4 ms·

Did NSA Put a Secret Backdoor in New Encryption Standard? (2007)

187 points by aprescott 13y ago

swombat 13y ago
This is clearly exaggerated. There's no way the NSA would ever do such a thing. Surely it would weaken US communications as well, and one of their mandates is to protect US communications - not to spy on americans, which it's forbidden to do. NIST and the NSA are obviously above reproach in this case. [/sarcasm]
- 3327 13y ago
  >>clearly exaggerated ? read the article again. Why is there no way the NSA would do such a thing ? There is no silver bullet in the crypto world. If somewhere 10% or 5% or even 1% of someone uses that encryption because it is 'standardized' you have a turn key solution without wasting any time. It makes perfect sense that they would push it in there.
  - aprescott 13y ago
    I think you missed the "[/sarcasm]"!
    - 3327 13y ago
      looks like i did!
jmgrosen 13y ago
On Schneier's blog here: https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html https://www.schneier.com/blog/archives/2007/11/the_strange_s...
EthanHeilman 13y ago
Yes, from the New York Times: Classified N.S.A. memos appear to confirm that the fatal weakness, discovered by two Microsoft cryptographers in 2007, was engineered by the agency. The N.S.A. wrote the standard and aggressively pushed it on the international group, privately calling the effort “a challenge in finesse.” “Eventually, N.S.A. became the sole editor,” the memo says.
- aprescott 13y ago
  The presentation on the vulnerability, from the two Microsoft employees, for those interested: http://rump2007.cr.yp.to/15-shumow.pdf http://rump2007.cr.yp.to/15-shumow.pdf Amusingly, from the PDF: > WHAT WE ARE NOT SAYING: > NIST intentionally put a back door in this PRNG :)
pyrocat 13y ago
http://www.youtube.com/watch?v=W8ZETOz5Fbs http://www.youtube.com/watch?v=W8ZETOz5Fbs
z3phyr 13y ago
Digital fortress anyone?
- weavejester 13y ago
  Is that a reference to the laughably inaccurate Dan Brown thriller?
  - milsorgen 13y ago
    Hit up a thrift store. It's kind of a fun read, well, depending on your tolerance for technobabble I guess!
deveac 13y ago
You don't even need to ask if the NSA broke the encryption to answer the question "Is this standard effectively compromised and not suitable for use?" Based on what we already know, keeping in mind the goal of encryption in the first place, the answer is "yes." But it is also a decent assumption to think that it is precisely the NSA that has broken the standard in light of the recent reporting by the NYT.
ganeumann 13y ago
So, it's six years later. Is Dual_EC_DRBG in use in any commercial products?
cupcake-unicorn 13y ago
Is this encryption standard used in any real life applications? It sounds like people had a ton of problems with it even just right as it was released. They may have forced the standard, but it didn't look like it was adopted.
danso 13y ago
Would love to see an update to this with some context. So this became a government standard...but was it widely adopted in the industry (outside of government)? It had already been under suspicion of this fatal flaw before its release and Schneier says it was "also three orders of magnitude slower than its peers"...even if the security flaw didn't deter users, I would think a performance drop of three magnitudes would make it unpopular for use in anywhere but the government [insert joke about government inefficiency here].
semenko 13y ago
The NYT piece today had different redactions than the Guardian, showing the NSA may have done this with commercial VPN ASICs. The Times includes "Complete enabling for [XXXXXXX] encryption chips used in Virtual Private Network and Web encryption devices." http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html?ref=us#briefing http://www.nytimes.com/interactive/2013/09/05/us/documents-r... (compare to http://www.theguardian.com/world/interactive/2013/sep/05/sigint-nsa-collaborates-technology-companies http://www.theguardian.com/world/interactive/2013/sep/05/sig... )
- aspensmonster 13y ago
  Also keep an eye on http://cryptome.org http://cryptome.org. It looks like they're keeping track of redactions as well.
- jevinskie 13y ago
  How did the difference come about? Did the Times and Guardian redact the documents themselves?
  - mikegagnon 13y ago
    Yes. According to Reuters: "The New York Times and ProPublica said they were asked not to publish their findings by intelligence officials who argued that their foreign targets might switch to newer forms of encryption or communications if the NSA tactics were revealed. 'Some specific facts' were removed, the New York Times said. The articles do not say which mainstream encryption systems have been effectively broken." http://www.reuters.com/article/2013/09/05/net-us-usa-security-snowden-encryption-idUSBRE98413720130905 http://www.reuters.com/article/2013/09/05/net-us-usa-securit...
- colmmacc 13y ago
  There is some precedent for the NSA backdoors in commercial VPNs ... http://www.schneier.com/blog/archives/2008/01/nsa_backdoors_i.html http://www.schneier.com/blog/archives/2008/01/nsa_backdoors_... Backdoors were found in the devices/software sold to many governments, used by embassies and consulates all over the world.
rob05c 13y ago
That's why my projects use RIPEMD rather than SHA. I prefer my encryption algorithms to not be developed by an organization that has a vested interested in them being broken.
- jared314 13y ago
  > I prefer my encryption algorithms to not be developed by an organization that has a vested interested in them being broken. While I understand the sentiment, you should not be using them for encryption in the first place. RIPEMD and SHA are cryptographic hash functions.
  - Dylan16807 13y ago
    Unless it's SHA3, but thankfully that wasn't designed by them.
    - jared314 13y ago
      SHA3 (Keccak) is also a cryptographic hash function, and should not be used for encryption.
      - Dylan16807 13y ago
        Why not? It's designed for indefinite output.
        maaku 13y ago
        Are you trolling?
        Dylan16807 13y ago
        ...no Keccak is a generic construction suitable for more than just hashing. Here, let me copy the first bullet point off their site. > As a sponge function, Keccak has arbitrary output length. This allows to simplify modes of use where dedicated constructions would be needed for fixed-output-length hash functions. It can be natively used for, e.g., hashing, full domain hashing, randomized hashing, stream encryption, MAC computation. In addition, the arbitrary output length makes it suitable for tree hashing. Note that Keccak has a significant amount of hidden state, and they proved that the sponge construction itself is secure as a function of how many bits are hidden.
SilliMon 13y ago
It is might be time for an audit of code submits to the encryption libararies in open source projects.
deleted 13y ago
[deleted]
gfody 13y ago
No. (per Betteridge's law of headlines)
- maaku 13y ago
  You know this is on the front page because they most certainly did?

187 points by aprescott 13y ago

This is clearly exaggerated. There's no way the NSA would ever do such a thing. Surely it would weaken US communications as well, and one of their mandates is to protect US communications - not to spy on americans, which it's forbidden to do. NIST and the NSA are obviously above reproach in this case. [/sarcasm]

3327 13y ago
>>clearly exaggerated ? read the article again. Why is there no way the NSA would do such a thing ? There is no silver bullet in the crypto world. If somewhere 10% or 5% or even 1% of someone uses that encryption because it is 'standardized' you have a turn key solution without wasting any time. It makes perfect sense that they would push it in there.
- aprescott 13y ago
  I think you missed the "[/sarcasm]"!
  - 3327 13y ago
    looks like i did!

jmgrosen 13y ago

On Schneier's blog here: https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html https://www.schneier.com/blog/archives/2007/11/the_strange_s...

EthanHeilman 13y ago

Yes, from the New York Times: Classified N.S.A. memos appear to confirm that the fatal weakness, discovered by two Microsoft cryptographers in 2007, was engineered by the agency. The N.S.A. wrote the standard and aggressively pushed it on the international group, privately calling the effort “a challenge in finesse.” “Eventually, N.S.A. became the sole editor,” the memo says.

aprescott 13y ago
The presentation on the vulnerability, from the two Microsoft employees, for those interested: http://rump2007.cr.yp.to/15-shumow.pdf http://rump2007.cr.yp.to/15-shumow.pdf Amusingly, from the PDF: > WHAT WE ARE NOT SAYING: > NIST intentionally put a back door in this PRNG :)

pyrocat 13y ago

http://www.youtube.com/watch?v=W8ZETOz5Fbs http://www.youtube.com/watch?v=W8ZETOz5Fbs

z3phyr 13y ago

Digital fortress anyone?

weavejester 13y ago
Is that a reference to the laughably inaccurate Dan Brown thriller?
- milsorgen 13y ago
  Hit up a thrift store. It's kind of a fun read, well, depending on your tolerance for technobabble I guess!

deveac 13y ago

You don't even need to ask if the NSA broke the encryption to answer the question "Is this standard effectively compromised and not suitable for use?" Based on what we already know, keeping in mind the goal of encryption in the first place, the answer is "yes." But it is also a decent assumption to think that it is precisely the NSA that has broken the standard in light of the recent reporting by the NYT.

ganeumann 13y ago

So, it's six years later. Is Dual_EC_DRBG in use in any commercial products?

cupcake-unicorn 13y ago

Is this encryption standard used in any real life applications? It sounds like people had a ton of problems with it even just right as it was released. They may have forced the standard, but it didn't look like it was adopted.

danso 13y ago

Would love to see an update to this with some context. So this became a government standard...but was it widely adopted in the industry (outside of government)? It had already been under suspicion of this fatal flaw before its release and Schneier says it was "also three orders of magnitude slower than its peers"...even if the security flaw didn't deter users, I would think a performance drop of three magnitudes would make it unpopular for use in anywhere but the government [insert joke about government inefficiency here].

semenko 13y ago

The NYT piece today had different redactions than the Guardian, showing the NSA may have done this with commercial VPN ASICs. The Times includes "Complete enabling for [XXXXXXX] encryption chips used in Virtual Private Network and Web encryption devices." http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html?ref=us#briefing http://www.nytimes.com/interactive/2013/09/05/us/documents-r... (compare to http://www.theguardian.com/world/interactive/2013/sep/05/sigint-nsa-collaborates-technology-companies http://www.theguardian.com/world/interactive/2013/sep/05/sig... )

aspensmonster 13y ago
Also keep an eye on http://cryptome.org http://cryptome.org. It looks like they're keeping track of redactions as well.
jevinskie 13y ago
How did the difference come about? Did the Times and Guardian redact the documents themselves?
- mikegagnon 13y ago
  Yes. According to Reuters: "The New York Times and ProPublica said they were asked not to publish their findings by intelligence officials who argued that their foreign targets might switch to newer forms of encryption or communications if the NSA tactics were revealed. 'Some specific facts' were removed, the New York Times said. The articles do not say which mainstream encryption systems have been effectively broken." http://www.reuters.com/article/2013/09/05/net-us-usa-security-snowden-encryption-idUSBRE98413720130905 http://www.reuters.com/article/2013/09/05/net-us-usa-securit...
colmmacc 13y ago
There is some precedent for the NSA backdoors in commercial VPNs ... http://www.schneier.com/blog/archives/2008/01/nsa_backdoors_i.html http://www.schneier.com/blog/archives/2008/01/nsa_backdoors_... Backdoors were found in the devices/software sold to many governments, used by embassies and consulates all over the world.

rob05c 13y ago

That's why my projects use RIPEMD rather than SHA. I prefer my encryption algorithms to not be developed by an organization that has a vested interested in them being broken.

jared314 13y ago
> I prefer my encryption algorithms to not be developed by an organization that has a vested interested in them being broken. While I understand the sentiment, you should not be using them for encryption in the first place. RIPEMD and SHA are cryptographic hash functions.
- Dylan16807 13y ago
  Unless it's SHA3, but thankfully that wasn't designed by them.
  - jared314 13y ago
    SHA3 (Keccak) is also a cryptographic hash function, and should not be used for encryption.
    - Dylan16807 13y ago
      Why not? It's designed for indefinite output.
      - maaku 13y ago
        Are you trolling?
        Dylan16807 13y ago
        ...no Keccak is a generic construction suitable for more than just hashing. Here, let me copy the first bullet point off their site. > As a sponge function, Keccak has arbitrary output length. This allows to simplify modes of use where dedicated constructions would be needed for fixed-output-length hash functions. It can be natively used for, e.g., hashing, full domain hashing, randomized hashing, stream encryption, MAC computation. In addition, the arbitrary output length makes it suitable for tree hashing. Note that Keccak has a significant amount of hidden state, and they proved that the sponge construction itself is secure as a function of how many bits are hidden.

SilliMon 13y ago

It is might be time for an audit of code submits to the encryption libararies in open source projects.

deleted 13y ago

[deleted]

gfody 13y ago

No. (per Betteridge's law of headlines)

maaku 13y ago
You know this is on the front page because they most certainly did?