4 ms·

> Problems with Dual_EC_DRBG were first described in early 2006. The math is complicated, but the general point is that the random numbers it produces have a sm

by yarg 3y ago

> Problems with Dual_EC_DRBG were first described in early 2006. The math is complicated, but the general point is that the random numbers it produces have a small bias. The problem isn’t large enough to make the algorithm unusable. > But today there’s an even bigger stink brewing around Dual_EC_DRBG. In an informal presentation (http://rump2007.cr.yp.to/15-shumow.pdf http://rump2007.cr.yp.to/15-shumow.pdf) at the CRYPTO 2007 conference in August, Dan Shumow and Niels Ferguson showed that the algorithm contains a weakness that can only be described as a backdoor. > What Shumow and Ferguson showed is that these numbers have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can predict the output of the random-number generator after collecting just 32 bytes of its output. To put that in real terms, you only need to monitor one TLS internet encryption connection in order to crack the security of that protocol. If you know the secret numbers, you can completely break any instantiation of Dual_EC_DRBG. You're right that it's a blog post regarding the work of others, but even Dan and Niels' simplified presentation is well beyond what a layman can grasp. Not knowing security, Schneier's post brought it down to a level where it didn't go over my head completely.

tptacek 3y ago
None of what Schneier reported put any of this in a layperson's grasp! The issue with Dual EC is that it's a public key RNG: it produces RNGs by encrypting state to a private key. Somebody potentially holds the private key, and can "decrypt" random numbers back to the internal state of the RNG. There, see, I explained it. There's not much to it! As evidence for Schneier not really moving the needle on this: Dual EC remained a component of important industry products --- Juniper/Netscreen VPNs, in particular --- for years after this blog post. For what it's worth: that's what the major revelation after BULLRUN was. Not that Dual EC was bad --- literally every competent practitioner knew Dual EC was bad --- but that serious products were actually using it. Seeing Dual EC turn up in a VPN server was the smoking gun, not any particular slide from a Snowden tranche. That's when there's no denying it's a backdoor. (Mark me down as someone who was a Dual EC backdoor skeptic prior to the Snowden fallout, for whatever that's worth to you.)
- yarg 3y ago
  It was the use of the term "skeleton key" that I think brings it down to the layman's level (it's the part where I thought "Oh."). They still won't understand how it works, but it provides an intuition of the nature of the problem that most people could grasp (vs a presentation where the vast majority of people wouldn't get past the first page, even if they looked).

by yarg 3y ago

tptacek 3y ago

None of what Schneier reported put any of this in a layperson's grasp! The issue with Dual EC is that it's a public key RNG: it produces RNGs by encrypting state to a private key. Somebody potentially holds the private key, and can "decrypt" random numbers back to the internal state of the RNG. There, see, I explained it. There's not much to it! As evidence for Schneier not really moving the needle on this: Dual EC remained a component of important industry products --- Juniper/Netscreen VPNs, in particular --- for years after this blog post. For what it's worth: that's what the major revelation after BULLRUN was. Not that Dual EC was bad --- literally every competent practitioner knew Dual EC was bad --- but that serious products were actually using it. Seeing Dual EC turn up in a VPN server was the smoking gun, not any particular slide from a Snowden tranche. That's when there's no denying it's a backdoor. (Mark me down as someone who was a Dual EC backdoor skeptic prior to the Snowden fallout, for whatever that's worth to you.)

yarg 3y ago
It was the use of the term "skeleton key" that I think brings it down to the layman's level (it's the part where I thought "Oh."). They still won't understand how it works, but it provides an intuition of the nature of the problem that most people could grasp (vs a presentation where the vast majority of people wouldn't get past the first page, even if they looked).