I prefer bcrypt because it uses a lot of "power" to decrypt.

But which encryption can i use that is most likely safe for NSA (which knows a lot of backdoors) and is relatively slow to decrypt.

I know RSA advised against their default encryption, which is developed partially by the NSA, here are other "unsafe" encryption methods who use elliptic-curve based encryption (pushed by the NSA off course):

  • Crypto-C ME,
  • Micro Edition Suite,
  • Crypto-J,
  • Cert-J,
  • SSL-J,
  • Crypto-C,
  • Cert-C
  • SSL-C

So which ones are (presumably) safe and which aren't...?

Update: Some people seem to think that this answer is subjective. But objective facts like : is not made in the USA, isn't popular.. aren't subjective.

The examples above, are also examples that the NSA really helped with, so have a high chance of containing a backdoor..

I know there is no answer that is absolutely correct, but there are multiple valid factors to consider in answering this question. For example, would the NSA choose an encryption they know they have backdoored, what do they use? Someone else could discover the backdoor and breach the security of the NSA.

closed as primarily opinion-based by Lucas Kauffman, Xander, Adi, user2213, TildalWave Sep 20 '13 at 14:19

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. – Lucas Kauffman Sep 20 '13 at 11:30
  • 1
    Nico, still try to use the cr.yp.to's NaCL library by Daniel J. Bernstein: nacl.cace-project.eu; report. It uses EdDSA on Curve25519, and Salsa20 instead of AES. It is safe to use SHA, because SHA is not a crypto but a hash (one-way, not-keyed function). Daniel claimed that there are no side channels in his implementation. – osgx Sep 20 '13 at 11:30
  • We don't know. NIST elliptic curves are slightly dubious, but even for them we don't have any concrete evidence. For AES, RSA or other elliptic curves we have no reason to believe that they're backdoored. I expect most vulnerabilities at a higher level e.g. implementation bugs in a PRNG or in a complex protocol like SSL. – CodesInChaos Sep 20 '13 at 11:31
  • 1
    @osgx If you want to use a NaCl like library, I'd rather go with LibSodium, mostly the same code but easier to compile. – CodesInChaos Sep 20 '13 at 11:32
  • 1
    I'd worry far more about making a design mistake in your own code that builds on the cryptographic primitives rather than a backdoor in the primitives themselves. The only low level part I really mistrust is the CSPRNG, it's really hard to see if they're seeded and implemented correctly. – CodesInChaos Sep 20 '13 at 11:39

what's your favorite algoritm to use? the cr.yp.to's NaCL library?

I think, that using algorithm made not in USA may be safer, or using not so popular rather than most popular like AES. With this idea using of NaCL/LibSodium may look as good choice (even if we know that DJB is US citizen; but he says there are no most side channels in his lib).

You can try candidates from AES round 2 (not only the Rijndael, but also Serpent or Twofish), or something from japanese CRYPTREC or european NESSIE or ECRYPT/eSTREAM.

You may also use crypto made in Russia (sure, there will be no backdoor from NSA, but there can be backdoor from KGB):

And, as I already mentioned in comments, you can try to combine several crypto together trying to get more security against backdoors.

For symmetrical cipher you may setup this chain: firstly use Salsa20, then reencrypt data with XXTEA and then - by AES. You even can do similar thing to asymmetrical algorithms. For example when you should transmit short secret key to somebody using his public keys, you and he may use several public-key algos: NTRUEncrypt, some ECC-based RSA and prime field based RSA. How can you combine them? Generate some rather long random key (300 bytes or more), split it into 3 parts, send each part with some algo; then you and receiver can combine parts together, compact them using any hash-sum (HMAC, PBKDF2, or just SHA512 of all parts) and use part of this hash sum as master key to encipher you highly-valued alkaida plans.

Even if 1 or 2 algos from chain will be breaked by backdoor... Oh, wait...

You can't use any random number generator because you can't believe in them.. There are real plans for converting Intel Ivy's hardware good-designed hardware PRNG into flawed generator with 2*32 - 2*40 period - NSA can change just two masks to put trojan here:

In this paper we introduced a new type of sub-transistor level hardware Trojan that only requires modication of the dopant masks. No additional transistors or gates are added and no other layout mask needs to be modied. Since only changes to the metal, polysilicion or active area can be reliably detected with optical inspection, our dopant Trojans are immune to optical inspection, one of the most important Trojan detection mechanism.

This trojan RNG is undetectable for Chipworks (cut the chip and look on transistors) and everybody from outside world. Intel uses HW PRNG to get raw data and then they encrypt data using some fixed AES key. You don't know the key from the Trojan, and EVERY test for PRNG (NIST and other) will be passed - because output of AES is tested. But Intel and NSA, who knows the key, will restore all random data generated from this PRNG in small number of operations.

.. So, you can't use single PRNG. Use several, both HW and SW (or even measure white noise with fast ADC) and then XOR them together. You may add encryption after XORing to get better random.

When you use several algorithms, and one or two are broken, you will have the third.

  • 1
    DJB is American, so that's not an argument for NaCl. – CodesInChaos Sep 20 '13 at 12:25
  • Actually, you should add you're answer of chaining encryption methods. – NicoJuicy Sep 20 '13 at 16:38
  • 2
    KGB? Does not exist any more since the collapse of the Soviet Union in 1991. ;) – TildalWave Sep 20 '13 at 23:14
  • TildalWave, Do you really believe? There were archives of KGB and there were scientists from KGB and they do exist, as do all backdoors implemented by them... – osgx Sep 20 '13 at 23:21
  • The KGB may no longer exist, but if they built backdoors into the algorithm then those backdoors will still exist, and no doubt be known to the FSB. – James_pic Jul 11 '16 at 10:50

Assume that I tell you:

Yeah, that library is safe and not backdoored by the NSA

then would you trust it ? After all, it was guaranteed safe by "some guy on the Internet who uses a plush teddy bear for his face". Cannot get better than that !

(Trust is at the root of the whole business. Making sure that a given system is free of backdoors is, ultimately, as unsolvable as your question is unanswerable.)

  • "Cannot get better than that!" Agreed. – Ayrx Sep 20 '13 at 12:09
  • 2
    +1 - I agree with this sentiment; though your statement can't be proven, it can be disproven. If you said its safe to use: MD5, WEP, WPA with WPS, or 2008 Debian OpenSSL, someone could present a counterargument. MD5 is broken against collision attacks; or WEP only provides 40 bits of security or WPA with WPS can be bruteforced in under 11000 guesses or 2008 Debian OpenSSL with poor random number seeding. – dr jimbob Sep 20 '13 at 12:42
  • But you could consider arguments that win the answer. Eg. chaining encryption methods or encryption methods that are created outside of America, based on published research outside of America, ... just a thought. – NicoJuicy Sep 20 '13 at 16:39
  • 1
    @NicoJuicy If you think the NSA is the only government agency undermining crypto, you're very naieve. France, UK, Germany, Russia, China, and many others have all the resources and motivation to pull similar tricks on their own citizens. They also have a demonstrated track record. The government of France is basically responsible for the horrible mess that is mobile phone network encryption, for example. – rmalayter Oct 16 '13 at 15:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.