Top all-time · #355
Daniel J. Bernstein
Personal blog · blog.cr.yp.tosecuritymathprogramming
Daniel J. Bernstein writes cr.yp.to: blog, a personal blog at blog.cr.yp.to about security, math and programming. Since 2014, 148 different Hacker News readers have linked it 220 times, most often “Entropy Attacks”. No feed was found, so read it on the site itself.
Sometimes recommended · 7 of 40 sampled comments recommend it?
Why HN links it
HN readers link Bernstein's blog as the reference for cryptography arguments: NSA and standards, RNG entropy, hybrid post-quantum crypto, and constant-time code. Most comments only cite it.
- Recommended for · 7 comments
- Called a good case, noteworthy, a good overview and very interesting; held up as an example to follow.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Entropy Attacks17 people · 24 mentions · first linked 2017-01-06
- Entropy Attacks13 people · 15 mentions · first linked 2014-02-05
- NSA and IETF: Can an attacker purchase standardization of weakened cryptography?11 people · 11 mentions · first linked 2025-10-04
- /20220805-nsa.html8 people · 9 mentions · first linked 2022-08-05
- How to design an elliptic-curve signature system (2014)7 people · 9 mentions · first linked 2016-03-25
- /20170723-random.html7 people · 9 mentions · first linked 2019-01-20
- Daniel J. Bernstein: The death of due process6 people · 7 mentions · first linked 2016-06-07
- How to design an elliptic-curve signature system5 people · 9 mentions · first linked 2014-03-23
- Thomas Jefferson and Apple versus the FBI5 people · 5 mentions · first linked 2016-03-15
- Debunking NIST's calculation of the Kyber-512 security level (2023)5 people · 5 mentions · first linked 2023-10-03
What Hacker News says?
Thinkers should instead crush tribalism, like this: http://blog.cr.yp.to/20160607-dueprocess.html
Comment linking /20160607-dueprocess.html
on “Social Cooling (2017)”Submitted NSA, NIST, and post-quantum crypto: my second lawsuit against the US government as a story · 974 points
HN discussionEven Knuth talked about it being a 97:3 rule[1] and according to some it's gotten more skewed since then[2] [1] http://sbel.wisc.edu/Courses/ME964/Literature/knuthProgrammi... [2] http://blog.cr.yp.to/20150314-optimizing.html
Comment linking /20150314-optimizing.html
on “24-core CPU and I can’t move my mouse”Submitted NSA and IETF, part 3: Dodging the issues at hand as a story · 316 points
HN discussionhttps://blog.cr.yp.to/20220805-nsa.html works too.
Comment linking /20220805-nsa.html
on “NSA, NIST, and post-quantum crypto: my second lawsuit against the US government”Submitted NSA and IETF: Can an attacker purchase standardization of weakened cryptography? as a story · 251 points
HN discussionthey did strengthen the s-boxes against differential cryptanalysis, yes, but since 02004 we have evidence that they also sabotaged it as part of a deliberate policy they'd put in place in 01968: https://blog.cr.yp.to/20220805-nsa.html
Comment linking /20220805-nsa.html
on “NSA releases 1982 Grace Hopper lecture”Submitted Clang vs. Clang as a story · 248 points
HN discussionIronically, DJB considers the 521 curve to be the only NIST standard that uses reasonable primes. "To be fair I should mention that there's one standard NIST curve using a nice prime, namely 2^521 - 1; but the sheer size of this prime makes it much slower than NIST P-256." http://blog.cr.yp.to/20140323-ecdsa.html http://safecurves.cr.yp.to/rigid.html
Comment linking /20140323-ecdsa.html
on “PuTTY vulnerability vuln-p521-bias”Submitted The sins of the 90s: Questioning a puzzling claim about mass surveillance as a story · 243 points
HN discussion> There's a weird fear in my mind that all these "post quantum algorithms" are so complicated, with such a large surface area, that they may hide flaws. That's correct (emphasis on "may", of course), and is why it's absolutely imperative to always use PQC/ECC hybrid cryptosystems rather than pure PQC. See eg [0] for a more detailed explanation. 0: https://blog.cr.yp.to/20240102-hybrid.html
Comment linking /20240102-hybrid.html
on “iMessage with PQ3 Cryptographic Protocol”- lx · 2016-03-15
Submitted Thomas Jefferson and Apple versus the FBI as a story · 217 points
HN discussion > NSA recommended people stop using ECC <384 bits ( https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa... ). Yet they are still fine with AES-128, even though it is objectively a weaker link in the chain. See https://blog.cr.yp.to/20151120-batchattacks.html
Comment linking /20151120-batchattacks.html
on “Age: A simple, modern and secure file encryption tool”Submitted Double encryption: Analyzing the NSA/GCHQ arguments against hybrids as a story · 171 points
HN discussionIIRC, Bernstein actually disagrees with (almost) any use of rdrand. Consider, as a toy example, an rdrand that poisons a register, so that xor'ing it with anything results in a known value; this might be worse than useless. ( http://blog.cr.yp.to/20140205-entropy.html : "imagine RDRAND microcode that's looking at the randomness pool that it's about to be hashed into") I'm not sure I agree with Bernstein here.
Comment linking /20140205-entropy.html
on “Making sure crypto remains insecure [pdf]”Submitted Why EdDSA held up better than ECDSA against Minerva as a story · 148 points
HN discussionThis is a fun slide deck, but if you'll forgive me for sucking some of the mystique out of it: it's just a reframing of DJB's hobby horses: * The group that standardized AES rejected cache timing as a viable attack vector: http://cr.yp.to/antiforgery/cachetiming-20050414.pdf --- more generally, that constant-time algorithms and constructions (a feature of virtually all of Bernstein's work for the last 15+ years) are…
Comment linking /20140205-entropy.html
on “Making sure crypto remains insecure [pdf]”Submitted Some small suggestions for the Intel instruction set as a story · 138 points
HN discussionSee https://blog.cr.yp.to/20150314-optimizing.html
Comment linking /20150314-optimizing.html
on “Why is this C++ code faster than my hand-written assembly (2016)”Submitted An Introduction to Vectorization as a story · 135 points
HN discussionIt may have been inspired by arguments like https://blog.cr.yp.to/20140205-entropy.html (although that one was published five years later than the change we're talking about).
Comment linking /20140205-entropy.html
on “An Almost-Secret Algorithm Researchers Used to Break Thousands of RSA Keys”Submitted How to design an elliptic-curve signature system as a story · 115 points
HN discussionFrom Daniel J. Bernstein: 2022.08.05: NSA, NIST, and post-quantum cryptography: Announcing my second lawsuit against the U.S. government. : https://blog.cr.yp.to/20220805-nsa.html https://twitter.com/hashbreaker/status/1555625577989541888
Comment linking /20220805-nsa.html
on “SHA-3 Buffer Overflow”Submitted Break a dozen secret keys, get a million more for free as a story · 110 points
HN discussionIt's very clear to me that civil liberties are at the core of this discussion. And while I think that crypto->math->speech is clear, others may not. Let's keep in mind that our legislators are responding to a genuine fear in the electorate. It's our job(s) as technophiles to educate the electorate and legislature as to why this isn't the right move. This is where SCOTUS really pays off as a check against Congress. T…
Comment linking /20160315-jefferson.html
on “Senate encryption bill draft mandates 'technical assistance'”Submitted Entropy Attacks as a story · 102 points
HN discussion> If no one except djb feels this strongly about hybrid vs. pure post-quantum stuff then it's okay. That is one of the contentious issues. See the last paragraphs of: https://blog.cr.yp.to/20251004-weakened.html Starting with "Remember that the actual tallies were 20 supporters, 2 conditional supporters, and 7 opponents".
Comment linking /20251004-weakened.html
on “Notes by djb on using Fil-C”Submitted Measuring "efficiency" in document prepration: Microsoft Word vs. LaTex as a story · 89 points
HN discussionhttps://blog.cr.yp.to/20140205-entropy.html
Comment linking /20140205-entropy.html
on “A wall of lava lamps helps encrypt the internet”Submitted A subfield-logarithm attack against ideal lattices as a story · 89 points
HN discussion
