4 ms·

> I would bet against it being a NIST standard Are you actually "betting against" Dual_EC_DRBG being backdoored by the NSA? The leaked documents specifically

by agwa 13y ago

> I would bet against it being a NIST standard Are you actually "betting against" Dual_EC_DRBG being backdoored by the NSA? The leaked documents specifically say the NSA weakened/backdoored a NIST standard in 2006[1]. Schneier himself, in the essay you quoted, repeatedly calls Dual_EC_DRBG backdoored[2], and has more recently suggested Dual_EC_DRBG could be the standard referred to by the leaked documents[3]. Also, it's not even close to a "reasonable first approximation" to say "nobody" uses Dual_EC_DRBG. BSAFE is in over one billion applications/devices[4]; how many of those do you really think aren't using BSAFE's default RNG? It's true this isn't at all a subtle backdoor (it took only a year for Shumow and Ferguson to discover it), nor does it appear to be very widely used, but too much of what you're saying about Dual_EC_DRBG just isn't supported by fact. [1] http://bits.blogs.nytimes.com/2013/09/10/government-announces-steps-to-restore-confidence-on-encryption-standards/?src=twrhp&_r=0 http://bits.blogs.nytimes.com/2013/09/10/government-announce... and http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryp... [2] https://www.schneier.com/essay-198.html https://www.schneier.com/essay-198.html [3] https://www.schneier.com/blog/archives/2013/09/the_nsa_is_brea.html#c1675954 https://www.schneier.com/blog/archives/2013/09/the_nsa_is_br... [4] http://satchitssecurity.typepad.com/a_page_from_satchits_secu/2008/11/rsa-bsafe-security-a-billion-times-over.html http://satchitssecurity.typepad.com/a_page_from_satchits_sec...

tptacek 13y ago
(1) The NYT article says NSA generated Dual_EC, but does not present evidence that it's backdoored. (2) Schneier isn't a subject matter expert on elliptic curve random number generators. I am aware that Schneier believes Dual_EC to be backdoored. I'm aware that Dual_EC comes from NSA. I would not use Dual_EC and would flag it if I saw it in an app I assessed. But I would still, right now, with the information I have, bet against it being an NSA backdoor. Not because I trust the NSA, but because it's a very dumb backdoor. It helps here to understand the gist of the purported backdoor. Basically, a (sketch of a) way to think of the issue is, NSA's ECC CSPRNG is built around curve parameters in such a way that generating numbers with it involves a public key operation, and only the public key is in the standard. The obvious question is, "what's the private key?". Obviously, you're not happy that NSA (which until recently wasn't even the confirmed author of the construction) won't say. On the other hand, that problem is SO OBVIOUS, and in SUCH A WEIRD, UNLIKELY-TO-BE-VALUABLE STANDARD, that it's kind of ridiculous. "A trojan platypus", as Daniel Franke put it. I've already addressed the "billions of deployed device" point.
- agwa 13y ago
  > (1) The NYT article says NSA generated Dual_EC, but does not present evidence that it's backdoored. So all of the following is just a coincidence then? * Publicly-released document states that as part of a project to enable SIGINT collection, the NSA "influences policies, standards, and specification for commercial public key technologies"[1] * NYT reports "Classified N.S.A. memos appear to confirm that the fatal weakness, discovered by two Microsoft cryptographers in 2007, was engineered by the agency"[2] * NSA was the sole editor of Dual_EC_DRBG[3] * Dual_EC_DRBG has a property where if you know the discrete log of one of its parameters, you can predict its future output. Since it's not explained how the parameter was derived, it's possible the parameter was chosen not randomly, but in a way to ensure its discrete log is known. (Shumow and Ferguson show how this is done[4].) > (2) Schneier isn't a subject matter expert on elliptic curve random number generators. It's not Schneier who raised the prospect of the backdoor - Shumow and Ferguson did. It's not like the NIST curves where Schneier says he doesn't trust them, but can't specify how they could be backdoored. Here we know exactly how Dual_EC_DRBG could be backdoored. Schneier doesn't need any elliptic curve expertise to postulate that it is actually backdoored, just his intuition as a security expert (which you must respect, as you quoted him to make a point above). > It helps here to understand the gist of the purported backdoor. Basically, a (sketch of a) way to think of the issue is, NSA's ECC CSPRNG is built around curve parameters in such a way that generating numbers with it involves a public key operation, and only the public key is in the standard. The obvious question is, "what's the private key?". Obviously, you're not happy that NSA (which until recently wasn't even the confirmed author of the construction) won't say. No, that's not quite it. The question isn't "what's the private key?"; it's "does anyone know the private key?" If the "private key" (e in Shumow's and Ferguson's presentation) were in the spec, everyone would be able to break it. We want assurance that the only way anyone could know the "private key" is by actually solving the elliptic curve discrete log problem (which is probably only possible by generating the Q parameter yourself). > I've already addressed the "billions of deployed device" point. I must have missed that... [1] http://www.theguardian.com/world/interactive/2013/sep/05/sigint-nsa-collaborates-technology-companies http://www.theguardian.com/world/interactive/2013/sep/05/sig... [2] http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html?pagewanted=all http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet... [3] ibid [4] http://rump2007.cr.yp.to/15-shumow.pdf http://rump2007.cr.yp.to/15-shumow.pdf

by agwa 13y ago

tptacek 13y ago

(1) The NYT article says NSA generated Dual_EC, but does not present evidence that it's backdoored. (2) Schneier isn't a subject matter expert on elliptic curve random number generators. I am aware that Schneier believes Dual_EC to be backdoored. I'm aware that Dual_EC comes from NSA. I would not use Dual_EC and would flag it if I saw it in an app I assessed. But I would still, right now, with the information I have, bet against it being an NSA backdoor. Not because I trust the NSA, but because it's a very dumb backdoor. It helps here to understand the gist of the purported backdoor. Basically, a (sketch of a) way to think of the issue is, NSA's ECC CSPRNG is built around curve parameters in such a way that generating numbers with it involves a public key operation, and only the public key is in the standard. The obvious question is, "what's the private key?". Obviously, you're not happy that NSA (which until recently wasn't even the confirmed author of the construction) won't say. On the other hand, that problem is SO OBVIOUS, and in SUCH A WEIRD, UNLIKELY-TO-BE-VALUABLE STANDARD, that it's kind of ridiculous. "A trojan platypus", as Daniel Franke put it. I've already addressed the "billions of deployed device" point.

agwa 13y ago
> (1) The NYT article says NSA generated Dual_EC, but does not present evidence that it's backdoored. So all of the following is just a coincidence then? * Publicly-released document states that as part of a project to enable SIGINT collection, the NSA "influences policies, standards, and specification for commercial public key technologies"[1] * NYT reports "Classified N.S.A. memos appear to confirm that the fatal weakness, discovered by two Microsoft cryptographers in 2007, was engineered by the agency"[2] * NSA was the sole editor of Dual_EC_DRBG[3] * Dual_EC_DRBG has a property where if you know the discrete log of one of its parameters, you can predict its future output. Since it's not explained how the parameter was derived, it's possible the parameter was chosen not randomly, but in a way to ensure its discrete log is known. (Shumow and Ferguson show how this is done[4].) > (2) Schneier isn't a subject matter expert on elliptic curve random number generators. It's not Schneier who raised the prospect of the backdoor - Shumow and Ferguson did. It's not like the NIST curves where Schneier says he doesn't trust them, but can't specify how they could be backdoored. Here we know exactly how Dual_EC_DRBG could be backdoored. Schneier doesn't need any elliptic curve expertise to postulate that it is actually backdoored, just his intuition as a security expert (which you must respect, as you quoted him to make a point above). > It helps here to understand the gist of the purported backdoor. Basically, a (sketch of a) way to think of the issue is, NSA's ECC CSPRNG is built around curve parameters in such a way that generating numbers with it involves a public key operation, and only the public key is in the standard. The obvious question is, "what's the private key?". Obviously, you're not happy that NSA (which until recently wasn't even the confirmed author of the construction) won't say. No, that's not quite it. The question isn't "what's the private key?"; it's "does anyone know the private key?" If the "private key" (e in Shumow's and Ferguson's presentation) were in the spec, everyone would be able to break it. We want assurance that the only way anyone could know the "private key" is by actually solving the elliptic curve discrete log problem (which is probably only possible by generating the Q parameter yourself). > I've already addressed the "billions of deployed device" point. I must have missed that... [1] http://www.theguardian.com/world/interactive/2013/sep/05/sigint-nsa-collaborates-technology-companies http://www.theguardian.com/world/interactive/2013/sep/05/sig... [2] http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html?pagewanted=all http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet... [3] ibid [4] http://rump2007.cr.yp.to/15-shumow.pdf http://rump2007.cr.yp.to/15-shumow.pdf