6 ms·

Wow, the scale of this is amazing, virtually all versions of windows are affected (search "Microsoft Corporation" & check for "Dual_EC_DRBG") as are a substanti

Wow, the scale of this is amazing, virtually all versions of windows are affected (search "Microsoft Corporation" & check for "Dual_EC_DRBG") as are a substantial number of Cisco products. Apple seems to fare better assuming that's what this means: CTR_DRBG: [ Prediction Resistance Tested: Enabled; Regarding hardware devices (Cisco etc routers) it'd be interesting to get an audit of vulnerability by firmware versions. People are terrible at keeping those things up to date. TL'DR: if you fear MITM, you've got your work cut out auditting your infrastructure

tptacek 13y ago
Microsoft implements Dual_EC, but does not default to it. CTR_DRBG is just a block cipher in counter mode. I don't think it's a scary construction.
- marshray 13y ago
  I SAW THAT TPTACEK SAYS CTR MODE IS NOT A SCARY CONSTRUCTION! Oh you are never going to live that down brother :-)
  - tptacek 13y ago
    IN A RANDOM NUMBER GENERATOR. I am not terrified of CTR, by the way; I just think CBC gets a bad rap. It's interesting that people can be on a jihad against DSA for needlessly depending on randomness, but not at all perturbed by the CTR randomness failure mode. (Granted, the DSA failure mode is much worse and much harder to get right.)
    - marshray 13y ago
      And why is it OK for use in a PRNG/DRBG and not a cipher?
      - fleitz 13y ago
        Because generally the plaintext input to a PRNG using a cipher in CTR mode is uninteresting to attackers, and generally cannot be controlled. What a DRBG needs to do is provide unpredictable bits, not bits that can't be decrypted.
        marshray 13y ago
        If the "plaintext input to a PRNG" becomes known to the attacker, the entire output of the PRNG becomes known (i.e., 'predictable') to the attacker.
        fleitz 13y ago
        That's why I try not to give attackers root access to the system, that way they can't examine the state of my PRNG.
      - tptacek 13y ago
        Because PRNG constructions tend to run the whole key schedule when they refresh their state; for instance, CTR_DRBG uses inputs to derive a nonce and a whole new key.
    - marshray 13y ago
      BTW, I think that's a great point about the comparison with DSA.
      - tptacek 13y ago
        I'm obnoxious, but every once in awhile I get a good one in. :)

tptacek 13y ago

Microsoft implements Dual_EC, but does not default to it. CTR_DRBG is just a block cipher in counter mode. I don't think it's a scary construction.

marshray 13y ago
I SAW THAT TPTACEK SAYS CTR MODE IS NOT A SCARY CONSTRUCTION! Oh you are never going to live that down brother :-)
- tptacek 13y ago
  IN A RANDOM NUMBER GENERATOR. I am not terrified of CTR, by the way; I just think CBC gets a bad rap. It's interesting that people can be on a jihad against DSA for needlessly depending on randomness, but not at all perturbed by the CTR randomness failure mode. (Granted, the DSA failure mode is much worse and much harder to get right.)
  - marshray 13y ago
    And why is it OK for use in a PRNG/DRBG and not a cipher?
    - fleitz 13y ago
      Because generally the plaintext input to a PRNG using a cipher in CTR mode is uninteresting to attackers, and generally cannot be controlled. What a DRBG needs to do is provide unpredictable bits, not bits that can't be decrypted.
      - marshray 13y ago
        If the "plaintext input to a PRNG" becomes known to the attacker, the entire output of the PRNG becomes known (i.e., 'predictable') to the attacker.
        fleitz 13y ago
        That's why I try not to give attackers root access to the system, that way they can't examine the state of my PRNG.
    - tptacek 13y ago
      Because PRNG constructions tend to run the whole key schedule when they refresh their state; for instance, CTR_DRBG uses inputs to derive a nonce and a whole new key.
  - marshray 13y ago
    BTW, I think that's a great point about the comparison with DSA.
    - tptacek 13y ago
      I'm obnoxious, but every once in awhile I get a good one in. :)