Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Who in their right mind would trust anything NIST offers considering Dual DRBG EC? Best bet is to use many entropy sources including local hardware (ie sound card audio input) mixed in a fortuna entropy pool.


They explicitly say do not use it for crypto.

A public source of random numbers is useful in almost all the fields mentioned in [1].

[1] http://en.wikipedia.org/wiki/Pseudorandomness


The metrology folks at NIST are top notch. I think they have been awarded four Nobels in physics in the last twenty years.


Unfortunately, that attests greatly to their credentials and precisely nil to their trustworthiness. For all we know there are NSL gag orders in effect.


I am not sure what you are talking about. Do you know what metrology is?

If there is a NSL gag order in effect for the work recognized by the 2012 Physics Nobel how did the committee hear about the work? You think the scientific community just took Haroche and Wineland's word and never looked into their results?


Please, allow me to paraphrase 'pg: pedigree is for suckers.

These data points have absolutely nothing to do with practical, trustworthy crypto standard processes or confidence in their ability to due-diligence systems.


Please allow me to paraphrase dfc, "confusing metrology with crypto is for suckers."

To recap; you started this thread with "Who in their right mind would trust anything NIST offers." I responded by pointing out that there is a very talented group of people working on metrology at NIST and that some of these individuals have been awarded Nobels. What is the connection between trustworthy crypto standards and metrology?


Maybe you're not reading the same words...

Nobel snobels, still has nothing to do with crypto.

Thank you for arguing my original position for me.


You did not limit your criticism to the crypto group at NIST. Your comment was about "anything" that came out of NIST. I am not sure how I argued your original position by saying that the metrology work that comes out of NIST is top notch. How did I support your claim by arguing and presenting evidence of the opposite?


You presented my argument in argumentative manner as something different. None of this has nothing to do with NIST's reputation for evaluating crypto systems and guiding standards. So please give up trying to say how great their weighs and standards are, because again, a Nobel in physics has nothing to do with crypto.


I just read the bit in your profile about wanting to get to zero karma in 2014. It never occurred to me I was an unwitting conspirator in your race to the bottom. Had I known this I never would have "presented [your] argument in argumentative manner."


Ad hominem attacks and claims of moral superiority also have nothing to do with NIST allowing Dual EC DRBG to be backdoored and this entropy source being suspicious.


I don't know why you'd accuse a source of public randomness of having a backdoor. It has a front door.


Yeah, they've burned almost all of their trust by acquiescing tech leadership to NSA agenda.

Further, weights and crypto are night and day. I'm sure they have the best clocks and reference weights, but everything that comes out of that shop is tainted.


What should we do with UTC? Petition OBSPM to stop including NIST measurements in the calculation of UTC? Should we include USNO in the list of "tainted clocks"? Things are going to start to get crazy when you factor in GPS.


Spurious red herring... the OP topic is crypto / CSPRNGs.


The OP topic is crypto? Is the OP crypto topic your blanket rejection of anything that comes from NIST or the link with:

           WARNING:
  DO NOT USE BEACON GENERATED
       VALUES AS SECRET
      CRYPTOGRAPHIC KEYS.


Or that because it comes from NIST I should trust it because some unrelated persons have won awards. Let's not forget a likely backdoor that was either consented to, or worse, permitted with extreme incompetence. [0]

Do you work for NIST or NSA? Just curious.

[0] http://blog.0xbadc0de.be/archives/155


Gag orders for fucking metrology? Does the NSA really, really want everybody to slightly underestimate how much things weigh? Is it part of a diabolical conspiracy to take over the world by the accumulation of tiny measurement errors?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: