Quote from: austonst on June 15, 2013, 07:14:42 PM

There are two big things that I think need to be pointed out here. First, you have an assumption that the NSA can crack any cryptographic encryption or hash that they had a hand in developing (SHA-2 being the main example). Can you explain why:

A) Nobody else in the entire world has publicly managed to even come close to breaking SHA256.

I wouldn't be surprised if the Russian government has managed it. As for why civilians haven't broke it, it has to do with the fact they are dirt poor compared to the higher echelons of society and that academic research is highly controlled. At least, that's my theory. Again, cryptanalysis isn't equivalent to auditing source code.

Quote from: austonst on June 15, 2013, 07:14:42 PM

B) NIST only recommended that the US Government move from SHA-1 to SHA-2 once it was publicly accepted that SHA-1 was insecure. Now, they're supposed to use SHA-2 everywhere. If the NSA is so far ahead of everyone else, why would they use hash functions they know to be insecure? As soon as a public release of a vulnerability comes out, their security will be severely damaged. (http://csrc.nist.gov/groups/ST/hash/policy.html)

The federal government isn't a unified organization. In fact, if I were higher up in the NSA, I would want the lower branches of the government to use weak cryptography so I could have access to all their communications and resources.

And who says the NSA uses SHA256? Do you work for the NSA? I doubt even the President knows their operating procedures. They likely use cryptography that isn't available to the public.

And why would an organization with a classified budget have their real and full policy out in the open on the web?

Quote from: austonst on June 15, 2013, 07:14:42 PM

C) SHA-3 was chosen through a contest where researchers publicly submitted and discussed their hash functions. The chosen winner to become SHA-3, Keccak, was selected because it is clearly fast and secure. It was not developed by the NSA, and there would be very little room for the NSA to "rig" the contest, finding a hash function that they, but nobody else, could find a flaw with. Doesn't this show NIST's intent: to provide a national standard for a secure hash, drawn from the minds of the best crypto researchers, in the case of SHA-2 failure?

They could have rigged the contest indirectly. A lot of the contestants weren't even revealed and tons of them were rejected. The NIST could have very well intentionally chosen a weak hash function that only the NSA could compromise.

How the winning hash function was chosen was not totally open and clear. They gave some vague requirements but not much beyond that. They could say it's "fast and secure" but that's taking their word on it. In the end, you're relying on trust.

Quote from: austonst on June 15, 2013, 07:14:42 PM

The other issue I have with this theory is that Bitcoin does NOT use classic DSA. Bitcoin's signatures are done using elliptic curve cryptography. Neither ECC nor ECDSA come from the NSA (Here, here, and here). A vulnerability in classic DSA does not mean there's a vulnerability in ECDSA.

It doesn't but it's still based on the core DSA technology. The bit security is improved but in the end it is a slight modification. ECDSA is directly based on DSA. It's equivalent technology.