Your Cryptography Conspiracy Theory Is Wrong

This conversation plays out hundreds of times a day, but (thankfully) only a handful of those involve me:...

http://soatok.blog/2026/10/29/your-cryptography-conspiracy-theory-is-wrong/

@soatok Wait, I thought the original key size of DES was to be 64 bits?

@ryanc parity bits!

@soatok @ryanc it’s a silly thing to include, maybe made sense at the time but you could tell if it was corrupted by how the plaintext is gibberish

@soatok in retrospect, I suspect Dual_EC_DRBG was deliberately botched by the technicals after failing to persuade management that what they were asking for was wildly unethical and dangerous even by spy agency standards

@0xabad1dea @soatok now *that's* a conspiracy theory I can get behind.

@soatok Something I'd missed: the NIST P-curves problem being solved. https://words.filippo.io/seeds-solved/

@soatok I find this a really great story to tell folks who are overly wowed by "AI" claims, because while the bounty was claimed by Misanthropic, the only "AI" involved seems to have been telling their chatbot to do the brute-forcing harness to try different PRNGs from the time. This is utterly trivial work anyone could do without even having any specialized cryptography knowledge. Not "super-intelligence".

@soatok The real lesson from "AI" successes finding things like this is how much low hanging fruit there is out there to be found if people's curiosity were respected and fostered and if they were given the time and confidence to explore.

@soatok Love it! Your thesis here almost seems to be: The NSA is always up to some shit, but your conspiracy theories are all weak sauce. Learn your facts and conspiracy theory harder next time!

@0xabad1dea @soatok they unsuccessfully try to name it NSAEVL_DRBG

@ferrix @0xabad1dea Oh god I can't believe I forgot about NSAKEY

@soatok You're exaggerating about the Snowden disclosures, I recommend Electrospaces his blog about this topic:

https://www.electrospaces.net/2023/06/on-10th-anniversary-of-snowden.html

to quote the section about PRISM:

> The most controversial part of these stories was the claim that "the National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants", which those companies vigorously denied.

> That "direct access" was taken from one of the slides, but it's unclear why both Gellman and Greenwald stuck to the most simple interpretation of it. Fact is that they had access to the extensive accompanying speaker's notes, which clearly said: "PRISM access is 100% dependent on ISP provisioning".*

@soatok and also:

> In Dark Mirror, Gellman admits: "In retrospect, I do not love the way I wrote the [PRISM] story. I knew a lot less then than I learned later, with more time in the documents and many more interviews". A well-informed source told him that the systems of a company like Facebook are too complex to let the NSA plug in a cable. Only Facebook knows how to pull things out, which they can then hand over upon a valid request.* Google did that through secure FTP transfers and in person.

@soatok it's so funny the NSA is often portrayed as the all seeing eye while they were downloading files from some FTP server

@soatok I love that my ML-KEM myth busting blog post from a year ago is still more or less the last thing that needed to be said about ML-KEM backdoors. I've added some small updates since, but really no new arguments have emerged that would require addressing, despite the most active conspiracy theory peddlers being well aware of it.

@soatok This is a good article but one error I thought I would point out. You say:

"move the entire fucking federal government’s systems for TOP SECRET classified information to adopt it as fast as possible?"

This is largely wrong. Data that is marked TOP SECRET will use classified cyphers. It is unclassified civilian government data that will use these algorithms. (CSfC is a thing for TS but not the main way TS gets encrypted)

@Moore Thanks for the correction. As a non-gov hacker, these are the kinds of nuances I'm prone to fuck up lol

@Moore @soatok is this also true for asymmetric primitives? For symmetric it makes sense, but in the case of asymmetric the design space is much smaller and the possibility to fuck up in really dumb ways is much greater

@sophieschmieg @soatok I will answer this by pointing to this Wikipedia page https://en.wikipedia.org/wiki/NSA_Suite_A_Cryptography

@Moore @soatok thanks!

@soatok What I don't understand is, why is NIST and the NSA involved at all? Can't the non-US-government part of the cryptography community have conferences and standardization processes where they land on algorithms and recommendations? Why even put yourself in a position where you have to defend why NIST is being good guys *this time* when they could just be completely out of the picture? What you write is almost certainly correct but trusting NIST recommendations still leaves a bad taste

@mort We do that, it's called the IACR.

But science and standardization requires government money if not also government involvement.

@soatok @mort the other big reason is that it takes an enormous amount of expertise, experience, funding, and logistics to organize things like the NIST PQC competition.
There is simply not currently another organization that can run these things, at this quality at this point in time.
The NIST process is also so incredibly transparent that professional cryptographers for the most part don't see a reason to change it, it simply works and produces high quality results, different orgs would just create different conspiracy theories.

As for the NSA, they are not directly involved in the process. They do have a vested interest, just as e.g. the BSI, so they will keep active relationships within the community, and they do have substantial expertise, so we would be fools to dismiss them outright, just as we would be fools for trusting every word they're saying.

@soatok It's a double edged sword isn't it. You get lots of money dedicated to the effort, but then in the end you're left with a standard chosen by NIST and therefore won't be trusted by people who don't trust NIST.

@mort It's not that.

If one red cent of government money touches your bank account, conspiracy theorists go wild over it.

But good luck getting anything done without government or large corporations' funding!

@soatok @mort heck, there are conspiracy theories about the IETF, and the IETF isn't even funded by the government, as far as I'm aware!

@sophieschmieg @soatok @mort

@sophieschmieg @soatok @mort my current working hypothesis is that the number one thing that spawns conspiracy theories is using the phrase “no, you’re wrong” on someone with significantly more ego than competence.

@soatok There's a legitimate difference though, isn't there, between a non-government cryptography committee where various governments from around the world + private money funds the process, and a standardization process literally run by the US government? Even if some people would distrust both.

@mort Sure, but good luck telling that to the "NSA is a honeypot because it was funded by the DoD" clowns

@soatok One thing that stands out to me after reading this... on the topic of NOBUS, if the NSA has a quantum computer in the Utah datacenter capable of (or theoretically capable of) cracking any existing encryption today, wouldn't it be NOBUS to *not* support the widespread adoption of genuine quantum-resistant cryptography? If you have an advantage, it seems strange to undermine it.

On the other hand, if they built one, other nation-states could too, so it benefits them to have a level of encryption that can resist it. So at the very least, it suggests the NSA isn't confident in their ability to create one in secret, since they are adopting the public standard that they didn't create. And if they *don't* have that advantage, but believe it's possible, it makes perfect sense that they'd want to help create something which they can use to protect themselves from it, and if that means everyone else gets it, that's fine too.

@soatok Also, all of these conspiracies assume that people would otherwise be using flawless cryptographic design, and history has shown this is not at all the case.

There are scores of unaudited, closed-source programs with names like "Dave's Excellent Encryption (Free Trial)" out there. Anyone who doesn't know what they're looking for can easily stumble into using a program that just uses Vigenère's cipher, or worse.

@soatok (I may have, as a teenager, written an "encryption" program that was mostly a slight variant of Vigenère's cipher. I wish I still had it, I'm sure it would be a great CTF challenge.)

@curtmack With a long enough key, Vigenere ciphers are fine ;p