[mtgx]

That may be true, but I still think there's a negative undertone against DJB's crypto here, even if it's unintentional (if you're going to talk about a crypto monoculture, it may become inevitable to talk about DJB's work and its adoption).

However, I worry many (developers) will get the wrong message from this post: that they shouldn't use the new standards from DJB (even if they are clearly superior in every way), because that would "help create the monoculture".

Also look at how this post ends:

> So the (pending) Bernstein monoculture isn't necessarily a vote for Dan, it's more a vote against everything else.

So it's not a vote for Berstein that he got so much so right? If it's not a vote for DJB's work, then maybe he can point out what's wrong with it (other than everyone wanting to adopt it).

The post could've very well ended like this, and it would've been better for it:

> The impending monoculture (based around DJB's crypto) is showing us that we need simpler, more boring crypto everywhere, but it needs to come from other authors as well.

Something like that. He is after all arguing against non-boring crypto throughout the post, no? So that should've been his conclusion?

Maybe even add a little bit of "DJB has showed us the way - now it's time for others to pick up the torch and take it from here." But I imagine he wouldn't have gone that far.

[tptacek]

The author of this post is a cryptographer. The people who select ciphers for products are almost invariably not cryptographers. The idea that DJB crypto is selected simply because it is "clearly superior in every way" seems inaccurate.

In fact, I think it's comments like these that set people like Guttman off. If you pay enough attention to the people who select but don't design ciphers --- ie, non-cryptographer engineers --- you're starting to hear more and more of a drumbeat of "do whatever DJB says"; if you push those people to explain those decisions, you don't usually get good answers.

[CiPHPerCoder]

> If you pay enough attention to the people who select but don't design ciphers --- ie, non-cryptographer engineers --- you're starting to hear more and more of a drumbeat of "do whatever DJB says"; if you push those people to explain those decisions, you don't usually get good answers.

Sure. I like to call that condition "secure by default". Said engineers most often don't have a lot of knowledge and experience with cryptography, so they opt for the best option available. In a lot of cases, it's DJB's work. In other cases, it's someone who followed his example (e.g. the BLAKE(2) team).

Also, this might have had something to do with this shift towards the current situation:

https://gist.github.com/tqbf/be58d2d39690c3b366ad

> Use, in order of preference: (1) The Nacl/libsodium default

> If you can just use Nacl, use Nacl. You don't even have to care what Nacl does.

[tptacek]

I take your point, and the point of the sibling commenter. I just think Guttman is talking about a different kind of "DJB by default" phenomenon.

[CiPHPerCoder]

I think you're right.

[napoleond]

And yet, that drumbeat is probably a good thing. And perpetuated by people like you chanting "just use NaCl" every chance you get. So it's not super fair to pick on non-crypto geeks for accepting that easy truth.

[tptacek]

We're not talking about what library to use; we're talking about what algorithms go into standards.