On 16/11/10 9:52 AM, Paul Hoffman wrote:
At 9:21 AM +1100 11/16/10, Ian G wrote:
It used to be said that the NSA employed more mathematicians than the rest of
the world put together. This was sort of a comment on their dominance in
cryptography. Is this factoid still the case?
And, could it be said that the NSA employs more IT Sec people than anyone else?
I'm trying to come up with some sort of view as to how leading or powerful the
NSA's influence is on the infosec world. For example, they are currently
pushing out the humble 1024 bit RSA key (via their open partner NIST).
NSA !!= NIST
:)
The NSA has a stated goal to get more people to use Suite B, which does not include RSA
of any key size. NIST is pushing for larger RSA key sizes, while making Suite B an
"option".
You and I have both been in the business long enough to see why that is.
When the NSA walks into the room and says, "from now on EC is the way
to do things," well .. we all know that RSA is dominant, and they'd be
better be thinking decade++ timeframes with liberal doses of patience.
From that long term business perspective, NIST and NSA are walking
hand-in-hand here. NIST is talking to the vast majority who are just
using stuff downloaded from the net. NSA are talking to the smaller
minority that have to meet heavy compliance over crypto. Whatever the
merits of NSA's view on ECC, this marriage speaks to two audiences.
In this case, the documentation clearly states it is for USA government
agencies only, but it seems open players like Mozilla with completely different
security agendas are tripping over themselves to follow NSA's guidance.
I don't see Suite B in Mozilla products yet.
Yeah, see above. It's easy to express an opinion on 1024 and 2048.
It's a whole other ball game to talk elliptic curves over RSA in
internet protocols.
As an illustrative observation, it's only in the last year or two that
the net community has woken up to the fact that we need to get MD5 out
of the protocols... After how much warning? 15 years?
iang
_______________________________________________
cryptography mailing list
[email protected]
http://lists.randombit.net/mailman/listinfo/cryptography
