2 ms·

You don't think that the NSA offering $10 million dollars to make it a default shouldn't have been a smoking gun to the staff at RSA that was aware of the payme

• tptacek 5y ago
  No, I imagine everyone was aware of the payment. I just think doing stupid shit to close GSA and DOD deals is the norm throughout enterprise software development; what I'm more curious about is whether anyone really gave a shit about this particular stupid thing. I feel like a hurdle that people arguing the other side of this need to clear, and aren't, is that prior to BULLRUN really not many people were making that much noise† about Dual EC. It was not a secret that it was in BSAFE; it was, according to the post upthread, not just in the documentation, but in the documentation with a warning to disable it! The tenor of the conversation changed sharply after BULLRUN and people connecting the dots on the TLS random data exposure. But the argument I keep seeing, and the one implicit in this post we're commenting on, is that nobody should have needed BULLRUN to start freaking the fuck out. I disagree with that argument, in a sense (obviously: everyone should have been freaking out.) † Yes, people were making noise, but they made noise (and still do) about _NSAKEY too. There's a difference between then and now, and it's obviously not just because I finally agree with them now.