Slashdot Mirror
NSA Infiltrated RSA Deeper Than Imagined
Rambo Tribble (1273454) writes "Reuters is reporting that the U.S. National Security Agency managed to have security firm RSA adopt not just one, but two security tools, further facilitating NSA eavesdropping on Internet communications. The newly discovered software is dubbed 'Extended Random', and is intended to facilitate the use of the already known 'Dual Elliptic Curve' encryption software's back door. Researchers from several U.S. universities discovered Extended Random and assert it could help crack Dual Elliptic Curve encrypted communications 'tens of thousands of times faster'."
The only question is WHY DO THEY GO ON RECORD with the bullshit denials?
Why do you think encryption was taken off the export controls list in the late 90s? It wasn't just out of the goodness of their hearts, people.
I can only hope that this sort of bullshit maneuver by RSA reflects both globally and in the USA with respect to sales. Name one Government willing to buy this equipment any longer? 10 M compared to what they're going to lose now is nothing.
that is why you don't want to have goverments around the world involved in any crypto
No wonder world's confidence in American tech companies has dropped more than sharply!
It is a calculated risk, and maybe out of habit.
“He’s not deformed, he’s just drunk!”
I'm guessing it's because they honestly believe what they are doing is necessary to keep America safe. To the point that they think lying to the people who are supposed to be overseeing them is necessary for the greater good.
Which is terrifying. Give me all the cynical, greedy, lying, corrupt asshole politicians you want. Just please, don't put zealots in power.
I can't help but wonder...
When the acts of the NSA first came to light as we now know them, there was outrage not just from the tech sector, but from the general population as well. As these stories continue coming at a steady and regular pace, I still see outrage over the infringement of our rights - and the understanding of the general slippery slope creepiness of it - from those technically inclined. But less and less are the major outlets making a fuss, and even when the general population catches wind of each new story it is increasingly met with a sarcastic, "Gee, didn't see that coming." and a shrug of the shoulders. Is the possibility of a tipping point in favor of our rights being eliminated be the increasing apathy of the greater people toward these issues? I suspect we are on the losing side. I suspect that as the stories come out, and people in general not only become desensitized - but worse, it becomes the norm. In becoming the norm it will balloon to scales and scopes unimaginable. I feel we will reach a point where the majority of people will have forgotten that it was ever any other way. Even as it continues to get worse, they will continue to forget.
Brought to you by Carl's Junior.
So those that know how, can test and verify open-source alternatives are cryptographically secure, not back-doored, and safe for people to use.
Uh, Linux geek since 1999.
Remember when the NSA was secretly changing widely-used crypto algortithms to make them stronger? I'm thinking of the DES sbox and differential cryptanalysis.
One thing's for sure, RSA is toast. They can issue all the denials they want. Nobody's ever going to trust them again.
Anyone who falls into that belief might as well be written off and put up against the wall, second in line to the people who believe that their own possession of arbitrary power is the only way to ensure the nation's safety. They can go first.
I think Mozilla needs to be cleaned of moles and it seems "Eric Rescorla" is one of them, and look where he is active:
https://tools.ietf.org/html/dr...
-- snip from reuters story -- .. Information Assurance Directorate, and an outside expert named Eric Rescorla.
Rescorla, who has advocated greater encryption of all Web traffic, works for Mozilla, maker of the Firefox web browser. He and Mozilla declined to comment. Salter did not respond to requests for comment.
-- snip --
They said it was just going to be foreplay!
America today is NOT the country my ancestors fled Eastern Europe for nor is it the country my wife and I grew up in. America is now a country run for the benefit of the wealthy, the privileged and the corporations. The CIA, NSA, FBI, DEA, etc. now exist to keep the powerful in charge and to detect and eliminate any movement that will challenge the status quo. Google "Green is the new Red"
Another day closer to redwood heaven
So those that know how, can test and verify open-source alternatives are cryptographically secure, not back-doored, and safe for people to use.
Simple question. Since I don't know or trust any of those people doing the evaluation of the open source alternatives, exactly how do you propose I trust that they are not back-doored as well? It's not a trivial question. I am not a software developer nor am I a cryptography expert. No one I know fits both categories either. Open source stuff could be absolutely riddled with holes and I'd have really no way to know. Even if numerous parties declare it safe, how can I be certain the compiled copy hasn't been tampered with?
Go google the revolutionary war and see who was running the country back then. Wealth, privileged corporate owners.
RSA are little more than a government puppet. If you are serious about security, avoid their products.
."
"RSA, now owned by EMC Corp, did not dispute the research when contacted by Reuters for comment. The company said it had not intentionally weakened security on any product and noted that Extended Random did not prove popular and had been removed from RSA's protection software in the last six months
lol. Wonder what new broke ~6 months ago.
The NSA has not been authorized to cryptanalyze American traffic, only foreign.
They have no business weakening American cryptography.
Because it's not the same data, you idiot.
And when their culture of lies and secrecy was started, in WWII when we'd secretly broken our enemies codes, it might have even been true.
I know I'm in the minority on this one, but I really don't see a problem with this. People voluntarily hand over every detail of their personal lives to Facebook, Apple and Google every single day. Why are they shocked that the NSA uses this same data for tracking? I'd be a lot more worried about private companies having access to data.
Because the people using these algorithoms arn't the ones handing out all of their information and often the information isn't theirs to hand out, for example medical institutes use them to store your information they need it you need them to have it but it is not suposed to be public or shared knowledge.
Additionally just because many people do throw all of their info at facebbok and google does not mean everyone does or that anyone should. I for example use encryption wherever possible, I use pgp to sign nearly all of my email and enrypt with others that uses it, I uses ssh to proxy much of my traffic to secure it and to keep my location privet to me. I don't share my every detail of life with every corpration on the planet. they have no right to my privet data and neither does the government. As for being woried more about the corps than government why? Can corperations arrest and imprison you? If not then you really have screwed up threat assesment abilities.
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
While there are legitimate problems, I don't think derping all over yourself offers any sort of solution, alternative, or progress.
I think people are being blinded a bit by the dual_EC_DRBG issue. It makes people think the other 3 DRBG algorithms in SP800-90A are OK.
However if your system implements FIPS140-2 compliance, there's another hole which affects all RNGs within the FIPS boundary. Please read section 4.9.2 of FIPS140-2. You will see this. I call it the FIPS entropy destroyer...
"1. If each call to a RNG produces blocks of n bits (where n > 15), the first n-bit block generated
after power-up, initialization, or reset shall not be used, but shall be saved for comparison with
the next n-bit block to be generated. Each subsequent generation of an n-bit block shall be
compared with the previously generated block. The test shall fail if any two compared n-bit
blocks are equal. "
This will eliminate all adjacent pairs, which would otherwise appear with a frequency dictated by the binomial distribution derived from the bit width of the output and for a 16 bit source, is trivially distinguishable from random with less that 1MByte of output data.
For the record, RdRand doesn't do this because I refused to put it in because it's a back door in the spec.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
EMC paid $2.6B for RSA. Could they sue the NSA for destroying the value of their property? What would be just compensation?
I can understand your feelings and I don't completely disagree with them either. However I think the issue is that many if not most people have a line they draw where everything beyond it is personal and private and they do not willingly share this information with people unless it's family or very close friends. There have been suicides over people being "outed" for their sexual preference or other intensely personal things. This is bad enough in the hands of normal bullies, but in the hands of government bullies people can be jailed, legitimate governments destroyed and illegitimate governments upheld. Commercial bullies can use secret information to coerce officials into placing outlandish restrictions on our rights as well. I could of course go on and on.
I am under no illusions that we in fact have any sort of real privacy anymore. I know that ended decades ago. However I think that we have the duty to try to make it difficult for those that want to catalog us in every way, reducing our humanity to data points. I for one will continue to try to shovel back the tide, no matter how pointless it may be.
It was. Then they lost that war.
Why is it so hard to only have politicians for a few years, then have them go away?
Adding it doesn't seem to provide any security benefits that we can figure out," said one of the authors of the study, Thomas Ristenpart of the University of Wisconsin.
Doesn't seem to? How is it SUPPOSED to work? The article says there are papers written on it. So can you reproduce the claims.. or not?
Can we get something a little more sciency sounding?
The academic researchers said it took about an hour to crack a free version of BSafe for Java using about $40,000 worth of computer equipment. It would have been 65,000 times faster in versions using Extended Random, dropping the time needed to seconds, according to Stephen Checkoway of Johns Hopkins.
Would have? Is it particularly hard to actually verify?
"It's certainly well-designed," said security expert Bruce Schneier, a frequent critic of the NSA. "The random number generator is one of the better ones."
So... there's a lot I don't understand about cryptography, but I'll go out on a shorter limb and suggest this "news" is a lot stupider than it sounds.
The NSA is what it is, whatever your feelings on the field of intelligence work, but I really doubt something known to be crackable in an hour is going to be seriously recommended for use within our government. The U.S. Government is HUGE. There is no such thing as "Hey y'all, we think you should use this spiffy new crypto algorithm", "OK boys, heyuck, make sure you don't use that broke ass new algorithm we just told everyone about".
If it's in the FIPS standard, everybody and their mother will use it within the government, period. IDK, forgive me if I feel things might be played up a bit. I mean the $10 mil figure... that's what it costs for big boys to have some enterprise software tweaked to their preference. That's not the rate you'd pay for a big company to compromise their integrity.
The only question is WHY DO THEY GO ON RECORD with the bullshit denials?
It is a calculated risk, and maybe out of habit.
Somewhere along the chain of command, though, the denials do become true. A good underling knows when to grant his masters the ultimate in plausible deniability by simply not filling them in on certain matters.
Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)
I think you fail to understand how deep the rabbit hole goes, Neo.
-- Tigger warning: This post may contain tiggers! --
As for being woried more about the corps than government why? Can corperations arrest and imprison you? If not then you really have screwed up threat assesment abilities.
This is kind of what I was getting at -- among those more concerned about privacy, everything is part of a vast government conspiracy, and they're lurking behind the next corner just waiting to imprison and torture you. I think the reality is a little different -- the US has become way too diverse even in the last 50 years to allow any one group to gain enough power to do anything major. There's 300+ million people, spread over a huge geographic area, all with different opinions on pretty much everything. Even if you did live in a mountaintop compound stockpiling ammunition for the revolution, no one would bother you unless you start using it on your neighbors. Look at how hard it is to get anything accomplished with a divided Congress...the entire country is polarized like that, and I doubt that will change anytime soon.
Companies having access to your personal data is a little different. There's an incentive to squeeze every last cent out of every single customer interaction now, and I think most people don't realize how much their data is being mined, for whatever reason. I find the increasingly focused ad targeting I've been noticing lately to be a little more invasive than an imagined threat. I'd love it if Google charged a subscription fee instead of using my data as payment for their services, but I guess they make way more from advertisers or they would have offered it as an option by now.
It worked out well for us though.
Why is it so hard to only have politicians for a few years, then have them go away?
Probably also because they had a vew "backroom" visits by the NSA who explained quite clearly that revealing or admitting to this sort of behavior will quickly get them thrown into a federal PMITA prison instead of a cushy white-collar prison. How many "hackers" have been "accidentally" put into a "real" prison who end up getting beaten nearly to death and viciously raped because they pissed off a particularly vindictive DA? (I can remember at least one. And there only needs to be one...)
If you were me, you'd be good lookin'. - six string samurai
I can refuse to join Facebook, purchase from Apple, and attempt to minimize my contact with Google. I have no such options with respect to the US government; as we have learned, even emigrating wouldn't work.
Just because some Americans don't value their privacy doesn't give the American government the idea to compromise mine.
I'm guessing it's because they honestly believe what they are doing is necessary to keep America safe.
Funny thing is that a lot of Democrats feel that way. And Hitler honestly believed he was making Germany better by eliminating all the Jews.
Whenever there is a section of government that isnt held accountable then its going to create tyranny. The only question is "how long will that take".
| The only question is WHY DO THEY GO ON RECORD with the bullshit denials?
Because they'd be put in federal prison---no parole system, extremely long sentences---if they don't. This is not an exaggeration, they were obviously forced to agree to certain national security requirements, and this is what they mean.
The USA is slightly kinder than the equivalent in China or Russia (and there's no doubt they do just as much, but no defectors)---you'd get a multiple-gunshot suicide and polonium in your tea.
I can't imagine anything deeper than "balls deep" as i originally assumed the NSA was into RSA. This leaves me dumbfounded I have written the NSA and asked for schematics on how they managed to get past balls deep, how much further they went, and did they get a whole leg in? did they get past the hips? was there a a device similar to the jaws of life employed in the process?
A good underling
Good for whom, exactly?
When we the people will reach the point of they've had enough and take this fucking country back from the hand full that somehow think it's theirs. Sign me up for when it happens. I'm ready.
Since from my perspective its gone completely terminal....... im gonna take them for the biggest fscking ride / free vacation of all time.
No. They don't believe that. That's a comfortable lie to make them appear more human.
Money. Greed. Power. These are the things that drive those sorts of people. The NSA is a collection of private contractors that enjoy their black budget. They're willing to invent boogeymen, find terrorists under every bed, and destroy your privacy to make a buck.
disgusting
Just stop playing sheep. Go and join your brothers from North Korea, hold hands and admit you are a Fucking Communist Regime called U.S.A
No, no, no. The USA is not at all like NK! We're allowed to get whatever haircut we want, not just Obama's (or our real supreme leader, Sam Walton's) haircut!
The job is the NSA is espionage ! Duh !
And that is approved and protected, as anybody else can do, by the laws of the USA. Duh !
LOL
This is like the banks and sub-prime lenders "honestly believing" that house prices would go up forever and money would always be cheap.
Read my lips: Everyone involved knew exactly what was going on.
Everyone inside the NSA with so much as a high school Diploma, when encountering even a low level program, knew that it was fundamentally wrong, probably illegal, and corrosive to the civic society. You don't even need to know what civic society is to know that tapping and permanently recording all calls in the US is both dangerous and wrong.
The on the record denials are effectively the NSA aping of the likes of John Corzine's claims of "We have no idea where the money is", despite being the man who took it right out of customers accounts. I dwell on the financial crisis because the breakdown in the rule of law, propriety, common sense, and all morality there is a mirror image and ultimately a fore-runner of the excesses and lies we now see in the NSA.
All that Keeping America Safe is BS. This is all about budgets, contracts, staffing levels, prestige and power seeking on the part of an entire city block of executives, officers, and IT workers throughout the NSA. The purpose of the NSA is to procure BMWs and range rovers for its management, and for favored private contractors and sub-contractors. That is why the price of a incorporated city is being spent on all these ludicrously overblown surveillance programs.
Forget the lies. Follow the money. Men will do anything, say anything, to anyone to keep such a gravy train flowing.
May the Maths Be with you!
+1
The road to hell is paved with good intentions.
Re: WHY DO THEY GO ON RECORD
If you make a fuss you join
"Only One Big Telecom CEO Refused To Give The NSA The Access It Wanted... And He's Been In Jail For 4 Years"
http://www.businessinsider.com...
Former CEO Says U.S. Punished Phone Firm
http://www.washingtonpost.com/...
NSA Domestic Surveillance Began 7 Months Before 9/11, Convicted Qwest CEO Claims
http://www.wired.com/2007/10/n...
Domestic spying is now "Benign Information Gathering"
You should decide on the solution then agitate for it. For example, one might say Proportional Representation is a solution, as it permits for a broader spectrum of parties/mandates/issues to be represented. (This is my opinion having voted in UK for ~ 4 elections).
Psssst... President Regan laid this groundwork during the Iran-Contra trial with "I don't recall".
Anyone who falls into that belief might as well be written off and put up against the wall.
This would result in a dramatic reduction of the population of the USA. I have never seen a country as full of *braindead patriots as the USA.
*Not implying patriotism is stupid, just that a disproportionate number of patriots in the USA are actually braindead.
America has always had good and evil, side by side. Remember Lincoln was right there along slavery. Benedict Arnold and Washington. Even the puritans were impressive and horrifying at the same time.
America has not changed.
"First they came for the slanderers and i said nothing."
Nice, but it relies on unreliable sources to make these assumptions. When they can do it without handling improperly disclosed material, perhaps they might have a point.
The silver lining of it is that these individuals won't be getting clearances anytime soon.
Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
FWIW, BMW is a budget brand these days
The ratio of people to cake is too big
Ah, time for an _Independance Day_ quote.
Why the hell wasn't I told about this place?
Two words Mister President: Plausible deniability.
> _Independance Day_ quote.
Diiiiiiiiiiiiiiiieeeeee
The masters, you fool. Imps may burn in hell. That's where they belong. Keep your masters happy. Smile. They won't save you if feces hit rotating things, but they might remember how stupidly loyal you were, and thank themselves for finding such a fool to work for them.
I find it kinda funny how americans think nationalism is good when it's them and called patriotism, and bad when it's called nationalism in other countries. Also, americans look the second most foolish with their flags. The most idiotic are the rag heads(yeah, call me racist. Wearing a rag on your head is not a race..) who are waving burning american flags. I always hope they catch fire and get burned. I mean, they are so annoying I can almost forgive US for blindly dropping bombs around their turf.
Yes. I think you have nailed it, right on the head.
-kgj
Read Herbert Yardley. It started much earlier.
Nice of you to advertise what a shitplace the U.S. is.
But actually, my father, a Luftwaffe POW in U.S. hands told me: Another German POW did not admit the shooting of a US airman until they drove over his foot with a truck.
So, nothing to see here.
...you use the horse carriage instead of this horrible German, socialist inventions which drive those Petrol/Diesel cars.
"We already know you have sex with your wife, why does it bother you if we watch?"