back to article NIST wants answers on infosec - your answers

Sometimes, “don't read the comments” just isn't an option – like when you're United States' National Institute of Standards and Technology (NIST), and you're soliciting input for the US government's Commission on Enhancing National Cybersecurity (CENC). The CENC, which was announced back in April, has asked NIST to provide …

  1. Anonymous Coward
    Terminator

    Pointless PR exercise..

    ..contrived to restore misplaced warm-and-fuzzyness in the NSA's crapto dissemination front.

    1) Drop your NSA-only primitives ruse and permit require!! multiple heterogeneous redundancy.

    2) Redesign all your crapto protocols to transfer primitive selection/assembly authority from server (where you've been told all along IT DOESN'T BELONG) to client.

    AES/Twofish/Camellia/Aria/Serpent, CBC/ECB/CTR/OCB/GCM/CFB/Salsa20+Poly1305, Whirlpool/Blake2/Skein/Grøstl/JH/Skein/Keccak... oh the permutations! You'd HATE that, wouldn't you? ...and those strange souls who don't completely trust NSA with their privacy & security could remove YOUR AES/SHA completely! You'd REALLY HATE that, wouldn't you? While those who must can disable the rest to conform to YOUR "certification" ...and when the next NSA primitive to be unpicked explodes in our faces, the client vendors could merely issue an immediate routine patch to remove it from use and protect all those who hadn't thought to disable your primitives for themselves. Without "having" to wait for YOU to recontrive & "ratify" a replacement OR ANYTHING!!!one Awesome!?! Have you bust an aneurysm yet "NIST"?

    3) Redesign all your crapto protocols to transfer random number generation from often heavily loaded and entropy starved server (where you've been told all along IT DOESN'T BELONG - SDOOPID FUCKTARDS) to client typically awash with entropy... unless you're expecting us to be surfing the web with smartcards. Hint: You're not.

    What's that? "la la la we still can't hear reason... anyway we're not asking for help with our b0rken-by-design protocols, stupid, we're asking for window dressing"

    Same old TLA. Same old shit.

    1. Anonymous Coward
      Anonymous Coward

      Re: Pointless PR exercise..

      Technically, NIST and CENC are both FLAs, not TLAs. Or were you so busy trying to pretend to know what you are talking about that you forgot to count the letters??

      (FLA = Four Letter Acronym, TLA = Three Letter Acronym - unless you meant something else amidst your ranting?)

      1. Anonymous Coward
        Anonymous Coward

        Re: Pointless PR exercise..

        >"..contrived to restore misplaced warm-and-fuzzyness in the NSA's crapto dissemination front."

        Technically, I see three.

  2. wozier

    Two questions come to mind:

    1) Is this a junk comment file? So far, not very professional

    2) Given that NIST's request is for real, I have one question: Why is there no mention of real risk metrics including the quantitative identification, measurement, and cost-effective management of cybersecurity (information asset) risks in either the private or public sectors? A long time ago, NIST provided a sound framework for such tools/approaches. Has that been abandoned?

    1. Anonymous Coward
      Anonymous Coward

      Re: Two questions come to mind:

      Looks like an entirely predictable stampede to me. The hapless cattle can clearly barely contain our enthusiasm to do NSA's "no we're NIST! Honest!'s" job for them, for nothing.

      Personally, I'm ebullient with excitement.

      Mind you don't get trampled!

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon