3 ms·
Yes, that was an insidious move from the NSA but nowhere near a mandate. No one uses it because of that weakness and they're allowed to do that.
by hypeatei 10mo ago
Yes, that was an insidious move from the NSA but nowhere near a mandate. No one uses it because of that weakness and they're allowed to do that.
- timschmidt 10mo agoMy understanding is that https://en.wikipedia.org/wiki/FIPS_140-2 https://en.wikipedia.org/wiki/FIPS_140-2 required Dual-EC DRBG to be implemented in any crypto system used by government, including such protocols as SSL/TLS, these algorithms are typically also adopted by industry, and NSA went further by paying RSA and perhaps others to make it the default in their security products. This came after previous attempts such as https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip