本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Your Cryptography Conspiracy Theory Is Wrong

This conversation plays out hundreds of times a day, but (thankfully) only a handful of those involve me: Person: “I have [problem].” Cryptography nerd: “Oh, you probably want to use [sensible recommendation].” Person: “Ah, well, can I really trust that? The NSA probably backdoored it 30 years ago. Dual_EC, amirite?!” Cryptography nerd: … Koblitz and Menezes, unheard: “You fucking wot m8?“

这种对话每天都会发生数百次，但（谢天谢地）只有少数几次涉及我：某人：“我遇到了[问题]。”密码学极客：“哦，你可能想用[合理的建议]。”某人：“啊，好吧，我真的能相信那个吗？NSA 大概 30 年前就留了后门吧。Dual_EC，对吧？！”密码学极客：…… Koblitz 和 Menezes 没听见地说道：“你他妈在说什么？”

Conspiracy theories about the NSA and/or NIST are a dime a dozen these days. And, ever since the Snowden disclosures in 2013, I am politically primed to directionally agree with distrusting the US government wholesale. But most of the technical arguments baked into folks’ conspiracy theories make no goddamn sense. This distrust is not exclusive to only the US government. The goal of this blog post is not to convince you that you should trust any government; just that they are not magical or omniscient.

如今，关于 NSA 和/或 NIST 的阴谋论多如牛毛。而且，自 2013 年斯诺登披露事件以来，我在政治上倾向于完全不信任美国政府。但人们阴谋论中包含的大多数技术论点根本说不通。这种不信任并不局限于美国政府。这篇博文的目的不是要说服你相信任何政府，只是想说明他们并非无所不能或全知全能。

To that end, I’m going to explore some of the history of NSA, NIST, and cryptography standardization. Then, to explore some of the conspiracy theories that were being floated about such activity, and what we’ve learned in the years since (especially in the past month). Finally, I’m going to examine some of the current conspiracy theories floating around message boards and social media today, and explain why they’re almost certainly wrong. Buckle up, this is going to be a tedious one. CMYKat

为此，我将探讨 NSA、NIST 和密码学标准化的一些历史。然后，探讨一些关于此类活动的阴谋论，以及这些年来（尤其是过去一个月）我们所了解到的情况。最后，我将审视当今在留言板和社交媒体上流传的一些当前阴谋论，并解释为什么它们几乎肯定是错误的。系好安全带，这会是一篇枯燥的文章。CMYKat

Why should we listen to you? If you find yourself asking a question like this, the correct answer is simply, “You shouldn’t.” After all, I have never held (let alone even applied for) a security clearance, and have no access to any non-public information. I’m also not a current or former government employee, and have no aspirations to ever become one. I have access to all the same facts anyone else does. In balance, I have no horse in the race of who trusts whom. I’m just tired of hearing the same poorly reasoned arguments all the damn time, and would like to stop having to repeat myself when I encounter one.

为什么要听你的？如果你发现自己问了这样的问题，正确的答案很简单：“你不应该听。”毕竟，我从未持有（更不用说申请过）安全许可，也没有接触过任何非公开信息。我也不是现任或前任政府雇员，也没有志向成为其中一员。我能接触到的事实和任何其他人一样。总而言之，谁信任谁与我无关。我只是厌倦了总是听到同样论据不足的争论，当再次遇到时，我不想再重复自己了。

Historical NSA Shenanigans. The sources for this, by the way, are the declassified United States Senate Select Committee on Intelligence and United States Cryptologic History. DES. No, not that DES. The Data Encryption Standard (DES) was published in the Federal Register in 1975 and then standardized in 1977. We consider it weak these days, but DES was a real game-changer for its time: It offered a standard block cipher to use for sensitive (but not classified) commercial applications. Prior to DES, the history of cryptography was largely about military uses (except a few quirky mathematicians here and there), going back before Caesar’s cipher.

NSA 的历史性恶作剧。顺便说一下，这些资料来源是解密的美国参议院情报特别委员会文件和《美国密码学史》。DES。不，不是那个 DES。数据加密标准 (DES) 于 1975 年在《联邦公报》上发布，并于 1977 年标准化。我们现在认为它很弱，但在当时，DES 确实改变了游戏规则：它提供了一种用于敏感（但非机密）商业应用的标准分组密码。在 DES 之前，密码学的历史主要与军事用途有关（除了少数古怪的数学家），其历史可以追溯到凯撒密码之前。

From declassified documents, we now know the full story, but from the time that DES was first standardized, up until recent years, there have been a concerns about NSA’s involvement. We sent the S-boxes off to Washington. They came back and were all different. Alan Konheim, quoted in Applied Cryptography, p. 280. To say that academics did not trust DES would be putting it mildly: Martin Hellman (who, with Whitfield Diffie and Ralph Merkle, invented public-key cryptography) sent a letter in 1975 to the National Bureau of Standards that stated: Whit Diffie and I have become concerned that the proposed data encryption standard, while probably secure against commercial assault, may be extremely vulnerable to attack by an intelligence organization. Martin Hellman, re-published in this paper in 1990.

通过解密文件，我们现在知道了全部真相，但从 DES 首次标准化到最近几年，人们一直对 NSA 的参与感到担忧。“我们将 S 盒送到华盛顿。它们回来时全变了。”Alan Konheim 在《应用密码学》第 280 页中如是说。说学术界不信任 DES 还算客气的：Martin Hellman（他与 Whitfield Diffie 和 Ralph Merkle 一起发明了公钥密码学）在 1975 年致信国家标准局，称：“Whit Diffie 和我开始担心，拟议的数据加密标准虽然可能对商业攻击是安全的，但可能极易受到情报机构的攻击。”Martin Hellman，1990 年在本文中重新发表。

At the heart of the concern about DES was something called an S-box, which simply maps an input to an output, but whose purpose is to provide a non-linear transformation to obscure the relationship between the ciphertext and the key. The S-box used by DES was chosen by NSA. This led a lot of people to suspect there was a backdoor in the selection of the S-boxes for DES. It turned out to be the opposite, of course: The NSA had discovered differential cryptanalysis in secret, and had selected S-boxes that were resistant to this technique, but did not want to reveal it publicly (lest they lose their advantage over rival nations).

对 DES 的担忧核心在于一种称为 S 盒的东西，它只是将输入映射到输出，但其目的是提供非线性变换，以掩盖密文和密钥之间的关系。DES 使用的 S 盒是由 NSA 选择的。这导致许多人怀疑 DES 的 S 盒选择中存在后门。当然，事实恰恰相反：NSA 私下发现了差分密码分析，并选择了能够抵御这种技术的 S 盒，但他们不想公开（以免失去对竞争对手国家的优势）。

There’s a lot more details to this story than I want to bore anyone with, so I recommend reading up on the history of cryptography and cryptanalysis if you’re interested in such things. In balance, at the advice of NSA, the final DES design did only offer 56 bits of security (down from an original key size of 128 bits). This short key ultimately allowed the EFF to crack DES in 1998 with a hardware cost of about $250,000. CMYKat

这个故事的细节比我想让大家感到厌烦的要多得多，所以如果你对这些事情感兴趣，我建议阅读密码学和密码分析的历史。总而言之，在 NSA 的建议下，最终的 DES 设计仅提供了 56 位的安全性（从最初的 128 位密钥大小下降）。这个短密钥最终使电子前沿基金会 (EFF) 在 1998 年以约 25 万美元的硬件成本破解了 DES。CMYKat

What does this actually tell us? When IBM was designing DES, with feedback from NSA, the stated purpose was to use for commercial cryptographic applications in the United States. Fact: NSA used secret cryptanalytic capabilities to ensure the resulting block cipher that became DES was protected from the attack they knew about without revealing said technique. Fact: NSA recommended reducing the key length from 128 bits to 64 bits (with 8 of the key bits serving as parity bits, thus making it only have 56-bit security). This both strengthened and weakened DES in different ways. A 56-bit key can be broken by a distributed computing effort in under 24 hours, as of 2012. DES’s 56-bit keys are at the heart of Moxie’s MSCHAPv2 break.

这实际上告诉了我们什么？当 IBM 在 NSA 的反馈下设计 DES 时，其既定目的是用于美国的商业密码应用。事实：NSA 利用秘密的密码分析能力，确保最终成为 DES 的分组密码能够抵御他们所知的攻击，而无需透露该技术。事实：NSA 建议将密钥长度从 128 位减少到 64 位（其中 8 位密钥位用作奇偶校验位，因此仅具有 56 位安全性）。这以不同的方式既加强又削弱了 DES。截至 2012 年，56 位密钥可以在 24 小时内通过分布式计算破解。DES 的 56 位密钥是 Moxie 破解 MSCHAPv2 的核心。

This is confusing until you remember NSA has two opposing missions, with (unfortunately) military jargon names. COMSEC (Communications Security) — basically blue-teamers. SIGINT (Signals Intelligence) — basically red-teamers. The COMSEC folks have a mission to secure the US government and protect US interests (read: private sector). The SIGINT folks have a mission to spy on other nations on behalf of the US. In theory, the SIGINT folks aren’t supposed to spy on Americans at all. In practice, their Five Eyes partners gives them a stupid loophole: An allied nation can simply do the spying for them, so long as federal prosecutors are willing to engage in a little bit of parallel construction. Take note of the DEA section o

这令人困惑，直到你记住 NSA 有两个相互对立的任务，它们（不幸地）带有军事术语名称。COMSEC（通信安全）——基本上是蓝队。SIGINT（信号情报）——基本上是红队。COMSEC 人员的任务是确保美国政府安全并保护美国利益（即：私营部门）。SIGINT 人员的任务是代表美国监视其他国家。理论上，SIGINT 人员根本不应该监视美国人。实际上，他们的“五眼联盟”伙伴给了他们一个愚蠢的漏洞：盟国可以代他们进行监视，只要联邦检察官愿意进行一点点“平行构建”。注意 DEA 部分 o