Slashdot Mirror

← Back to Stories (view on slashdot.org)

New NSA-Approved Encryption Standard May Contain Backdoor

Posted by Zonk on from the find-out-by-knocking dept.

Hugh Pickens writes "Bruce Schneier has a story on Wired about the new official standard for random-number generators the NIST released this year that will likely be followed by software and hardware developers around the world. There are four different approved techniques (pdf), called DRBGs, or 'Deterministic Random Bit Generators' based on existing cryptographic primitives. One is based on hash functions, one on HMAC, one on block ciphers and one on elliptic curves. The generator based on elliptic curves called Dual_EC_DRBG has been championed by the NSA and contains a weakness that can only be described as a backdoor. In a presentation at the CRYPTO 2007 conference (pdf) in August, Dan Shumow and Niels Ferguson showed that there are constants in the standard used to define the algorithm's elliptic curve that have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can completely break any instantiation of Dual_EC_DRBG."

10 of 322 comments (clear)

  1. T-shirts by hoggoth · · Score: 5, Funny

    secret numbers appearing on T-shirts in Finland in 3.. 2.. 1..

    --
    - For the complete works of Shakespeare: cat /dev/random (may take some time)
  2. Re:What part of "NSA Approved" don't you understan by arkane1234 · · Score: 2, Funny

    That would explain why SELinux isn't widely used.

    --
    -- This space for lease, low setup fee, inquire within!
  3. Re:umm by Anonymous Coward · · Score: 2, Funny

    1 2 3 4

  4. Re:Ummm, parent is right. by cayenne8 · · Score: 3, Funny
    Nah....they had to put a backdoor here in hopes of getting it adopted.

    Turns out Vista doesn't have the uptake they thought it would...so, they really can't exploit the windows backdoor any longer...

    They gotta try something!!

    :-D

    --
    Light travels faster than sound. This is why some people appear bright until you hear them speak.........
  5. Re:umm by cayenne8 · · Score: 3, Funny
    "5! you forgot the 5!"

    Still..........I'd better go change the combination on my luggage....

    --
    Light travels faster than sound. This is why some people appear bright until you hear them speak.........
  6. Re:The answering machine by maxwell+demon · · Score: 2, Funny

    Anyone else reminded of the little Black Box from Sneakers?

    It's a movie. A movie. Ya know, fiction.

    That's what they tell you. :-)
    --
    The Tao of math: The numbers you can count are not the real numbers.
  7. Re:Trust the Spies by caluml · · Score: 2, Funny

    -----BEGIN PGP MESSAGE-----
    Version: GnuPG v1.4.6 (GNU/Linux)

    jA0EAwMCPPnmI+wr8DVgyRye1U/9KBxX5jcOp0oidm/5y9TesyWpjQbYvE3j
    =pvFV
    -----END PGP MESSAGE-----

    This is secure. The password is foo. Let's have a symmetrically encrypted discussion using GPG. All passwords are foo.

    --
    Get your own free personal location tracker
  8. Re:Ummm, parent is right. by sgt_doom · · Score: 2, Funny
    You (iknownuttin) are absolutely right, of course!

    I recall years ago when I was a contracter at NSA and they were using the reverse-Polish security system, i.e., the passage monitors were keyed to one's security badge, therefore all one needed to do to go to a higher-level access area was to remove one's security badge.

    Unfortunately, regardless of higher intelligence, anyone who subscribes to the bureacratic gods always behave stupidly.....

  9. Re:umm by Anonymous Coward · · Score: 1, Funny

    Exactly. It's like Sauron having a hold over the Three Rings that he did not make or touch. He can directly influence only the Seven or the Nine.

  10. Obligatory War Games Quote by guttentag · · Score: 2, Funny

    "Mr. Potato Head? Mr. Potato Head! Back doors are not secrets!"