3 ms·
I think it's less of an "NSA directly did this" and more of a "NSA invented cryptography that absolutely no one thought was a good idea." The juicy bit, and th
by nickysielicki 11y ago
I think it's less of an "NSA directly did this" and more of a "NSA invented cryptography that absolutely no one thought was a good idea."
The juicy bit, and the piece that really is obnoxiously bad, is that NIST, who decides cryptographic standards, contracted out to two agencies when they were looking at introducing new cryptography in 2006. Those two agencies? RSA and NSA. They paid both of these organizations for the privilege of getting insight.
NSA had been pushing for Dual_EC for a couple years at this point, and wanting people to take the bait, they secretly gave $10 million to RSA for them to start using it in some of their products and for them to tell NIST that they thought it was cryptographically sound. All completely behind the back of NIST and the public.
So NIST is consulting out with two of the biggest names in cryptography, one of which had been championing Dual_EC for years (NSA), and one of which started using it in their products (which are primarily sold to government agencies that MUST use NIST-approved crypto, and presumably stood to lose a lot of money by "betting" on Dual_EC).
NIST never saw it coming.
And that's the irony of the whole thing. NSA is supposed to make the US, especially the US government, more technologically secure... yet they directly undermined cryptography that was predominately used by government agencies. Meanwhile the rest of the tech world saw it for the bullshit it was. The only people who were hurt by it was our government.
Thomas Massie gave a great speech to congress about this earlier this year, and pushed through a vote that now prevents NIST from contracting out with NSA. I wish I could find it.
(Aside: Thomas Massie, a congressman from Kentucky, graduated from MIT with a BS in EE and a MS in ME, founded a successful tech startup, and now serves on the Committee on Science, Space and Technology. One of the few cases where I feel someone in our government is adequately educated in what they rule over.)
- atmosx 11y ago> NIST never saw it coming. How so? The NSA is a spy agency, they are the one institution that you clearly should NOT ask. BTW I love the USA Committee on Science, Space and Technology[1], full of geniuses. [1] https://www.youtube.com/watch?v=lPgZfhnCAdI&spfreload=10 https://www.youtube.com/watch?v=lPgZfhnCAdI&spfreload=10
- nickysielicki 11y agoIt's hard to remember what the world was like in 2006, but no one thought the NSA had gone rogue back then.
- maxerickson 11y agoExcept Congress? http://www.cnn.com/2006/POLITICS/01/01/nsa.spying/ http://www.cnn.com/2006/POLITICS/01/01/nsa.spying/ Or does criticizing the executive branch by calling their phone monitoring program illegal not reach the bar set by gone rogue?
- nickysielicki 11y agoWell to that point, NSA contracted out both with NSA and with RSA. At least they didn't give NSA their complete trust. The nasty part is that NSA went behind the backs of everyone and bribed RSA for their own nefarious purposes. I don't think anyone saw that coming.
- acdha 11y agoThat's certainly true now but it hasn't always been such a given because the NSA has a defensive mission, even if they've grossly neglected it, and in the past acted to make crypto standards safer: https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_involvement_in_the_design https://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.2...
- nyolfen 11y ago> How so? The NSA is a spy agency, they are the one institution that you clearly should NOT ask. also the largest employer of cryptographers in the world, and is routinely sought for input by NIST, usually to no ill consequence
- nickysielicki 11y agoEDIT: Just saw that this recent Omnibus budget bill stripped out his restriction at the last minute. NIST can still pay NSA to lie to them.