New Vista Random Numbers to Include NSA Backdoor?

Schneier is reporting that Microsoft has added the new Dual_EC-DRBG random-number generator to Vista SP1. This random-number generator is the same one discussed earlier that may have a secret NSA backdoor built into it.

Comments

Given the known problems of Dual_EC_DRBG

[morgan_greywolf]

Given the known problems of Dual_EC_DRBG, which, from the Bruce Schneier article, include the fact that's slow, that it's got an obvious backdoor, and that it was inexplicably pushed for the NSA for seemingly no reason, why would Microsoft add it to Vista SP1?

Now adding the algorithm itself isn't really a backdoor per se, because no one is forcing you to use that particular random number generator. But it is also interesting to note that this isn't the first time Microsoft has been accused of inserting backdoors for the CIA or the NSA. Of course, Microsoft vehemently denies such allegations, but I would assume that they would. Given what the telcos did for the NSA, would anyone be surprised if it really did come out that the NSA actually forced Microsoft to put backdoors in Office or Windows?

Re:From the article

[Smidge204]

It's not enabled by default ... until the next Automatic Update rolls around.

=Smidge=

Does anyone who uses Vista...

[gillbates]

Have any expectation of privacy or security in the first place?

IIRC, some of the key SCOTUS decisions regarding the Fourth Amendment have centered around a person's expectation of privacy. They've argued:

• That someone doesn't have a reasonable expectation of privacy regarding their garbage.
• That email doesn't have a reasonable expectation of privacy...
• That a person's car is subject to Fourth Amendment protection.

That said, the government could persuasively argue that someone who runs Windows, especially Vista, has no expectation of privacy in the first place:

• More malware and trojans run on Windows than Mac and Linux combined. In fact, there are more viruses available for Windows than there are editors - even applications - for Linux.
• Microsoft has continued a trend of introducing software with gaping holes for that past 10 years. No OS vendor in the last decade has produced a less secure OS than Microsoft. Surely the user must be aware of this, and have accepted the risk.
• Users accept the Windows EULA, which, among other things, allows Microsoft to remotely check Windows for proper activation - so they already have given up their privacy to a corporation.

Now the sad thing is that this does come across as a troll, but sadly, it's true. And it needs to be addressed. For some reason, the /. crowd thinks it is acceptable that a majority of the population uses an OS which is horribly less secure than the ones we ourselves use (Linux, Macs, etc...). We're supposed to be the technical ones who have the solution to these problems, and yet, most /.ers just choose to blame the victim and whine about Microsoft being evil. Granted, we already know that.

Is it really acceptable that our collective rights are surrendered because a major corporation finds more profit in insufficient design and testing of its software? I realize that most of you loathe Windows, but unless we actually do something to fix the social barriers to the adoption of Linux, we can expect that, because Windows is so insecure, our government will be able to convince SCOTUS that a computer user has no "reasonable expectation of privacy".

It doesn't matter so much that this PRNG is insecure. A knowledgeable cryptographer isn't going to trust the OS for random numbers, anyway - unless it is in compliance with some standard to which their code must comply. What matters is that Vista is full of holes, and we're talking about a PRNG which no software of cryptographical consequence is going to use anyway.

Instead, we ought to worry that Windows itself is easily compromised by the government. That is the real problem. Why would you break the PRNG when you can rootkit even a fully patched Vista box with an email?.