> The judges who chose AES and SHA-3 as the "winners" of the global competitions are the NSA.
Sure, however this process creates alternatives and if the crypto community thinks the winner is backdoored I am pretty sure we will know it and additionally we will have a valid alternative ready to be implemented.
Additionally if the NSA/NIST modifies the specs for the crypto construction there is still the possibility to implement the original one. See SHA-3 for instance. It was about to be weakened, but the crypto community could still implement the original spec.
> That would include AES and SHA-3.
You cut the rest of the sentence and therefore changed completely the whole meaning. My original sentence included: "...without going through years of reviews by international cryptographers."
Take a look at this video of D.J.B.: https://www.youtube.com/watch?v=G-TM9ubxKIg
He makes a great example with the Dual_EC_DRBG, where many cryptographers told NIST that there could be a backdoor. NIST answer basically was: sorry too late, it has already been implemented !
So in other words, in case of Dual_EC_DRBG the standardization process was all in reverse. First NIST standardized it and then the crypto community started to review it and found problems.
The judges who chose AES and SHA-3 as the "winners" of the global competitions are the NSA.
> You should avoid at all costs anything that has been standardized by NIST...
That would include AES and SHA-3.