3 ms·
Think you've got that backwards, there's nothing fundamental about Dual_EC_DRBG that prevents anyone else exploiting it, while the xz vulnerability is gated wit
by lamontcg 3y ago
Think you've got that backwards, there's nothing fundamental about Dual_EC_DRBG that prevents anyone else exploiting it, while the xz vulnerability is gated with a specific private key.
- acdha 3y agoSame story with the constants in Dual EC: http://rump2007.cr.yp.to/15-shumow.pdf http://rump2007.cr.yp.to/15-shumow.pdf The xz vulnerability is exactly the same in that guarded sense, so I’d be completely unsurprised if the NSA was behind it but I don’t think they’d otherwise help keep it quiet. Even if it was another Fives Eyes country it’s hard to imagine them being okay with that level of risk.