Business folks riding the hype train? Maybe.

HAWK is a signature algorithm, not encryption.

While your point is valid on its own merits, it isn't relevant here.

Start with the outcome you believe will be the most in line with the spirit and traditions of the open source community. This is precisely what won't happen.

It won't necessarily be the inverse. It could be, of course, but it's also likely to be a compromise between the two.

For a topical example: The companies doing "AI" layoffs aren't doing so out of a sense of having failed their staff that helped carry them so far. Often, these announcements come on the heels of record-breaking profits. They're doing it out of contempt for workers.

See https://www.cnet.com/tech/services-and-software/cory-doctoro... for Doctorow's take on centaurs vs. reverse centaurs. Broadly speaking: C-suite business leadership wants reverse centaurs. Workers want centaurs. Unless you have a union (or some other collective bargaining power structure that I'm not aware of), the C-suite calls the shots.

The same can be said of the current administration. They don't give a fuck what most of us want on any given issue. They're captured by an aggressive ideology. Their only incentive is to be able to spin their decision to make themselves look good; to posture as "strong" leadership.

Comments URL: https://news.ycombinator.com/item?id=48846731

Points: 9

# Comments: 0

That's beyond moving goalposts. Just take the L, dude.

Would you indict NIST MEP https://www.nist.gov/mep/about-nist-mep as being an NSA project without evidence?

Incorrect. My argument is that they aren't the same entity.

The thing you said is a whole different argument. "I like waffles" "So you hate pancakes" is happening.

> Incentives are basically all I consider when trying to establish true motive. But you're not required to consider motive when there's a history or pattern.

Yes you are. You need to consider both factors. Why render yourself willfully ignorant? That's not how you arrive at truth.

They made DES more secure against differential cryptanalysis (a method that was classified at the time DES was being designed). Sure, the whole "make the keys 56-bit instead of 64-bit" is a weakening, but differential cryptanalysis would have broken the entire fucking cipher if they didn't prevent it by selecting a secure S-box.

> The NSA pushed backdoored design of Dual_EC_DRBG was standardized in NIST SP 800-90A.

Correct, which another threat actor used in a backdoor by replacing the public key.

I'm not arguing that NIST isn't vulnerable to NSA influence. I'm arguing that they are not the same entity and do not have the same goals or incentives.

I'm not an NSA defender. https://furry.engineer/@soatok/116854899284071513

NIST isn't the NSA and doesn't have the NSA's goals in mind. They are briefed by NSA on some matters, sure, but they're not the same organization.

NSA has a dual mission: Both SIGINT and COMINT. While the SIGINT folks might rub their hands and laugh evilly at the prospect of backdooring the PQ KEM that the Internet wants to move towards, this plot makes no sense at several levels.

The NSA has, through CNSA 2.0, committed to moving the entire federal government onto ML-KEM for top secret communications. The COMINT guys would shit themselves in rage if it turned out to be backdoored, even if there was enough hubris that the backdoor was NOBUS.

If you can't trust the people, you should always seek to understand their incentives if you want to predict their behavior.

My interpretation of the CNSA 2.0 move was that the NSA believes 1) that ML-KEM is actually the good stuff, and 2) the Suite B transition failed so spectacularly that they want to signal confidence in ML-KEM by recommending it without hybridization. Since pretty much everything they do is top secret, they probably can't comment further.

I wrote at length about this debate in my blog post about threat modeling: https://soatok.blog/2026/06/30/soatoks-informal-guide-to-thr...

Supoose we're trying to decide between two services for a long term group chat.

Service A, on the server-side, sees all messages, in plaintext, sent to/from all participants--including other servers. It can log it indefinitely. It sees the whole social graph. Some servers have no k-anonymity (self-hosted, single user), some have thousands of users. They're all over the world, including in jurisdictions the NSA's TAO can operate.

Service B can only see IP addresses and ciphertext. There's only one real 'server", but it has millions of users and the encryption is widely reputed by experts. Its servers happen to be hosted on American cloud providers.

By firmly disagreeing with the linked post, you are saying you prefer Service A on the matter of privacy, only because of the jurisdiction.

Is that really the hill you choose?

Hybrids obviously help if you believe Q-Day is far into the future, or never coming.

But if you take Q-Day happening as possible in our lifetime, the HNDL threat means data being encrypted today depends entirely on PQ security in the long run (since breaking EC with a Quantum Computer has an attack cost of like 2^30 or so instead of 2^120 or so).

My dayjob involves a lot of code review and protocol cryptanalysis, so I agonize quite a bit there.

My blog would be less fun if I maintained the same level of rigor. If that makes any sense. ^^;

Just now. In an HN comment.

I write in conversational English. I'm not always going to meticulously write everything like a formal argument might.

If you didn't understand that what I wrote later in a blog post was predicated on an assumption established in the intro, but would have if I wrote an explicit transitional sentence, that's useful feedback. But if you're treating an informal blog post like a court filing, you might be setting yourself up for disappointment.