Subject: Re: [TLS] EllipticCurveList is not expressive enough

From: "Jeffrey A. Williams" <[email-masked]>
Date: Thu, 29 Jul 2010 17:00:04 -0500 (GMT-05:00)

Dean and all,

  I believe your correct.  Further I am more than a bit
baffeled as to why NSA is taking this view and approach,
especially now.  Perhaps it is because that there is a fear
that they cannot decrypt something that some hacker has
encrypted without the keys.  If so, that is a good reason
to have fear, but a poor one IMO, to take this view/approach.

-----Original Message-----
>From: Dean Anderson <[email-masked]>
>Sent: Jul 28, 2010 8:54 PM
>To: Kyle Hamilton <[email-masked]>
>Cc: "[email-masked]" <[email-masked]>
>Subject: Re: [TLS] EllipticCurveList is not expressive enough
>
>:-)
>
>Wasn't it the NSA that told MS to compromise Windows security a while
>back? (unintentionally, of course--they just didn't think it all the way
>through)  I return you to your regular security-bashing.
>
>		--Dean
>
>On Mon, 26 Jul 2010, Kyle Hamilton wrote:
>> The NSA does not answer questions.  The NSA simply dictates what reality
>> shall be.  Yes, the Suite B profile really does need to be that strict,
>> because the NSA says that it needs to be that strict.  The Suite B
>> profile is the set of encryption and authentication schemes that the NSA
>> has deemed acceptable to encrypt classified data.
>
>
>-- 
>Av8 Internet   Prepared to pay a premium for better service?
>www.av8.net         faster, more reliable, better service
>617 256 5494
>
>
>
>_______________________________________________
>TLS mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/tls

Regards,

Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 294k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827

---

From: Kyle Hamilton <[email-masked]>
Date: Thu, 29 Jul 2010 18:08:44 -0700

> to have fear, but a poor one IMO, to take this view/approach.

Perhaps it is because there is fear that someone could be passing
nuclear technology to China or North Korea or any of our other opponents.

Remember, NIST Suite B is intended *explicitly* (not just implicitly,
but it has been spelled out as a core requirement) for the protection of
US Government Classified data.

For Microsoft, NSA has decided to allow them to sign arbitrary
Cryptographic Service Providers as long as they report every 6 months on
who they signed it for.

(Nice to see that you've added someone at NCSC.mil (which apparently has
a website, but I can't find out who it's registered to), the NIASC at
nsa.gov, and the NSA Public Affairs Office to the cc: list on this.)

-Kyle H