7 ms·

RSA chief believed cryptographers’ warnings on Dual EC DRBG lacked merit (2014)

185 points by jalcazar 5y ago

trasz 5y ago
RSA, being American company, cannot refuse NSA’s backdoors. Discovery of the backdoor hurt RSA’s business, so it’s understandable RSA has beef with them.
- elmo2you 5y ago
  Since when can they not refuse a NSA backdoor? Where does the mandate come from, with which the NSA supposedly can instruct commercial/private entities to integrate technological back doors? Does it even have such a legal mandate. I'm sure the NSA will argue that they do, but that doesn't mean they actually have it.
  - trasz 5y ago
    Some of the ways are already known: your company can be denied lucrative government contracts if you deny. Or you might learn you can't export your products due to export restrictions. Other ways are known to exist, but details are not available yet - go read about National Security Letters, or kangaroo "secret courts".
    - HappySweeney 5y ago
      Not that I don't agree, but how do you know the secret courts are kangaroo?
      - kook_throwaway 5y ago
        The fact that it's secret. Also that you aren't even allowed to show up to defend yourself. [1] Also that they denied 11 out of 34,000 requests over a 35 year period. Also that the judges are appointed by one person and don't even need congressional approval. How could it possibly not be a kangaroo court? [1] https://en.m.wikipedia.org/wiki/Ex_parte https://en.m.wikipedia.org/wiki/Ex_parte
      - Spooky23 5y ago
        Courts that aren’t adversarial are just interpreting law. Secrecy makes it worse by eliminating accountability by the petitioner and judge. For a non-secret example, look at the Social Security “fair hearings”, where an administrative law judge basically listens to a petition and makes a decision. The standards vary significantly by locale.
  - bdamm 5y ago
    Government buyers that are less important (e.g. state level tollways) would be mandated to buy the backdoored algorithm by having the federal government cook it into a specification of how to buy tollway equipment, for example. Once the backdoored algorithm is in the product suite, it can be put to work on a more tactical level.
- rdtsc 5y ago
  > RSA, being American company, cannot refuse NSA’s backdoors. The key is selling to American government, and any entity related to it. But no, they can't mandate RSA build anything. Of course, if they refuse, they'll find another company which would, pay them lots of money, and then issue a certification requirement that only this particular backdoor algorithm is "approved" and then wait for RSA to go out of business.
- er4hn 5y ago
  This wasn't added via a secret order however. RSA had a business agreement with the NSA to add the backdoor. RSA was paid $10 Million for this.
johnklos 5y ago
From the wonderful fortune(6) database: Anyone who is capable of getting themselves made President should on no account be allowed to do the job. -- Douglas Adams, "The Hitchhiker's Guide to the Galaxy" I think the RSA chief can be trusted to do what's in the best financial interest of the RSA, even when that is in contradiction of the correct thing, so long as there's plausible deniability. I'm glad this is being brought up and not forgotten.
- deleted 5y ago
  [deleted]
DaftDank 5y ago
Reading about this saga in Ben Buchanan's book "The Hacker and the State" made me realize how every government agency (NIST in this case) seems to be always second fiddle to the "needs" of the NSA/national security apparatus. It seems clear from the book that there was a point in time when they essentially just left it in the NSA's hands to develop, knowing it was probably not secure. Not exactly some huge revelation that the national security apparatus can exert power and leverage over other government groups, or even private companies, but the extent to which it happens was surprising.
- nullc 5y ago
  Budiansky's Code Warriors emphasized the point that the NSA and its precursors has actively withheld information from the civilian government, including the president. Unfortunately, the very secrecy of it prevent us from knowing the full extent, we only know of the specific cases where its been documented.
- er4hn 5y ago
  Another problem is how NIST should come up with standards. NIST is in charge of standards, but that means that they need to turn to subject matter experts for each separate field. They need to define the standards for everything from measuring weights, to chemicals in wastewater, to cryptography. So then for each standard you then end up with the government equivalent of an open process where there are requests for comments, maybe a meeting or two to discuss, and trusted folks end up defining the bulk of the document with oversight from editors. Where this breaks down is when you have the subject matter expert on crypto in government, the NSA, be interested in undermining the standards for their own specialty to serve their internal agenda.
sneak 5y ago
It's important to remember that RSA received cash payments from the USG to backdoor this. It wasn't just an "oops, we were insufficiently vigilant". They actively participated.
- some_furry 5y ago
  I feel like this detail isn't emphasized enough in the coverage of RSA's participation with Dual EC. Wasn't it like $10 million?
  - sneak 5y ago
    This is important to remember when you see industry professionals paying money to RSA to attend their events, or, worse yet, speaking at them. Supporting those who make us less safe is a clear signal about where your priorities lie.
- elmo2you 5y ago
  > They actively participated. And that, in my opinion, makes them a criminal enterprise. Maybe not within a US context, for arguable the US government gave them a mandate for this deception. But within an international context they should probably be held accountable and barred from doing business abroad (as they are essentially an agent/extension of a US intel agency). Never going to happen, of course. Not with how that whole industry operates. But that only shows how little the whole lot of them and their industry should not be trusted in the first place.
- nickysielicki 5y ago
  It's slightly more complicated than that: There's 3 parties at play in this story. NSA, RSA, and NIST. NIST was evaluating dual_ec_drbg for certification for government usage, with people from NSA heavily pushing it. NIST was actively contracting out to RSA to evaluate it for weaknesses. The kicker is here: NSA then secretly paid RSA something like $10M to advocate strongly for dual_ec_drbg, behind the back of NIST. So you have one government agency spending money on a contractor, hoping for an honest expert opinion, then another government agency spending money on a contractor secretly so that the second government agency can sneak something behind the first government agency. It's insanity. Sure, RSA should not have taken the money from NSA, but given that NIST crypto certification mostly matters to government implementations (and not to the private sector), isn't the bigger problem that NSA is happy to introduce backdoors into crypto exclusively used by other government agencies? It's traitorous. Thomas Massie offered an amendment in the house to try to stop this. He gave a pretty good overview of the situation (he is an electrical and mechanical engineer from MIT) to the house when the amendment was brought to the floor. https://www.govtrack.us/congress/votes/114-2015/h290 https://www.govtrack.us/congress/votes/114-2015/h290 (strangely, the video has been sort of cut on cspan. It's supposed to be at 3:17:11 https://www.c-span.org/video/?326244-2/us-house-debate-fy-2016-spending&start=38577&transcriptSpeaker=64005 https://www.c-span.org/video/?326244-2/us-house-debate-fy-20... )
nullc 5y ago
WHAT DID YOU SAY? I CANT HEAR YOU OVER THE SOUND OF THE $10 MILLION DOLLARS THAT JUST SPONTANEOUSLY LANDED IN MY LAP. CONCERNS? YES I AM CONCERNED THAT IF I AM NOT HELPFUL THE CIA WILL NOT COLLUDE WITH THE GERMANS TO PURCHASE MY COMPANY OUTRIGHT AND USE IT FOR DECADES TO SHIP BACKDOORED CRYPTOGRAPHIC PRODUCTS LIKE THEY DID WITH CRYPTO AG. WHAT WAS THAT YOU WERE SAYING ABOUT COWS AND FREE MILK?
fmajid 5y ago
It is difficult to get a man to understand something when his salary depends upon his not understanding it. — Upton Sinclair
tptacek 5y ago
Two things real quick: Art Coviello is a salesman who headed the company that bought RSA and took the name. It would be a little weird to expect him to meaningfully know what a cryptographer even is. The idea that Coviello would himself be weighing NIST against crypto eprints is pretty silly. And, more importantly, the only important cite here is Shumow and Ferguson. Schneier didn't analyze Dual EC (he never did work in elliptic curves at all, and claimed not to trust their math); here, he's simply reporting on Shumow and Ferguson's paper, and he doesn't even say Dual EC was backdoored. Nor, for that matter, do the cites before Shumow and Ferguson. (Before anyone jumps on my back about this: I basically shared Schneier's take on this, that Dual EC was too conspicuous to really be a backdoor, and that the right response was to ignore and never use it. I was wildly wrong about how prevalent Dual EC was --- I couldn't imagine any sane engineer adopting it, because it's slow and gross. If I'd known before the BULLRUN revelations that, for instance, every Juniper VPN box was using Dual EC, I'd have been a lot more alarmed and a lot less charitable about it. Oh well, live and learn.)
- S_A_P 5y ago
  Not disagreeing with your take, but I think its important to note that I just don't see it being possible that Art came up with his take without any input from folks in the company. I would imagine there were meetings where these talking points were constructed. Right?
  - tptacek 5y ago
    I think it seems crazy now, but that's because we know a lot more about the practical applications of malicious RNGs; they aren't an abstract concern now. But they kind of were when the big debate was alleged to have happened at RSA. Also: I'm naturally going to sound like I'm defending RSA here, and I am not. I feel like --- I'll probably be proven wrong by this in time because we live in a fallen world --- no major company in the world would in 2021 swap out a crucial cryptographic component for one DOD was demanding while cryptographers were making noise about how janky it is. That should have been the standard in 2007 or whatever, too.
    - 5y ago
adyavanapalli 5y ago
The link to the keynote wasn't resolving in the article, so here's the YouTube link: https://youtu.be/aB2gG-cRj10 https://youtu.be/aB2gG-cRj10
bdamm 5y ago
We keep having this come up with some of the EC curves like NIST P-256 for example. There's no evidence that it is actually backdoored, but the consensus seems to be that the construction is suspicious, unlike the construction for SHA-2. What do we do with it? Not many in a product development team that is interacting with other companies or organizations can meaningfully defend not using a NIST curve because it looks suspicious.
CamperBob2 5y ago
nullc's flagged comment may not have been the best way to get the point across, but it's an important point nevertheless. Conversations about the US intelligence community's repeated attempts to suppress and subvert modern encryption standards never seem to mention Crypto AG, perhaps the most egregious example we know about. A great article just came out that highlights some of the shenanigans: https://spectrum.ieee.org/the-scandalous-history-of-the-last-rotor-cipher-machine https://spectrum.ieee.org/the-scandalous-history-of-the-last... ... In 1966, the relationship among CAG, the NSA, and the CIA went to the next level. That year, the NSA delivered to its Swiss partner an electronic enciphering system that became the basis of a CAG machine called the H-460. Introduced in 1970, the machine was a failure. However, there were bigger changes afoot at CAG: That same year, the CIA and the German Federal Intelligence Service secretly acquired CAG for US $5.75 million. I'm surprised no one has submitted this one, actually.
- a1369209993 5y ago
  > I'm surprised no one has submitted this one, actually. They did: https://news.ycombinator.com/item?id=28378734 https://news.ycombinator.com/item?id=28378734
baby 5y ago
My explanation of the backdoor: https://youtu.be/OkiVN6z60lg https://youtu.be/OkiVN6z60lg

185 points by jalcazar 5y ago

RSA, being American company, cannot refuse NSA’s backdoors. Discovery of the backdoor hurt RSA’s business, so it’s understandable RSA has beef with them.

elmo2you 5y ago
Since when can they not refuse a NSA backdoor? Where does the mandate come from, with which the NSA supposedly can instruct commercial/private entities to integrate technological back doors? Does it even have such a legal mandate. I'm sure the NSA will argue that they do, but that doesn't mean they actually have it.
- trasz 5y ago
  Some of the ways are already known: your company can be denied lucrative government contracts if you deny. Or you might learn you can't export your products due to export restrictions. Other ways are known to exist, but details are not available yet - go read about National Security Letters, or kangaroo "secret courts".
  - HappySweeney 5y ago
    Not that I don't agree, but how do you know the secret courts are kangaroo?
    - kook_throwaway 5y ago
      The fact that it's secret. Also that you aren't even allowed to show up to defend yourself. [1] Also that they denied 11 out of 34,000 requests over a 35 year period. Also that the judges are appointed by one person and don't even need congressional approval. How could it possibly not be a kangaroo court? [1] https://en.m.wikipedia.org/wiki/Ex_parte https://en.m.wikipedia.org/wiki/Ex_parte
    - Spooky23 5y ago
      Courts that aren’t adversarial are just interpreting law. Secrecy makes it worse by eliminating accountability by the petitioner and judge. For a non-secret example, look at the Social Security “fair hearings”, where an administrative law judge basically listens to a petition and makes a decision. The standards vary significantly by locale.
- bdamm 5y ago
  Government buyers that are less important (e.g. state level tollways) would be mandated to buy the backdoored algorithm by having the federal government cook it into a specification of how to buy tollway equipment, for example. Once the backdoored algorithm is in the product suite, it can be put to work on a more tactical level.
rdtsc 5y ago
> RSA, being American company, cannot refuse NSA’s backdoors. The key is selling to American government, and any entity related to it. But no, they can't mandate RSA build anything. Of course, if they refuse, they'll find another company which would, pay them lots of money, and then issue a certification requirement that only this particular backdoor algorithm is "approved" and then wait for RSA to go out of business.
er4hn 5y ago
This wasn't added via a secret order however. RSA had a business agreement with the NSA to add the backdoor. RSA was paid $10 Million for this.

johnklos 5y ago

From the wonderful fortune(6) database: Anyone who is capable of getting themselves made President should on no account be allowed to do the job. -- Douglas Adams, "The Hitchhiker's Guide to the Galaxy" I think the RSA chief can be trusted to do what's in the best financial interest of the RSA, even when that is in contradiction of the correct thing, so long as there's plausible deniability. I'm glad this is being brought up and not forgotten.

deleted 5y ago
[deleted]

DaftDank 5y ago

Reading about this saga in Ben Buchanan's book "The Hacker and the State" made me realize how every government agency (NIST in this case) seems to be always second fiddle to the "needs" of the NSA/national security apparatus. It seems clear from the book that there was a point in time when they essentially just left it in the NSA's hands to develop, knowing it was probably not secure. Not exactly some huge revelation that the national security apparatus can exert power and leverage over other government groups, or even private companies, but the extent to which it happens was surprising.

nullc 5y ago
Budiansky's Code Warriors emphasized the point that the NSA and its precursors has actively withheld information from the civilian government, including the president. Unfortunately, the very secrecy of it prevent us from knowing the full extent, we only know of the specific cases where its been documented.
er4hn 5y ago
Another problem is how NIST should come up with standards. NIST is in charge of standards, but that means that they need to turn to subject matter experts for each separate field. They need to define the standards for everything from measuring weights, to chemicals in wastewater, to cryptography. So then for each standard you then end up with the government equivalent of an open process where there are requests for comments, maybe a meeting or two to discuss, and trusted folks end up defining the bulk of the document with oversight from editors. Where this breaks down is when you have the subject matter expert on crypto in government, the NSA, be interested in undermining the standards for their own specialty to serve their internal agenda.

sneak 5y ago

It's important to remember that RSA received cash payments from the USG to backdoor this. It wasn't just an "oops, we were insufficiently vigilant". They actively participated.

some_furry 5y ago
I feel like this detail isn't emphasized enough in the coverage of RSA's participation with Dual EC. Wasn't it like $10 million?
- sneak 5y ago
  This is important to remember when you see industry professionals paying money to RSA to attend their events, or, worse yet, speaking at them. Supporting those who make us less safe is a clear signal about where your priorities lie.
elmo2you 5y ago
> They actively participated. And that, in my opinion, makes them a criminal enterprise. Maybe not within a US context, for arguable the US government gave them a mandate for this deception. But within an international context they should probably be held accountable and barred from doing business abroad (as they are essentially an agent/extension of a US intel agency). Never going to happen, of course. Not with how that whole industry operates. But that only shows how little the whole lot of them and their industry should not be trusted in the first place.
nickysielicki 5y ago
It's slightly more complicated than that: There's 3 parties at play in this story. NSA, RSA, and NIST. NIST was evaluating dual_ec_drbg for certification for government usage, with people from NSA heavily pushing it. NIST was actively contracting out to RSA to evaluate it for weaknesses. The kicker is here: NSA then secretly paid RSA something like $10M to advocate strongly for dual_ec_drbg, behind the back of NIST. So you have one government agency spending money on a contractor, hoping for an honest expert opinion, then another government agency spending money on a contractor secretly so that the second government agency can sneak something behind the first government agency. It's insanity. Sure, RSA should not have taken the money from NSA, but given that NIST crypto certification mostly matters to government implementations (and not to the private sector), isn't the bigger problem that NSA is happy to introduce backdoors into crypto exclusively used by other government agencies? It's traitorous. Thomas Massie offered an amendment in the house to try to stop this. He gave a pretty good overview of the situation (he is an electrical and mechanical engineer from MIT) to the house when the amendment was brought to the floor. https://www.govtrack.us/congress/votes/114-2015/h290 https://www.govtrack.us/congress/votes/114-2015/h290 (strangely, the video has been sort of cut on cspan. It's supposed to be at 3:17:11 https://www.c-span.org/video/?326244-2/us-house-debate-fy-2016-spending&start=38577&transcriptSpeaker=64005 https://www.c-span.org/video/?326244-2/us-house-debate-fy-20... )

nullc 5y ago

WHAT DID YOU SAY? I CANT HEAR YOU OVER THE SOUND OF THE $10 MILLION DOLLARS THAT JUST SPONTANEOUSLY LANDED IN MY LAP. CONCERNS? YES I AM CONCERNED THAT IF I AM NOT HELPFUL THE CIA WILL NOT COLLUDE WITH THE GERMANS TO PURCHASE MY COMPANY OUTRIGHT AND USE IT FOR DECADES TO SHIP BACKDOORED CRYPTOGRAPHIC PRODUCTS LIKE THEY DID WITH CRYPTO AG. WHAT WAS THAT YOU WERE SAYING ABOUT COWS AND FREE MILK?

fmajid 5y ago

It is difficult to get a man to understand something when his salary depends upon his not understanding it. — Upton Sinclair

tptacek 5y ago

Two things real quick: Art Coviello is a salesman who headed the company that bought RSA and took the name. It would be a little weird to expect him to meaningfully know what a cryptographer even is. The idea that Coviello would himself be weighing NIST against crypto eprints is pretty silly. And, more importantly, the only important cite here is Shumow and Ferguson. Schneier didn't analyze Dual EC (he never did work in elliptic curves at all, and claimed not to trust their math); here, he's simply reporting on Shumow and Ferguson's paper, and he doesn't even say Dual EC was backdoored. Nor, for that matter, do the cites before Shumow and Ferguson. (Before anyone jumps on my back about this: I basically shared Schneier's take on this, that Dual EC was too conspicuous to really be a backdoor, and that the right response was to ignore and never use it. I was wildly wrong about how prevalent Dual EC was --- I couldn't imagine any sane engineer adopting it, because it's slow and gross. If I'd known before the BULLRUN revelations that, for instance, every Juniper VPN box was using Dual EC, I'd have been a lot more alarmed and a lot less charitable about it. Oh well, live and learn.)

S_A_P 5y ago
Not disagreeing with your take, but I think its important to note that I just don't see it being possible that Art came up with his take without any input from folks in the company. I would imagine there were meetings where these talking points were constructed. Right?
- tptacek 5y ago
  I think it seems crazy now, but that's because we know a lot more about the practical applications of malicious RNGs; they aren't an abstract concern now. But they kind of were when the big debate was alleged to have happened at RSA. Also: I'm naturally going to sound like I'm defending RSA here, and I am not. I feel like --- I'll probably be proven wrong by this in time because we live in a fallen world --- no major company in the world would in 2021 swap out a crucial cryptographic component for one DOD was demanding while cryptographers were making noise about how janky it is. That should have been the standard in 2007 or whatever, too.
  - 5y ago

adyavanapalli 5y ago

The link to the keynote wasn't resolving in the article, so here's the YouTube link: https://youtu.be/aB2gG-cRj10 https://youtu.be/aB2gG-cRj10

bdamm 5y ago

We keep having this come up with some of the EC curves like NIST P-256 for example. There's no evidence that it is actually backdoored, but the consensus seems to be that the construction is suspicious, unlike the construction for SHA-2. What do we do with it? Not many in a product development team that is interacting with other companies or organizations can meaningfully defend not using a NIST curve because it looks suspicious.

CamperBob2 5y ago

nullc's flagged comment may not have been the best way to get the point across, but it's an important point nevertheless. Conversations about the US intelligence community's repeated attempts to suppress and subvert modern encryption standards never seem to mention Crypto AG, perhaps the most egregious example we know about. A great article just came out that highlights some of the shenanigans: https://spectrum.ieee.org/the-scandalous-history-of-the-last-rotor-cipher-machine https://spectrum.ieee.org/the-scandalous-history-of-the-last... ... In 1966, the relationship among CAG, the NSA, and the CIA went to the next level. That year, the NSA delivered to its Swiss partner an electronic enciphering system that became the basis of a CAG machine called the H-460. Introduced in 1970, the machine was a failure. However, there were bigger changes afoot at CAG: That same year, the CIA and the German Federal Intelligence Service secretly acquired CAG for US $5.75 million. I'm surprised no one has submitted this one, actually.

a1369209993 5y ago
> I'm surprised no one has submitted this one, actually. They did: https://news.ycombinator.com/item?id=28378734 https://news.ycombinator.com/item?id=28378734

baby 5y ago

My explanation of the backdoor: https://youtu.be/OkiVN6z60lg https://youtu.be/OkiVN6z60lg