6 ms·

> I doubt anyone used this algo... Apparently RSA Security uses it as a default. http://developer-content.emc.com/docs/rsashare/share_for_java/1.1/dev_guide/g

> I doubt anyone used this algo... Apparently RSA Security uses it as a default. http://developer-content.emc.com/docs/rsashare/share_for_java/1.1/dev_guide/group__LEARNJSSE__RANDOM__ALGORITHM.html http://developer-content.emc.com/docs/rsashare/share_for_jav... https://lwn.net/Articles/566329/ https://lwn.net/Articles/566329/

rgbrenner 13y ago
Interesting. Thanks for the link.. it's the first example of it actually being used I've seen. If anyone else has other examples, I would be interested in those too.
- ig1 13y ago
  If you look at http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgval.html http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgval.... you can see who's using EC_DBRG. Most notably apart from RSA is the "McAfee Firewall Enterprise Control Center" (who actually use RSA's library)
  - lambda 13y ago
    So, when are we going to start seeing CVEs from these vendors, and updates to their software that disable this "feature"? Cisco, Certicom, RSA, McAffee (via RSA), Juniper, Blackberry/RIM, OpenPeak, OpenSSL, Samsung, Symantec, Riverbed, Cummings Engineering, CoCo Communications, Kony, Lancope (via RSA), Mocana, Safenet, SafeLogic, Panzura, Microsoft, Thales e-Security, Catbird, ARX all list Dual_EC_DRBG as at least supported. Of these, RSA (and presumably the others based on their, like McAffee and Lancope), Thales e-Security, and possibly Microsoft (Windows Server 2008 R2 lists only Dual_EC_DRBG, though its possible that that's just their only FIPS compliant one and they use some non-standard algorithm by default) seem to use Dual_EC_DRBG by default or as the only option. I haven't tried finding documentation on all of these to see if they say what their default algorithm is, so it may be more. edit to add: Found this discussion on the OpenSSL users list, about why they added it. Apparently it was because a paying customer requested it, thought the customer is not named for confidentiality reasons. OpenSSL doesn't appear to enable the NIST/FIPS random number generators unless you compile it in FIPS mode (at least, as far as I can tell from a quick, their build system is a bit weird, and FIPS mode is even stranger): http://marc.info/?l=openssl-users&m=137858935523161&w=2 http://marc.info/?l=openssl-users&m=137858935523161&w=2
  - anologwintermut 13y ago
    That tells you who has a certification for it. Note must people have certifications for multiple RNGs, including openssl (indeed a few of those modules are wrappers around openssl) There is one company that only has a cert for EC_DRBG and thus can reasonably be inferred to be using it is Lancope, a network security/firewall company. For the rest of them, we don't know.
    - ig1 13y ago
      McAfee Firewall Enterprise Control Center only has dual EC_DRBG certified (despite the fact the RSA library they use supports others; strongly suggesting its what they actually use).
      - anologwintermut 13y ago
        McAfee Firewall Enterprise Control Center has certifications 340 333 163 162 and 340. Two of those are for HMAC_Based_DRBG.
jlgaddis 13y ago
"The default Pseudo Random Number Generator (PRNG) is the Dual EC-DRBG using a P256 curve with prediction resistance off." ... later ... "Using a weak PRNG is inadvisable as it may allow attackers to predict the values of secret information such as session keys."

rgbrenner 13y ago

Interesting. Thanks for the link.. it's the first example of it actually being used I've seen. If anyone else has other examples, I would be interested in those too.

ig1 13y ago
If you look at http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgval.html http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgval.... you can see who's using EC_DBRG. Most notably apart from RSA is the "McAfee Firewall Enterprise Control Center" (who actually use RSA's library)
- lambda 13y ago
  So, when are we going to start seeing CVEs from these vendors, and updates to their software that disable this "feature"? Cisco, Certicom, RSA, McAffee (via RSA), Juniper, Blackberry/RIM, OpenPeak, OpenSSL, Samsung, Symantec, Riverbed, Cummings Engineering, CoCo Communications, Kony, Lancope (via RSA), Mocana, Safenet, SafeLogic, Panzura, Microsoft, Thales e-Security, Catbird, ARX all list Dual_EC_DRBG as at least supported. Of these, RSA (and presumably the others based on their, like McAffee and Lancope), Thales e-Security, and possibly Microsoft (Windows Server 2008 R2 lists only Dual_EC_DRBG, though its possible that that's just their only FIPS compliant one and they use some non-standard algorithm by default) seem to use Dual_EC_DRBG by default or as the only option. I haven't tried finding documentation on all of these to see if they say what their default algorithm is, so it may be more. edit to add: Found this discussion on the OpenSSL users list, about why they added it. Apparently it was because a paying customer requested it, thought the customer is not named for confidentiality reasons. OpenSSL doesn't appear to enable the NIST/FIPS random number generators unless you compile it in FIPS mode (at least, as far as I can tell from a quick, their build system is a bit weird, and FIPS mode is even stranger): http://marc.info/?l=openssl-users&m=137858935523161&w=2 http://marc.info/?l=openssl-users&m=137858935523161&w=2
- anologwintermut 13y ago
  That tells you who has a certification for it. Note must people have certifications for multiple RNGs, including openssl (indeed a few of those modules are wrappers around openssl) There is one company that only has a cert for EC_DRBG and thus can reasonably be inferred to be using it is Lancope, a network security/firewall company. For the rest of them, we don't know.
  - ig1 13y ago
    McAfee Firewall Enterprise Control Center only has dual EC_DRBG certified (despite the fact the RSA library they use supports others; strongly suggesting its what they actually use).
    - anologwintermut 13y ago
      McAfee Firewall Enterprise Control Center has certifications 340 333 163 162 and 340. Two of those are for HMAC_Based_DRBG.

jlgaddis 13y ago

"The default Pseudo Random Number Generator (PRNG) is the Dual EC-DRBG using a P256 curve with prediction resistance off." ... later ... "Using a weak PRNG is inadvisable as it may allow attackers to predict the values of secret information such as session keys."