25 votes

The inability to count correctly: Debunking the US National Institute of Standards and Technology's calculation of the cryptographic security level of Kyber-512

2 comments

  1. R3qn65
    (edited )
    Link
    He writes that I couldn't find any of this during my internet searches. It's possible, of course, that I'm simply not looking in the right places. I found some stuff like this: Which doesn't...

    He writes that

    Public material regarding Kyber-512 already shows how NIST multiplied costs that should have been added, how NIST sabotaged public review of this calculation, and how important this calculation was for NIST's narrative of Kyber outperforming NTRU, filling a critical gap left by other steps that NIST took to promote the same narrative.

    I couldn't find any of this during my internet searches. It's possible, of course, that I'm simply not looking in the right places. I found some stuff like this:

    The experiments show that, for Kyber-512 and 768, the failure probability resulting from the original paper is relatively conservative...

    Which doesn't support the original blog necessarily.

    I know djb is prominent in the field, but I think he might be looking for malice (he really doesn't like the US government.)

    Edit: of course, it's also possible that he's totally right and is just the first to recognize this. Look forward to seeing if this is a story that develops.

    9 votes
  2. spit-evil-olive-tips
    Link
    DJB gives a very thorough (yet still accessible to non-cryptographers such as myself) walk-through of a pretty basic math error NIST made as part of their standardization process for post-quantum...

    DJB gives a very thorough (yet still accessible to non-cryptographers such as myself) walk-through of a pretty basic math error NIST made as part of their standardization process for post-quantum cryptographic algorithms

    5 votes