3 ms·

I think the most informative part of this writeup is this: Niels Ferguson and Dan Shumow demonstrated that if the points are not randomly generated, but carefu

I think the most informative part of this writeup is this: Niels Ferguson and Dan Shumow demonstrated that if the points are not randomly generated, but carefully chosen in advance, the security of Dual_EC DRBG can be subverted by the party doing the choosing; effectively backdooring the PRNG. Namely if one chooses P, Q such that Q=Pe holds for a value e that is kept secret, it will allow the party that generated said P, Q to recover the internal state of the PRNG from observed output in a computationally “cheap fashion” – hence instances of Dual_EC PRNG for which the provenance of the points P and Q is unknown are susceptible to having been backdoored.* What assurance is there that the Q chosen by Juniper isn't subject to that type of backdoor vulernability? Why is Juniper using Dual_EC DRBG anyways? Aren't there other PRNG that are considered more robust?

adrtessier 11y ago
> Why is Juniper using Dual_EC DRBG anyways? As a follow-on question: was NetScreen using Dual_EC_DRBG before Juniper bought them (and with it ScreenOS?) If so, it might be good to scrutinize the original NetScreen owners and where they are now (hint: They now run Fortinet and Palo Alto Networks. Are they at risk of interesting, compromised security choices, now, too?) And you're right. Juniper could still have their own e, which renders the security pointless.
jvdh 11y ago
Yes, just about any PRNG is more robust than DUAL_EC. It's hard to implement correctly, its performance in software "is rotten"[0]. And even before the backdoor was discovered, the constants were suspect, and you can never get rid of that in your own implementation, as you have to generate those numbers then, then you are suspect. [0]: http://blog.cryptographyengineering.com/2013/12/a-few-more-notes-on-nsa-random-number.html http://blog.cryptographyengineering.com/2013/12/a-few-more-n...

adrtessier 11y ago

> Why is Juniper using Dual_EC DRBG anyways? As a follow-on question: was NetScreen using Dual_EC_DRBG before Juniper bought them (and with it ScreenOS?) If so, it might be good to scrutinize the original NetScreen owners and where they are now (hint: They now run Fortinet and Palo Alto Networks. Are they at risk of interesting, compromised security choices, now, too?) And you're right. Juniper could still have their own e, which renders the security pointless.

jvdh 11y ago

Yes, just about any PRNG is more robust than DUAL_EC. It's hard to implement correctly, its performance in software "is rotten"[0]. And even before the backdoor was discovered, the constants were suspect, and you can never get rid of that in your own implementation, as you have to generate those numbers then, then you are suspect. [0]: http://blog.cryptographyengineering.com/2013/12/a-few-more-notes-on-nsa-random-number.html http://blog.cryptographyengineering.com/2013/12/a-few-more-n...