[leonidasrup]

This is exactly according the NOBUS ("Nobody But Us") principle. With weak S-box, anybody could break DES, with strong S-box only NSA could bruteforce DES (in the 1980s).

"

Michael Hayden, a former NSA Director, has since acknowledged the concept of NOBUS:

    You look at a vulnerability through a different lens if even with the vulnerability it requires substantial computational power or substantial other attributes and you have to make the judgment who else can do this? If there's a vulnerability here that weakens encryption but you still need four acres of Cray computers in the basement in order to work it you kind of think "NOBUS" and that's a vulnerability we are not ethically or legally compelled to try to patch – it's one that ethically and legally we could try to exploit in order to keep Americans safe from others."

https://en.wikipedia.org/wiki/NOBUS

In general we can asume that NOBUS applies to everything NSA publishes or supports. If not in direct algorithmic weakness, then in weakened parameters or in selection of algorithms that are hard to implement in secure way without specialized hardware support (side channel attacks of AES, sensitivity of DSA to quality of random number generator, hard to correctly implement NIST curves - generated by NSA).