For as long as most of us in the cryptographic community can remember, the National Security Agency (NSA) has occupied a unique and sometimes misunderstood role in shaping the world’s cryptographic standards. Its influence has often sparked speculation, but when we look back with the benefit of hindsight, a consistent theme emerges: many of the NSA’s interventions seem to have quietly strengthened the systems we all rely on.
The DES Controversy: When IBM’s Lucifer Became a National Standard
It all began in 1975, when IBM submitted its symmetric key algorithm Lucifer to the first open national data encryption standard competition. IBM won, and the algorithm became the Data Encryption Standard (DES). Before publication, the design was refined: the Substitution boxes (S boxes, or lookup tables) were carefully adjusted, and the cryptographic key size was reduced from 128 bits to 56 bits.
At the time, these changes raised eyebrows. Did the NSA possess technology capable of breaking 64-bit keys? Or did it simply understand something deeper about S-box design? The answer, as history showed, leaned toward the latter. In 1990–1991, Eli Biham and Adi Shamir introduced differential cryptanalysis, and remarkably, the DES S-boxes, in their final version, were resistant to that very attack. What once appeared suspicious now looks like judicious foresight.
SHA-0 to SHA-1: A One-Bit Change That Saved a Standard
A similar story unfolded a few years later. NIST’s first standard hash function, SHA-0, was published in 1993. Two years later, the algorithm was subtly modified: a single bit rotation was added, and the updated version became SHA-1. Again, some questioned the reasoning. But later research validated the change – Chabaud and Joux (1998) showed that collisions could be found for SHA-0’s compression function, and Wang et al. (2005) extended that to the full SHA-0 hash output. Once again, the adjustment appeared to have anticipated emerging weaknesses.
The Rise of ECC: A Forward-Thinking Shift Toward Efficiency
Around that same time, the NSA officially recommended transitioning from RSA to elliptic-curve cryptography (ECC) in its Suite B algorithms. This shift, instead of being about hidden motives, was more likely about efficiency and forward-thinking design. ECC offered greater strength per bit, meaning a 256-bit ECDSA key could replace a 2048-bit RSA key, with smaller parameters and easier implementation. The NSA’s recommendation helped steer global cryptography toward faster, leaner, and more scalable security.
The Broader Pattern: Cryptographic Evolution Through Agility
This pattern, of evolution driven by emerging understanding, runs throughout cryptographic history. DES gave way to 3DES and then to AES, with key sizes expanding from 56 to 112 and eventually 128 and 256 bits. Similarly, SHA-1 evolved into SHA-2 and SHA-3, as computing power and attack methods advanced. Each transition underscores the importance of cryptographic agility and the constant readiness to adapt…principles the NSA also seems to be supportive of.
The Next Great Shift: Preparing for the Post-Quantum Era
Today, another great transition looms on the horizon. Quantum computing promises revolutionary capabilities, but it also poses a threat to the foundations of classical public-key cryptography based on factoring and discrete logarithms. Unlike in decades past, this time the challenge is universally recognized and, crucially, preparations are already underway.
For more than a decade, NIST and the broader cryptographic community have been collaborating on the development of post-quantum standards. The result is a new suite of algorithms designed for a quantum-resistant future: ML-KEM (FIPS -203) for key exchange and ML DSA (FIPS 204 & 205) for digital signatures, alongside ongoing research into alternative mathematical structures to lattices and learning with errors in case these turn out to have unknown weaknesses.
This time, it feels different. The transition is transparent, collaborative, and proactive. And perhaps for the first time in modern cryptography, we’re not reacting to a crisis – we’re more aware and preparing for it. Organizations embracing post-quantum cryptography and cryptographic agility today are positioning themselves for long-term security in the quantum era; and it’s fair to say that this time, we might truly be ahead of the curve.
_____
Helena Handschuh is a security technologies expert specializing in cryptography, post-quantum security, and hardware protections. A former Rambus Fellow, she has led teams at Cryptography Research, Intrinsic-ID, and Gemplus, chaired the RISC-V Security Committee, and contributed to global standards.
Join our LinkedIn group Information Security Community!
