3 ms·
To be fair, the insanity of anyone using it was never called into question. We agree it shouldn't be used. As we all know, science has yet to establish any corr
by lawnchair_larry 13y ago
To be fair, the insanity of anyone using it was never called into question. We agree it shouldn't be used. As we all know, science has yet to establish any correlation between sanity and what companies are actually doing in the real world for security.
Edit: Actually, I take that back. I have no problem believing that RSA Security are perfectly sane. Would we be completely shocked if the reason they chose a questionable default was due to coercion from the spooks? Only NSA has the keys, so it's a pretty safe backdoor.
You know, props to China, had to go through the work of owning RSA's seed server last year just to level the playing field. They get so derided in the media for doing that, but it seems unfair when the other team has a backdoor. Who is the real "Advanced Persistent Threat"?
- rgbrenner 13y agoI'll call into question the sanity of anyone using it. The problems with it were known days after the standard was published.. meaning anyone who implemented was well aware of its problems. Edit: actually, the first attack was in march 06 -- 3 months before the standard was published: http://www.math.ntnu.no/~kristiag/drafts/dual-ec-drbg-comments.pdf http://www.math.ntnu.no/~kristiag/drafts/dual-ec-drbg-commen...
- lawnchair_larry 13y agoSorry, that was worded incorrectly. I meant that we all agree it was insane to use it. The contention was over whether or not it was in use, not whether it is a good idea to use. I should have said calling into question the insanity, will edit.