5 ms·

Do we know if this is intentional or not? Because this is probably the kind of thing NSA would love to implement.

tptacek 9y ago
No, it's the opposite of the kind of thing NSA "loves to implement". The only reason this bug took so long to find is that it's a hardware/firmware bug, and you have to take the time to survey hardware RSA key generation to find it. Despite that fact, a bunch of grad students found it. Once you know the broken shortcut Infineon uses to generate primes, working out the exploit is itself academic. See, for instance, the name of the attack (ROCA) and what it stands for. The NSA wants cryptographic vulnerabilities that are cryptographically "NOBUS". Dual_EC was a useful backdoor (if surprisingly clunky) because even if you understand the weakness, you can't take advantage of it without having custody of a private key.
- phkahler 9y ago
  >> The NSA wants cryptographic vulnerabilities that are cryptographically "NOBUS". That depends on who is going to use the vulnerable system and for what purpose.
  - tptacek 9y ago
    How? In what situation does NSA ever benefit from a vulnerability that its adversaries can exploit?
    - akvadrako 9y ago
      plausible deniability. Or honey pots - first compromise a 3rd party target, then wait for your adversary to think they broke in. Either trace them back or plant false data.
      - tptacek 9y ago
        How does a NOBUS vulnerability cost them plausible deniability? To prove it's their vulnerability, you have to know the private key that matches a public key. If you're setting up a honeypot, why would you use an extremely complex cryptographic vulnerability? There's tens of thousands of straightforward software vulnerabilities that allow you to set up honeypots. These don't sound like plausible reasons for NSA to effectively allow its own assets to be compromised needlessly.
        akvadrako 9y ago
        > How does a NOBUS vulnerability cost them plausible deniability? To prove it's their vulnerability, you have to know the private key that matches a public key. Of course not. If the public key came from the intelligence community and is a possible vector for attack, then a successful attack implicates them as the likely holders of the private key. BTW, "plausibility" doesn't imply "proof". > If you're setting up a honeypot, why would you use an extremely complex cryptographic vulnerability? Because of it's complexity, the honey pot is less suspicious to your adversary. If you compromise a 3rd party, then install a straightforward vulnerability, that raises flags. But letting your adversary compromise the system using the same vulnerability as you is perfectly natural.
    - flukus 9y ago
      Oh, that must be why they disclosed all those vulnerabilities they found instead of exploiting them... The NSA finds and exploits vulnerabilities for their own uses, suggesting that they might create some is hardly a stretch.

No, it's the opposite of the kind of thing NSA "loves to implement". The only reason this bug took so long to find is that it's a hardware/firmware bug, and you have to take the time to survey hardware RSA key generation to find it. Despite that fact, a bunch of grad students found it. Once you know the broken shortcut Infineon uses to generate primes, working out the exploit is itself academic. See, for instance, the name of the attack (ROCA) and what it stands for. The NSA wants cryptographic vulnerabilities that are cryptographically "NOBUS". Dual_EC was a useful backdoor (if surprisingly clunky) because even if you understand the weakness, you can't take advantage of it without having custody of a private key.

phkahler 9y ago
>> The NSA wants cryptographic vulnerabilities that are cryptographically "NOBUS". That depends on who is going to use the vulnerable system and for what purpose.
- tptacek 9y ago
  How? In what situation does NSA ever benefit from a vulnerability that its adversaries can exploit?
  - akvadrako 9y ago
    plausible deniability. Or honey pots - first compromise a 3rd party target, then wait for your adversary to think they broke in. Either trace them back or plant false data.
    - tptacek 9y ago
      How does a NOBUS vulnerability cost them plausible deniability? To prove it's their vulnerability, you have to know the private key that matches a public key. If you're setting up a honeypot, why would you use an extremely complex cryptographic vulnerability? There's tens of thousands of straightforward software vulnerabilities that allow you to set up honeypots. These don't sound like plausible reasons for NSA to effectively allow its own assets to be compromised needlessly.
      - akvadrako 9y ago
        > How does a NOBUS vulnerability cost them plausible deniability? To prove it's their vulnerability, you have to know the private key that matches a public key. Of course not. If the public key came from the intelligence community and is a possible vector for attack, then a successful attack implicates them as the likely holders of the private key. BTW, "plausibility" doesn't imply "proof". > If you're setting up a honeypot, why would you use an extremely complex cryptographic vulnerability? Because of it's complexity, the honey pot is less suspicious to your adversary. If you compromise a 3rd party, then install a straightforward vulnerability, that raises flags. But letting your adversary compromise the system using the same vulnerability as you is perfectly natural.
  - flukus 9y ago
    Oh, that must be why they disclosed all those vulnerabilities they found instead of exploiting them... The NSA finds and exploits vulnerabilities for their own uses, suggesting that they might create some is hardly a stretch.