8 ms·
DRBG Validation List
- lawnchair_larry 13y agoThis is the only place that I've been able to find a decent list of vendors potentially affected. This lists all vendors, so you will have to ctrl-f for BSAFE. To be completely clear, most vendors on this list are not known to be affected, only those listed as using the library, or libraries derived from it (also listed). All entries using Dual_EC_DRBG are potentially affected, but it is believed that most do not use that by default. If it's the only one listed, you can probably assume they use it by default. Especially things called "Datacryptor DUAL_EC_DRBG" by Thales e-Security.
- eli 13y agoThis seems dangerous. If you're going to name and shame people, I think you've really got to be extremely sure you're naming the right people.
- DerpDerpDerp 13y agoThis isn't an article naming-and-shaming; it's an information dump so people can sort through it and find the right people to actually name-and-shame.
- ballard 13y agoThis lists which companies have certified implementations, not which products relies on which CSPRNG/s by default. I think there are already internal code audits underway by some of the listed entities, if not, it would be wise to get started real quick before customer anger arrives. If this is not a clear impetus for open source, eg, publicly audit-able code >>> trade secrets, I think we should keep blindly accepting black box solutions, from chip to app. No funny business ever happens without transparency.
- lawnchair_larry 13y agoUnfortunately, the stupid moderator submission title editing policy has struck again, so anybody seeing this has no context now. Thanks for being unhelpful, moderators!
- Nanzikambe 13y agoWow, the scale of this is amazing, virtually all versions of windows are affected (search "Microsoft Corporation" & check for "Dual_EC_DRBG") as are a substantial number of Cisco products. Apple seems to fare better assuming that's what this means: CTR_DRBG: [ Prediction Resistance Tested: Enabled; Regarding hardware devices (Cisco etc routers) it'd be interesting to get an audit of vulnerability by firmware versions. People are terrible at keeping those things up to date. TL'DR: if you fear MITM, you've got your work cut out auditting your infrastructure
- tptacek 13y agoMicrosoft implements Dual_EC, but does not default to it. CTR_DRBG is just a block cipher in counter mode. I don't think it's a scary construction.
- marshray 13y agoI SAW THAT TPTACEK SAYS CTR MODE IS NOT A SCARY CONSTRUCTION! Oh you are never going to live that down brother :-)
- tptacek 13y agoIN A RANDOM NUMBER GENERATOR. I am not terrified of CTR, by the way; I just think CBC gets a bad rap. It's interesting that people can be on a jihad against DSA for needlessly depending on randomness, but not at all perturbed by the CTR randomness failure mode. (Granted, the DSA failure mode is much worse and much harder to get right.)
- marshray 13y agoAnd why is it OK for use in a PRNG/DRBG and not a cipher?
- fleitz 13y agoBecause generally the plaintext input to a PRNG using a cipher in CTR mode is uninteresting to attackers, and generally cannot be controlled. What a DRBG needs to do is provide unpredictable bits, not bits that can't be decrypted.
- jlgaddis 13y agoI've got dozens of pieces of Cisco gear deployed throughout my network but I'm far from a crypto expert and, honestly, haven't really kept up on this specific issue so perhaps somebody can help me out here. Within Cisco's operating systems (primarily IOS, but also NX-OS, IOS XR, etc.) I can think of a number of places where hashing and encryption are used: password hashes (obviously), BGP passwords, OSPF authentication, NTP secret keys, etc. Which of these might potentially be affected if Cisco were using this algorithm? Any of them? All of them? With the exception of being able to specify particular types of hashes for user passwords, I'm not sure what else one might do to mitigate any vulnerabilities. Edit: After thinking about it for a few minutes, I realized that since the processors in Cisco devices are already so slow (relatively speaking), Cisco would likely avoid using such an algorithm when other, much faster options are available. I can't be for sure, of course, but it seems reasonable. In the meantime, I'll keep my tinfoil hat on.
- tptacek 13y agoIt would be shocking if Cisco were using Dual_EC in any "traffic-scale" crypto in their devices. It isn't just extremely slow, but also slow in a way that makes it obnoxious in embedded environments.
- jlgaddis 13y agoYeah, I thought that after posting my original comment. With the processors on the control-plane already being as slow as they are, I can't imagine they'd intentionally choose to use such a slow algorithm for such "time-sensitive" operations (verifying OSPF authentication, etc.).
- lawnchair_larry 13y agohttps://supportforums.cisco.com/thread/2062466 https://supportforums.cisco.com/thread/2062466 http://www.juniper.net/security/auto/vulnerabilities/vuln24104.html http://www.juniper.net/security/auto/vulnerabilities/vuln241... https://latinamerica.rsa.com/rsasecured/product.aspx?id=968 https://latinamerica.rsa.com/rsasecured/product.aspx?id=968 "Cisco routers utilize RSA BSAFE encryption and are certified to interoperate with RSA Certificate Manager software and RSA SecurID authentication technology." You're shocked now, I guess. But it's no big deal, nobody uses Cisco routers. Throw Novell in there too: http://www.novell.com/support/kb/doc.php?id=3590033 http://www.novell.com/support/kb/doc.php?id=3590033 and Adobe: https://latinamerica.rsa.com/rsasecured/product.aspx?id=108 https://latinamerica.rsa.com/rsasecured/product.aspx?id=108 and many more: https://latinamerica.rsa.com/rsasecured/results.aspx?search=bsafe https://latinamerica.rsa.com/rsasecured/results.aspx?search=...
- jlgaddis 13y agoHmm, interesting to see Harris Corporation is on the list. They provide a lot of encryption gear to the U.S. government.
- tptacek 13y agoA couple random observations: * The overwhelming majority of vendors here list Dual_EC_DRBG along with the HMAC and CTR DRBGs. A reminder: Dual_EC is a catastrophically slow CSPRNG that relies on bignum multiplication; if you pay any attention to crypto performance at all, you have every incentive never to use Dual_EC, and to an almost reasonable first approximation, nobody does. The HMAC and CTR CSPRNGs are innocuous designs based on simple conventional crypto. * I'm a little suspicious of this list because it suggests Windows Server 2008 and Windows 7 use only Dual_EC. Neither do; you'd have to go through contortions to make Windows use Dual_EC. Obviously, the list is about certifications and not actual field configurations, but still, you should know: Windows does not rely on Dual_EC. * Here are the products (other than Windows, which, see above) that are listed as only certifying Dual_EC: Lancope Mocana McAfee Firewall Console Thales Datacryptor None of these are particularly important industry products. McAfee is not a leading firewall vendor (Cisco and Juniper are). Lancope is a niche intrusion detection product, and Lancope is not exactly a hotbed of cryptographic research, if you get my drift. Also, the CSPRNG Lancope would be using would be relevant only to their admin console. I don't know what Mocana or Thales do, which could be my ignorance showing, or it could be telling given what I do for a living. Here's what Bruce Schneier had to say about the Dual EC DRBG: "If this story leaves you confused, join the club. I don't understand why the NSA was so insistent about including Dual_EC_DRBG in the standard. It makes no sense as a trap door: It's public, and rather obvious. It makes no sense from an engineering perspective: It's too slow for anyone to willingly use it. And it makes no sense from a backwards-compatibility perspective: Swapping one random-number generator for another is easy." This is basically my take on Dual EC as well. I am not putting it past the NSA to backdoor a crypto standard (I would bet against it being a NIST standard --- if they backdoored a standard, my money is on a telephony/RF one --- but I would not bet my house against it). But this would be an inexplicable backdoor to add.
- blutack 13y ago> I don't know what Mocana or Thales do Thales are a large defense contractor - a French equivalent of BAE Systems or General Atomics. Not particularly famous for corporate integrity [0]. [0]: http://en.wikipedia.org/wiki/Thales_Group#Corruption_allegations http://en.wikipedia.org/wiki/Thales_Group#Corruption_allegat...
- marshray 13y agoLet's be clear here: This is a list of product that NIST considers "validated" by an accredited lab for one or more of their SP800-09 DRBGs. Only the "Dual EC" DRBG is known to be weak/backdoored. We know that some of them do, but just because a product contains a validated Dual EC DRBG doesn't mean it's on by default. Basically, the only reason to use such a DRBG is FIPS compliance, and since FIPS mandates so many other odd things most product has a special "FIPS mode" switch which is off by default.