4 The ISO/IEC Standardization of Simon and Speck
75
of Simon and Speck was not yet fully understood, and additional information,
preferably in the form of a design rationale, was requested. 7
In parallel, two responses to the Preliminary Working Draft, editorial in nature,
were received. Both the comments made in the study period and the ones on the
Preliminary Working Draft were discussed in a presentation by Louis Wingers.
In this presentation, Wingers argued that providing a design rationale was not the
designer’s job, and that cryptanalysis of both algorithms had stabilized such that no
new results were expected to be published. 8
Not mentioned in the meeting summary is a discussion that was held about past
involvement of the NSA in sabotaging cryptographic standards, e.g., Dual-EC. One
of the NSA experts, Debby Wallner, who was also involved in the standardization
of Dual-EC, referred to it as the “elephant-in-the-room” and claimed that they had
apologized for it and that it was time to move on. 9
Also not reflected in the summary is a request by Wallner to have a country-level
vote during the meeting in order to decide how to proceed with the project. This
vote, which has no grounds in the ISO directives, had to be later ratified using the
correct procedure. By then, the meeting summary had already noted that the study
period should be terminated and that a first Working Draft should be circulated.
Tampa, Florida, USA (April 2016)
Simon and Speck’s Working Draft (WD) was circulated on November 2015 with a
commenting period of 17 weeks (until March 2016). Aside from editorial remarks,
the comments received make it clear that many experts did not trust the security
of these algorithms. Another concern raised by experts was that many experts
disagreed with the editors’ decision to leave variants of Simon and Speck with a
48-bit block size in the draft.
In their Disposition Of Comments (DoC), the editors refused to address the
security concerns raised by the experts, virtually marginalizing what seems to be
the majority’s opinion; quoting from the first paragraph of their response:
The decision to initiate this Amendment which includes SIMON and SPECK has already
been made.
Reading the comments about small block sizes, the editors decided to shift the
discussion outside of their own project, and started yet another Study Period (SP)
dealing with the more general question of small block sizes.
In conclusion, the meeting report writes:
The session ended by trying to determine how to move forward. To do this, Debby Wallner
(US) requested that a straw poll be taken to decide if the proposed Amendment should move
7 This would be a recurring theme in the standardization of Simon and Speck.
8 This is yet another recurring theme in the standardization of Simon and Speck. This claim was
made by the NSA in each and every meeting, and was always defeated by the time of the next
meeting.
9 Since the discussion about Dual-EC is not reflected in the meeting summary, it is reproduced here
from memory.
75
of Simon and Speck was not yet fully understood, and additional information,
preferably in the form of a design rationale, was requested. 7
In parallel, two responses to the Preliminary Working Draft, editorial in nature,
were received. Both the comments made in the study period and the ones on the
Preliminary Working Draft were discussed in a presentation by Louis Wingers.
In this presentation, Wingers argued that providing a design rationale was not the
designer’s job, and that cryptanalysis of both algorithms had stabilized such that no
new results were expected to be published. 8
Not mentioned in the meeting summary is a discussion that was held about past
involvement of the NSA in sabotaging cryptographic standards, e.g., Dual-EC. One
of the NSA experts, Debby Wallner, who was also involved in the standardization
of Dual-EC, referred to it as the “elephant-in-the-room” and claimed that they had
apologized for it and that it was time to move on. 9
Also not reflected in the summary is a request by Wallner to have a country-level
vote during the meeting in order to decide how to proceed with the project. This
vote, which has no grounds in the ISO directives, had to be later ratified using the
correct procedure. By then, the meeting summary had already noted that the study
period should be terminated and that a first Working Draft should be circulated.
Tampa, Florida, USA (April 2016)
Simon and Speck’s Working Draft (WD) was circulated on November 2015 with a
commenting period of 17 weeks (until March 2016). Aside from editorial remarks,
the comments received make it clear that many experts did not trust the security
of these algorithms. Another concern raised by experts was that many experts
disagreed with the editors’ decision to leave variants of Simon and Speck with a
48-bit block size in the draft.
In their Disposition Of Comments (DoC), the editors refused to address the
security concerns raised by the experts, virtually marginalizing what seems to be
the majority’s opinion; quoting from the first paragraph of their response:
The decision to initiate this Amendment which includes SIMON and SPECK has already
been made.
Reading the comments about small block sizes, the editors decided to shift the
discussion outside of their own project, and started yet another Study Period (SP)
dealing with the more general question of small block sizes.
In conclusion, the meeting report writes:
The session ended by trying to determine how to move forward. To do this, Debby Wallner
(US) requested that a straw poll be taken to decide if the proposed Amendment should move
7 This would be a recurring theme in the standardization of Simon and Speck.
8 This is yet another recurring theme in the standardization of Simon and Speck. This claim was
made by the NSA in each and every meeting, and was always defeated by the time of the next
meeting.
9 Since the discussion about Dual-EC is not reflected in the meeting summary, it is reproduced here
from memory.