# Has this forum been compromised by the NSA BULLRUN program?

Today, this site shows 24 thousand users in Cryptography. It runs in parallel with and is associated with StackOverflow boasting 6 million users. This site then clearly creates some leverage and impact for the cryptographic community, with the power to influence and shape minds. It can then somewhat shape the nature of cryptography in general.

I suspect that most users have not met each other, and probably use ids unique to this site so cannot be otherwise tracked in the wider Interweb. I realise that some people do post under their real names. There is also no vetting or background checking of new users. Anyone can join with a made up id and fake email address. They can then shape discussions and steer advice towards certain individualistic goals.

Even with my limited cryptographic knowledge, I perceive certain forces trying push agendas. It seems to me that there is a subtle movement towards certain approved cryptographic primitives and protocols. Rather than encouraging cryptographic diversity, there seems to be a drive towards a mono culture with all the adherent risks. Potatoes turned out poorly for the Irish. I suggest that AES be a similar contemporary potato for example. I can't tell, but as another example, there might be similar steerage with elliptic cryptography.

Since this is an issue of security, privacy and data protection, what is the probability that this site falls within the scope of the NSA Bullrun program? Are there any steps that Stack Exchange can take to mitigate the possible risk posed by intelligence agents / contractors steering this community? Hundreds of millions of dollars buys many internet café postings and online identities. There's some appropriate quotation about more things in Heaven and Earth...

I ask this specifically here as this is the only Stack Exchange site that a government would care about. It is a perfect target for counter intelligence programs. I also see this question as too important for Meta as it strikes directly at the heart of everything posted here.

## migrated from crypto.stackexchange.comJun 11 '16 at 3:39

This question came from our site for software developers, mathematicians and others interested in cryptography.

• Interestingly enough, I have been accused of being an intelligence agency plant for suggesting one use the NSA designed SHA512 instead of some other brand new hash function – Richie Frame Jun 11 '16 at 0:02
• Why bother? This site is overwhelmingly focused on algorithms and primitives, instead of where the real vulnerabilities are. The lowest hanging fruit of exploitable vulnerabilities are in how those primitives are implemented, and the complex protocols, systems, and people that they are embedded in and used by. Why bother 'steering the conversation' here when the conversation here is irrelevant and/or harmless? – J.D. Jun 11 '16 at 1:38
• @RichieFrame So why did you suggest it? – Paul Uszak Jun 11 '16 at 2:08
• @J.D. In my short time here, this site is NOT focused entirely on algorithms and primitives. Far from it. There is a strong "steer" towards telling people what they should /should not use. I've seen users warned off rolling their own TRNGs, using one time pads and writing their own encryptions. There appears to be an orthodoxy that is not seen in other IT forums. If I run a business and want to use triple Whirlpool wrapped around an Enigma machine, few here would countenance it. Why not? Would you tell McDonalds how to fry burgers? We'd tell them to use AES though. – Paul Uszak Jun 11 '16 at 2:23
• You are focusing on algorithms and primitives exactly like the rest of this site - i.e. should you use AES or OTP, should you roll your own TRNG or use Fortuna, should you use this hash function or that - these are all questions about which primitives and algorithms to use. Worrying too much about such matters while neglecting the far greater risks of implementing and using those primitives in a complex system is a little like obsessing over what kind of fancy lock to install in your front door when all your windows are wide open and the walls are made of tissue paper. – J.D. Jun 11 '16 at 2:36
• I had made a suggestion of a construction I would be more comfortable with, as many well reviewed problem free implementations exist, and the algorithms are well understood and have stood up to intense scrutiny for a very long time. The problems inherent to MD hashes were not an issue for the construction. – Richie Frame Jun 11 '16 at 5:17
• We need a new tag: tinfoil-hat – cygnusv Jun 14 '16 at 15:54
• I was recently framed as from GCHQ, for pushing the convenience of asymmetric cryptography using certificates rather than undulterated Quantum Key Distribution; blast, my evil plan is foiled! – fgrieu Sep 22 '17 at 20:26
• @fgrieu But do you realise how ironic your comment is? You're championing certificates vs. independent quantum cryptography, yet Verisign will immediately issue 100 fake certificates when a National Security Letter lands on their desk. And you're actively supporting the system that allows this to happen. You're playing directly into the NSA's hands, deliberately or otherwise. Democracy should be hard and inconvenient. Oppression is easy. – Paul Uszak Sep 22 '17 at 21:27
• @Paul Uszak: Like you, and most sensible persons, I do not trust the general CA hierarchy. Clearly, so many people can forge a certificate, and get away with it, that this green lock shown by my browser on top of this page must be considered breakable by competent or well-introduced adversaries. But I do not dismiss all certificates as unsafe: using a private CA, they are a secure and convenient way to authenticate things. – fgrieu Sep 22 '17 at 22:36
• "Just use TLS with current key sizes"... but in honesty to keep that vibe in this forum and the whole green earth the NSA would just need a few paid accounts / professors / NISTs to steer everyone in that direction. – daniel Oct 6 '17 at 12:50

I am very jealous of your optimism regarding the influence of this site. My personal feeling is that mounting a long-term Sybil attack on this forum would be an astounding waste of the NSA's time and money.

Besides, most of the concrete recommendations on practical cryptography (i.e. not purely theoretical stuff) that appears on this site comes from textbooks and research papers on cryptography, so unless the NSA is also mounting a Sybil attack on the program committees of IACR conferences I think we're probably alright.

• I'm not actually suggesting that the NSA is specifically targeting this forum or that the science here is bad, but consider. I'm actually a contractor on £30K/yr paid to monitor many crypto sites. Then under multiple ids, I undermine efforts for alternative diverse cryptography and steer newcomers towards the singular AES which is now opaquely hardware based and under the complete influence of US government. Whilst NSA might not have broken AES, it has narrowed the field of attack to one target. And what if government then forces a hardware SHA3? One cipher, one hash, one potato. – Paul Uszak Jun 11 '16 at 2:06
• @PaulUszak One cipher, one hash, one potato. – Mind you, AES (aka Rijndael) is a Belgian potato… not a bunch of US-native fries cooked up by a 3-letter agency. – e-sushi Jun 11 '16 at 4:02

Crypto.SE is definitely not a perfect target for counter-intelligence. While I would be pretty confident NSA and others will trawl all of SE for certain keywords in context, focusing on Crypto in an effort to steer people towards weaker or more easily compromised algorithms would be a vast waste of effort.

While there are some notable cryptographers on this site, and their involvement is often to help support and encourage others, I haven't seen any who would use SE as an alternative to proper peer review. You literally aren't going to persuade people to use algorithm 'X' here if they haven't had it reviewed for suitability for their application (and yes, for general usage, that review could be as simple as approval by government.)

I am very much in favour of the Stack Exchange way of supporting communities, helping develop improvements in various areas etc., but I am under no illusions as to the role SE fills. It does not replace professional level panels, review, conferences etc.

But over the top of all that - there are so many better places for any agency to compromise encrypted comms that this suggestion just makes no sense.

Rather than encouraging cryptographic diversity, there seems to be a drive towards a mono culture with all the adherent risks.

First of all, note that a more heterogeneous infrastructure would be more likely to be hacked. It's just that the impact would be smaller than successful attacks on a mono-culture.

Mono-culture vs heterogeneous-culture is a tricky subject. The problem is that cryptography is hard. Getting it rightly deployed sometimes seems even harder. Yes, we should be encouraging new ideas, but with cryptography (just like many other complex topics) the person trying to do so should understand all the crypto-analysis.

I'm not seeing a lot of "pushing agenda's". What I do see is a lot of good non-popular algorithms being discussed. On the other hand, I also see a lot of people trying new stuff without proper training (autodidact or otherwise) trying out new algorithms and protocols. Those people are generally steered towards standard algorithms and protocols. There is nothing strange about that.

Note that "don't invent your own" is not just our opinion, it's also the opinion of for instance Bruce Schneier. Now if you want to accuse Bruce of being an NSA shill go right ahead but I don't think many will take that seriously.

There are also few people here that try and defend things like Dual-DRBG or even the Intel RAND instructions. If there were any shills you would expect a few remarks on those, even if anonymously.

Finally, AES (and indeed Keccak, the algorithm for SHA-3) was created by a Belgian team of cryptographers and chosen by NIST. It has been extensively analyzed. The thing is that many people would rather trust that than some other scheme.

• Wait, there's a reason why I shouldn't defend Intel RAND instructions? – SEJPM Jun 14 '16 at 18:52
• RDRAND is nice and fast so it's pretty nice to augment existing randomness. Probably not wise to use it on its own, though. ;) – forest Mar 23 at 2:59
• @forest Why not? – Paul Uszak Mar 31 at 21:07
• @PaulUszak Because if you use it as the sole source of entropy, you are boned if it is compromised or producing predictable randomness (whether because of malice or poor design). If on the other hand you use it to augment your system entropy, the entropy will be as strong as the strongest source. – forest Apr 1 at 1:02