<story><title>Some new snippets from the Snowden documents</title><url>https://www.electrospaces.net/2023/09/some-new-snippets-from-snowden-documents.html</url></story><parent_chain><item><author>neilv</author><text>&amp;gt; &lt;i&gt;&amp;quot;How do they accomplish their goals with project BULLRUN? One way is that United States National Security Agency (NSA) participates in Internet Engineering Task Force (IETF) community protocol standardization meetings with the explicit goal of sabotaging protocol security to enhance NSA surveillance capabilities.&amp;quot; &amp;quot;Discussions with insiders confirmed what is claimed in as of yet unpublished classified documents from the Snowden archive and other sources.&amp;quot; (page 6-7, note 8)&lt;/i&gt;&lt;p&gt;There&amp;#x27;s long been stories about meddling in other standards orgs (both to strengthen and to weaken them), but I don&amp;#x27;t recall hearing rumors about sabotage of &lt;i&gt;IETF&lt;/i&gt; standards.</text></item></parent_chain><comment><author>tptacek</author><text>These rumors, about IETF in particular, predate the Snowden disclosures.&lt;p&gt;Almost immediately after that happened, a well-known cypherpunk person accused the IETF IPSEC standardization process of subversion, pointing out Phil Rogaway (an extraordinarily well-respected and influential academic cryptographer) trying in vain to get the IETF not to standardize a chained-IV CBC transport (this is a bug class now best known, in TLS, as BEAST), while a chorus of IETF gadflies dunked on him and questioned his credentials. The gadflies ultimately prevailed.&lt;p&gt;The moral of this story, and what makes these &amp;quot;NSA at IETF&amp;quot; allegations so insidious, is that the IETF is perfectly capable of subverting its own cryptography without any help from a meddling intelligence agency. This is a common failure of all standards organizations (W3C didn&amp;#x27;t need any help coming up with XML DSIG, which is probably the worst cryptosystem ever devised), but it&amp;#x27;s somewhat amplified in open settings like IETF.</text></comment>
<story><title>Some new snippets from the Snowden documents</title><url>https://www.electrospaces.net/2023/09/some-new-snippets-from-snowden-documents.html</url></story><parent_chain><item><author>neilv</author><text>&amp;gt; &lt;i&gt;&amp;quot;How do they accomplish their goals with project BULLRUN? One way is that United States National Security Agency (NSA) participates in Internet Engineering Task Force (IETF) community protocol standardization meetings with the explicit goal of sabotaging protocol security to enhance NSA surveillance capabilities.&amp;quot; &amp;quot;Discussions with insiders confirmed what is claimed in as of yet unpublished classified documents from the Snowden archive and other sources.&amp;quot; (page 6-7, note 8)&lt;/i&gt;&lt;p&gt;There&amp;#x27;s long been stories about meddling in other standards orgs (both to strengthen and to weaken them), but I don&amp;#x27;t recall hearing rumors about sabotage of &lt;i&gt;IETF&lt;/i&gt; standards.</text></item></parent_chain><comment><author>fidotron</author><text>Just a concrete example of that time we know the NSA actually did their job properly:
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Data_Encryption_Standard#NSA&amp;#x27;s_involvement_in_the_design&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Data_Encryption_Standard#NSA&amp;#x27;s...&lt;/a&gt;</text></comment>