses, or would allow attackers to avoid those weaknesses.

  4. The advice against "security through obscurity", I think is misunderstood. Security through obscurity is only problem when it is used on its own, or with an underlying algorithm that is weak. All cryptography is based on some degree of security through obscurity; the actual key used is obscured within a keyspace that is so large that it cannot be discovered by brute-force search within a resonable time-scale; the key cannot be calculated from the encrypted data because the algorithm makes the relationship too obscure. In a good algorithm, the obscurity is mathematically calculated and can be precisely defined.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .