Slashdot Mirror
NSA Infiltrated RSA Deeper Than Imagined
Rambo Tribble (1273454) writes "Reuters is reporting that the U.S. National Security Agency managed to have security firm RSA adopt not just one, but two security tools, further facilitating NSA eavesdropping on Internet communications. The newly discovered software is dubbed 'Extended Random', and is intended to facilitate the use of the already known 'Dual Elliptic Curve' encryption software's back door. Researchers from several U.S. universities discovered Extended Random and assert it could help crack Dual Elliptic Curve encrypted communications 'tens of thousands of times faster'."
I can only hope that this sort of bullshit maneuver by RSA reflects both globally and in the USA with respect to sales. Name one Government willing to buy this equipment any longer? 10 M compared to what they're going to lose now is nothing.
I'm guessing it's because they honestly believe what they are doing is necessary to keep America safe. To the point that they think lying to the people who are supposed to be overseeing them is necessary for the greater good.
Which is terrifying. Give me all the cynical, greedy, lying, corrupt asshole politicians you want. Just please, don't put zealots in power.
I can't help but wonder...
When the acts of the NSA first came to light as we now know them, there was outrage not just from the tech sector, but from the general population as well. As these stories continue coming at a steady and regular pace, I still see outrage over the infringement of our rights - and the understanding of the general slippery slope creepiness of it - from those technically inclined. But less and less are the major outlets making a fuss, and even when the general population catches wind of each new story it is increasingly met with a sarcastic, "Gee, didn't see that coming." and a shrug of the shoulders. Is the possibility of a tipping point in favor of our rights being eliminated be the increasing apathy of the greater people toward these issues? I suspect we are on the losing side. I suspect that as the stories come out, and people in general not only become desensitized - but worse, it becomes the norm. In becoming the norm it will balloon to scales and scopes unimaginable. I feel we will reach a point where the majority of people will have forgotten that it was ever any other way. Even as it continues to get worse, they will continue to forget.
Brought to you by Carl's Junior.
So those that know how, can test and verify open-source alternatives are cryptographically secure, not back-doored, and safe for people to use.
Uh, Linux geek since 1999.
How? Easy for me, I was alive and paying attention.
The problem wasn't so much that good tools from American sources were unavailable, they were just subject to onerous restrictions, that made it hard to distribute. So producers of software were stuck either producing an "international" version which was easy to distribute and download, but had restrictive key length limits and a seperate, harder to download version for the US.
So yes, European tools were generally better, because they were not under such restrictions, and worked just fine in or outside the US. A lot of people in the US even used pgp "international" version just because it was easier.
It really was little more than a lame attempt to stuff a genie back in a bottle; after the bottom was smashed off. The ONLY thing it served to do was make the US into a laughing stock.
"I opened my eyes, and everything went dark again"
Remember when the NSA was secretly changing widely-used crypto algortithms to make them stronger? I'm thinking of the DES sbox and differential cryptanalysis.
One thing's for sure, RSA is toast. They can issue all the denials they want. Nobody's ever going to trust them again.
Anyone who falls into that belief might as well be written off and put up against the wall, second in line to the people who believe that their own possession of arbitrary power is the only way to ensure the nation's safety. They can go first.
I think Mozilla needs to be cleaned of moles and it seems "Eric Rescorla" is one of them, and look where he is active:
https://tools.ietf.org/html/dr...
-- snip from reuters story -- .. Information Assurance Directorate, and an outside expert named Eric Rescorla.
Rescorla, who has advocated greater encryption of all Web traffic, works for Mozilla, maker of the Firefox web browser. He and Mozilla declined to comment. Salter did not respond to requests for comment.
-- snip --
America today is NOT the country my ancestors fled Eastern Europe for nor is it the country my wife and I grew up in. America is now a country run for the benefit of the wealthy, the privileged and the corporations. The CIA, NSA, FBI, DEA, etc. now exist to keep the powerful in charge and to detect and eliminate any movement that will challenge the status quo. Google "Green is the new Red"
Another day closer to redwood heaven
RSA are little more than a government puppet. If you are serious about security, avoid their products.
."
"RSA, now owned by EMC Corp, did not dispute the research when contacted by Reuters for comment. The company said it had not intentionally weakened security on any product and noted that Extended Random did not prove popular and had been removed from RSA's protection software in the last six months
lol. Wonder what new broke ~6 months ago.
I think people are being blinded a bit by the dual_EC_DRBG issue. It makes people think the other 3 DRBG algorithms in SP800-90A are OK.
However if your system implements FIPS140-2 compliance, there's another hole which affects all RNGs within the FIPS boundary. Please read section 4.9.2 of FIPS140-2. You will see this. I call it the FIPS entropy destroyer...
"1. If each call to a RNG produces blocks of n bits (where n > 15), the first n-bit block generated
after power-up, initialization, or reset shall not be used, but shall be saved for comparison with
the next n-bit block to be generated. Each subsequent generation of an n-bit block shall be
compared with the previously generated block. The test shall fail if any two compared n-bit
blocks are equal. "
This will eliminate all adjacent pairs, which would otherwise appear with a frequency dictated by the binomial distribution derived from the bit width of the output and for a 16 bit source, is trivially distinguishable from random with less that 1MByte of output data.
For the record, RdRand doesn't do this because I refused to put it in because it's a back door in the spec.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
The only question is WHY DO THEY GO ON RECORD with the bullshit denials?
It is a calculated risk, and maybe out of habit.
Somewhere along the chain of command, though, the denials do become true. A good underling knows when to grant his masters the ultimate in plausible deniability by simply not filling them in on certain matters.
Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)
A good underling
Good for whom, exactly?
This is like the banks and sub-prime lenders "honestly believing" that house prices would go up forever and money would always be cheap.
Read my lips: Everyone involved knew exactly what was going on.
Everyone inside the NSA with so much as a high school Diploma, when encountering even a low level program, knew that it was fundamentally wrong, probably illegal, and corrosive to the civic society. You don't even need to know what civic society is to know that tapping and permanently recording all calls in the US is both dangerous and wrong.
The on the record denials are effectively the NSA aping of the likes of John Corzine's claims of "We have no idea where the money is", despite being the man who took it right out of customers accounts. I dwell on the financial crisis because the breakdown in the rule of law, propriety, common sense, and all morality there is a mirror image and ultimately a fore-runner of the excesses and lies we now see in the NSA.
All that Keeping America Safe is BS. This is all about budgets, contracts, staffing levels, prestige and power seeking on the part of an entire city block of executives, officers, and IT workers throughout the NSA. The purpose of the NSA is to procure BMWs and range rovers for its management, and for favored private contractors and sub-contractors. That is why the price of a incorporated city is being spent on all these ludicrously overblown surveillance programs.
Forget the lies. Follow the money. Men will do anything, say anything, to anyone to keep such a gravy train flowing.
May the Maths Be with you!
No, because the PHBs at EMC/RSA already accepted payment from the NSA. Someone should be fired over the fact that a $2.6B investment was hugely devalued for a payment of only $10M.
The real "Libtards" are the Libertarians!