Slashdot Mirror
RSA Flatly Denies That It Weakened Crypto For NSA Money
The Register reports that RSA isn't taking quietly the accusation reported by Reuters, based on documents released by Edward Snowden, that the company intentionally used weaker crypto at the request of the NSA, and accepted $10 million in exchange for doing so. RSA's defends the use of the Dual Elliptic Curve Deterministic Random Bit Generator, stating categorically "that we have never entered into any contract or engaged in any project with the intention of weakening RSA's products, or introducing potential 'backdoors' into our products for anyone's use."
RSA denying it? "Well, he would, wouldn't he?" - Mandy Rice-Davies
If this story turns out to be true, then RSA's name is mud. Only a complete and utter moron would buy from them after this.
Same goes for the other companies who have been selling us out. Even Google and Microsoft who are now leaking stories about them boldly protecting their backbones from the NSA have been handing over our data, and in the case of Microsoft took cold hard cash to add backdoors to Skype and God knows what else. If you trust *any* of these companies you are a complete and utter moron.
The problem is that the NSA has been lying to everyone with doublespeak--asking permission for X warrants when the warrants really covered umpteen billion warrants, things like that. So while this press release categorically denies "that RSA entered into a “secret contract” with the NSA to incorporate a known flawed random number generator into its BSAFE encryption libraries[,]" it could still be truthful even if any ONE of the facts in that list is false.
For example, "known" flawed random number generator--suppose the NSA knew it was flawed and RSA didn't. This denial does not contradict that.
In the context of a topic where companies and government agencies are lying regularly by using careful diction, even a "strong" "categorical" denial has to eliminate the possibility of loopholes in order for it to be believable.
Comment removed based on user account deletion
The government has a new encryption algorithm that is "amazingly strong". Only they are paying YOU to use it? And that does not throw up any red flags in a company based on SECURITY?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
It's a very sad day when we have media which prostituting themselves to the BIG BROTHER and companies betraying the trust of their customers for some breadcrumbs.
If all that happened in a banana republic we may say "Oh, but they are banana republics".
But no. All these are happening in the United States in America !
What hath my beloved country turned into ?
Muchas Gracias, Señor Edward Snowden !
What you are saying is incorrect. In the UK if I tell you a lie about someone, and you repeat it publicly, you can be sued for libel. The fault is yours for not verifying the damaging information before you published it. Merely printing a retraction isn't enough, because once the accusation is made it sticks in the public mind. Otherwise I can call you a pedo, and retract it later. It doesn't work that way. Sometimes a retraction might satisfy the defamed party, but if the damage is significant they can decide to sue you anyway. In this case no one would ever trust RSA again, so the damage is severe. If the story was fake, RSA could sue the Guardians arse off.
As for your theory that competitors leaked this to damage RSA, you have not offered a shred of evidence, and your premise that the Guardian can print untrue stories without being sued for libel is false.
And, of course, the weasel words. Their intention was not to weaken the crypto, that was a side effect. The intention was to pocket $10mil and perhaps a favor to be named later.
I don't think you could prove they were lying even if they were open source. All looking at the source code would tell you is that they implemented Dual_EC_DRBG; exactly the same as looking at the OpenSSL source code will tell you. I doubt there would be a handy comment saying "/* Implemented a known-weak method on behalf of the NSA. */" around it.
The problem Dual_EC_DRBG, as far as I can tell, is in the choice of constants used in it; the constants are defined by the NIST standard.
Yeah, I had a sig once; I got bored of it.
I do not trust Snowden just because he is Snowden. I do not know that guy in person. I only heard of his name after what he has disclosed what NSA had done - PRISM / GCHQ / tapping on foreign leaders, and so on.
Every single "story" about a leak that has been linked to Snowden file is just that, a "story".
After reading them, I re-traced the link back to the matter itself. If there are articles related to the matter, I give them a good read up.
The case regarding RSA for example - there have been case studies since 2006 (and earlier) that can be used as reference to what has just been reported.
That is why I say it is a very sad day when my country has turned into something worse than a banana republic.
Muchas Gracias, Señor Edward Snowden !
Snowden: 100% accuracy so far.
RSA: For profit company that looks really bad right now and there's no downside to them lying.
I'll go with the 100% guy with nothing to gain.
And before you have pity on US firms losing this cash, remember that they have been knowingly aiding the NSA and the CIA and any other government entity that came knocking for years, and they would still be handing over our data (and they probably still are) without any concerns had Snowden not exposed the extent of the NSA's illegal, immoral, unconstitutional, and and brazenly stupid surveillance program.
When Angela Merkel is comparing the NSA to the Stasi, we've got problems. When Chinese tech firms become more trusted than American tech firms, we've got problems. When a schmuck wearing a military costume -- which is a disgrace to people who served their country instead of their government -- lies to congress about spying on Americans and gets away with it, we've got problems. "General" Keith B. Alexander was head of Army Intelligence and missed the piles of evidence pointing towards 9/11, and even after he helped the state security apparatus morph into the world's largest and most expensive spying effort, the organization under his control has still failed to stop a single terrorist attack.
The NSA, the CIA, and Mr. Alexander are a disgrace to our country, but they are unfortunately typical of American government, and the corporations that have been colluding with them for years. They're more interested in their own careers and dollar signs than they are about upholding the Constitution, but when they are caught, they hide behind their military titles and bullshit legalese because they have no redeeming qualities as individuals or as organizations.
If it seems personal, its because it is personal. It may just be a coincidence that I am flagged constantly when I cross the border for "random" searches, but I live in a country where I can't even find out why I seem to be a magnet for the attention of the security state. For my own protection, I am not allowed to know what my government is doing. And now that the NDAA has passed, an American agent could pick me up and detain me indefinitely without a trial.
Thanks for protecting American ideals from those totalitarian invaders, Mr. Alexander. You're doing a heckuva job.
The test is simple. If Snowden lied, then the NSA and the President have nothing to charge him with. It is simple. They tried claling him a liar and a traitor guilty of treason in the same paragraph. When it was pointed out he couldn't be both they quickly stopped pretending he was lying.