🚨The NSA Is Steering the IETF to Adopt Weak Crypto Standards 🤯 Additionally, Internet's Rulemakers Are Quietly Giving Themselves the Power to Silence Dissent Which They Have Already Used To Remove Dr. Daniel J Bernstein (djb) from the IETF TLS mailing list! 😲
Every time you open a secure website, use a VPN, or send an encrypted message, you are relying on the work of Dr. Daniel J. Bernstein, better known in the cryptography world as djb.
He created Curve25519, Ed25519, ChaCha20, and Poly1305. These algorithms are the backbone of modern secure communication and protect billions of devices. They are used in browsers, encrypted messengers, and the WireGuard VPN.
He also wrote qmail and djbdns, two programs so carefully engineered that they changed how developers think about secure software design.
In the 1990s, Bernstein took on the U.S. government in Bernstein v. United States and won. That court case established that cryptographic code is protected speech under the First Amendment, paving the way for open encryption software around the world.
Without that victory, modern privacy tools like online banking, private messaging, and Bitcoin might not exist.
As Bernstein once put it, “People using crypto are people communicating using a language we don’t understand.”
That idea, that encryption is a form of free expression, now sits at the heart of his newest warning.
Post-Quantum Cryptography
Quantum computers could one day break today’s encryption. To prepare, the world is adopting post-quantum (PQ) cryptography, algorithms resistant to quantum attacks.
Two competing approaches are being debated inside the IETF TLS Working Group, which defines how HTTPS and other secure protocols work:
Hybrid TLS combines existing elliptic-curve cryptography (ECC) with new post-quantum algorithms such as ML-KEM. Think of it as double encryption, ECC plus PQ.
Pure Post-Quantum TLS removes the old ECC layer and relies entirely on the new PQ system. It is simpler, but far riskier.
The NSA Is Pushing the Weaker Option
In an October 2025 essay titled, “NSA and IETF: Can an attacker simply purchase standardization of weakened cryptography?” Bernstein accuses the NSA and its UK partner GCHQ of steering global standards groups toward the pure PQ option and eliminating the safer hybrid model.
He writes, “Surveillance agency NSA and its partner GCHQ are trying to have standards-development organizations endorse weakening ECC PQ down to just PQ. Weakening ECC PQ to just PQ, normalizing the practice of driving without seatbelts, is another win for you as the attacker.”
He calls it a repeat of history, comparing it to the 1970s when the NSA secretly reduced the key strength of the Data Encryption Standard (DES) before promoting it as “secure.”
The Evidence
NSA Policy Signals: CNSA 2.0
The CNSA 2.0 Suite, the NSA’s official guidance for national-security systems, lists ML-KEM-1024 for key exchange and explicitly says hybrids are not required.
That single line signals to vendors, especially defense contractors, that pure post-quantum solutions are preferred.
With billions in procurement spending at stake, Bernstein says this policy effectively buys influence over what gets standardized worldwide.
Cisco’s Revealing Email
On the IETF TLS mailing list, a Cisco engineer wrote in December 2024, “There are people whose cryptographic expertise I cannot doubt who say that pure ML-KEM is the right trade-off for them, and more importantly for my employer, that’s what they’re willing to buy. Hence, Cisco will implement it.”
Bernstein interpreted this as procurement pressure from government buyers and speculated, “If that source isn’t NSA, who is it?”
“Consensus”
When the IETF TLS Working Group declared “consensus” to adopt the pure-PQ draft, seven experts including Bernstein objected. They argued that removing the ECC layer weakened overall security.
Despite these objections, the chairs pushed it through.
A senior Security Area Director responded to Bernstein’s concerns by writing, “You calling into question this consensus call of the WG chair is abusive and follows a repetitive pattern. Nevertheless, for now this is your right... there comes a point where you will be prevented from further playing these games.”
That official later voted in favor of a new policy known as MODPOD, a proposal that could soon make such warnings more than rhetorical.
The IESG
Proposals like TLS drafts are approved not just by working-group chairs but also by a committee called the Internet Engineering Steering Group (IESG).
The IESG also appoints those working-group chairs and is itself appointed by a “Nominating Committee,” or NomCom. NomCom membership is limited to people who can afford to attend frequent IETF meetings, often paid for by major tech companies or governments.
In 2024, the voting NomCom members included employees from Huawei, ZTE, Cisco, Linaro, and one representative from the U.S. government. Critics argue this structure ensures the IESG reflects corporate and institutional interests, not independent engineers.
Bernstein points out that this same IESG already holds broad powers of censorship under a rule called RFC 3683 (BCP 83).
Existing Censorship Power: BCP 83
BCP 83 claims that some participants had engaged in “denial-of-service” attacks on the IETF’s consensus process by posting “off-topic” or “inflammatory” messages. It allows the IESG to ban authors from mailing lists if it deems their messages “abusive of the consensus-driven process.” Once banned, other moderators may enforce the same ban automatically.
Bernstein notes that this power has already been used at least five times.
In one case, engineer Dan Harkins was banned from 2022 until 2025 after criticizing proposals to rename technical terms like “master” and “slave.” The IESG claimed his posts were “rude” and “abusive,” despite being part of a policy debate about terminology.
Bernstein argues this ban “sabotaged, rather than protected, the consensus-driven process.”
MODPOD
The proposed MODPOD draft would vastly expand these censorship powers by creating a five-member “Moderator Team” authorized to police every IETF forum, issue permanent bans, and define “disruptive behavior” so broadly that “incessant requests for evidence” could qualify.
Appeals would go to the same leadership, the IESG, that appointed them.
In other words, the IESG, which already controls appointments and approvals, would gain direct enforcement authority over speech within the IETF itself.
Governance Capture
Bernstein and others see a broader pattern, the NSA influencing cryptographic standards through procurement, and the IESG consolidating procedural control through governance reforms like MODPOD.
This, they argue, is governance capture, centralization by process rather than policy.
Open technical review is being replaced by administrative authority. By controlling both what gets standardized and who is allowed to speak, a small circle of institutions, corporate and governmental, now shapes the very fabric of internet security.
Cryptographic standards are not just technical documents, they define global trust. Once a standard is adopted, it can take decades to change. If weakened protocols are standardized today, and dissenters are silenced tomorrow, the consequences will echo far beyond the IETF.
If the IETF and its steering group can quietly rewrite both encryption standards and the rules of dissent, then the open internet, and the security it depends on, may soon belong to those who can pay for consensus.
Take your privacy and security in your own hands.