9 ms·

NSA invents weak (Back Door present) crypto algo. Pushes RSA to make it a Default in a key function (RNG) by giving them $10 Million. NSA points to RSA as an

NSA invents weak (Back Door present) crypto algo. Pushes RSA to make it a Default in a key function (RNG) by giving them $10 Million. NSA points to RSA as an early adopter and gets NIST to certify it. Millions of systems are now protected by an RSA product that the NSA deliberately weakened. Any sufficiently skilled rogue actor can attack virtually any business that uses these RSA products - NSA (Cyber security Command) gets even more money to "Protect" us from said Rogue actors. So all-in-all good investment on their part Edit: Spelling fixed per commenter pointing out the difference between rouge and rogue. I did imply malicious actors not red-cheeked actors (not that they are mutually exclusive).

adriand 13y ago
Minor quibble (and yes I'm as outraged by this as you are) - but "rouge" means "a red powder or cream used as a cosmetic for coloring the cheeks or lips", whereas "rogue" means "a person or thing that behaves in an aberrant, faulty, or unpredictable way", which is what you mean in this comment.
- deleted 13y ago
  [deleted]
- emkemp 13y ago
  Another quibble: A "rouge" is also a one-point scoring play unique to Canadian Football.
mitchty 13y ago
Just a side note, rouge = red, rogue = villain/scoundrel/etc... I hate being that guy but it happened twice and triggered my have to post response. Tshuß!
- waqf 13y ago
  Just a side note, "Tschüß!" = bye/cheers/etc; "Tshuß!" = I can't spell German. I hate being that guy but … wait, I'm lying, I love it, but I normally try to restrain myself.
  - vdaniuk 13y ago
    How many times did you check your comment to make sure all grammar and punctuation is perfect? :)
    - elwell 13y ago
      Is wasn't perfect. There was a space between "but" and the ellipsis. Not to mention the several other mistakes.
      - guiambros 13y ago
        It wasn't... You know, I hate being the guy that hate those who hate being that guy, but couldn't resist.
        elwell 13y ago
        ah, nice!
        kirubakaran 13y ago
        "You know, I hate being the guy that hate those who hate being that guy, but couldn't resist." It is "I hate being the guy that hates those who hate being that guy" :-)
        guiambros 13y ago
        Mate! :)
        qbrass 13y ago
        *hates those
      - waqf 13y ago
        I disagree that the space between "but" and the ellipsis is a mistake, and the first citation I found (http://grammar.ccc.commnet.edu/grammar/marks/ellipsis.htm http://grammar.ccc.commnet.edu/grammar/marks/ellipsis.htm) supports me. However, lest anyone think I think I'm perfect, I'll point out that I omitted the period after "etc".
swordswinger12 13y ago
>Any sufficiently skilled rouge actor Not quite - finding the actual magic number that enables the backdoor would involve solving the discrete log problem for the suspicious constant in the spec. A more likely scenario is some disgruntled employee steals the number and sells it to the highest bidder.
jballanc 13y ago
There's enough wrong with what the NSA has been doing, and enough reasons to encourage people to take an interest in how to curtail, or at least better police, their actions without resorting to tawdry conspiracy theories. The NSA doesn't "protect" anyone. They are an intelligence agency. Their mandate is to collect information. The group you're thinking of, the one that's actually supposed to "protect" the network, is US Cyber Command: http://en.wikipedia.org/wiki/United_States_Cyber_Command http://en.wikipedia.org/wiki/United_States_Cyber_Command
- lawnchair_larry 13y ago
  USCC doesn't protect anyone either. They, like most of the Department of "Defense", are almost entirely offense in nature.
  - ihsw 13y ago
    The best defence is a good offence.
    - mousefad 13y ago
      A catchy sound byte, but in almost all practical situations, the best defence is avoiding conflict. In fights: flee. In international affairs: diplomacy.
      - javert 13y ago
        That is disasterous. That logic is why Chaimberlain allowed Hitler to get more and more and more power. ("Surely they'll agree to peace if we just let them have Poland.") It is also why my generation (I'm 27) will eventually have to fight a nuclear war that pits Iran against Israel and possibly the US. That war will potentially kill millions. And whose fault will it be? Obama's and Bush's. They will (if history is just and we don't change course) go down in history as potentially making mistakes that killed millions, just as Stalin and Hitler did. Or we could insist now (or, ideally, a few years ago) that Iran not develop nuclear weapons capability, if necessary fighting a minor tactical war to stop them. (There is NO reason to have Vietnam IV, where Afghanistan and Iraq are Vietnam II and III. Except of course socialism for defense contractors and altruism as we throw away trillions "re-building" the latter two countries.)
bri3d 13y ago
Lucky Green, who appears to have had inside knowledge of this deal based on this mailing list post from September, seems to disagree that this was a good investment: http://lists.randombit.net/pipermail/cryptography/2013-September/005341.html http://lists.randombit.net/pipermail/cryptography/2013-Septe... The particularly relevant portion is this: "This was $10M wasted. While this vendor may have had a dominating position in the market place before certain patents expired, by the time DoD/NSA paid the $10M, few customers used that vendor's cryptographic libraries. There is no reason to believe that the $250M per year that I have seen quoted as used to backdoor commercial cryptographic software is spent to any meaningful effect." Interestingly the mailing list post doesn't seem to mention the use of RSA's adoption as a factor in the NIST standard, so it's possible that while their knowledge was more advanced than the public's they didn't know about that side-effect.
tomp 13y ago
You're wrong on points 5 and 6. Dual_EC_DRBG is not "unsafe" per se; it's just that the constants chosen could be precalculated so as to allow easier prediction of the resulting random numbers. This doesn't mean that the numbers the constant was calculated from are easily calculable by an attacker.
gaius 13y ago
The problem of a backdoor is that actually, anyone can use it http://www.nytimes.com/2011/06/04/technology/04security.html?_r=0 http://www.nytimes.com/2011/06/04/technology/04security.html...
blazespin 13y ago
Not that many people use / used BSAFE. However, the news is still pretty mind blowing because it makes you wonder what else the NSA is doing.

adriand 13y ago

Minor quibble (and yes I'm as outraged by this as you are) - but "rouge" means "a red powder or cream used as a cosmetic for coloring the cheeks or lips", whereas "rogue" means "a person or thing that behaves in an aberrant, faulty, or unpredictable way", which is what you mean in this comment.

deleted 13y ago
[deleted]
emkemp 13y ago
Another quibble: A "rouge" is also a one-point scoring play unique to Canadian Football.

mitchty 13y ago

Just a side note, rouge = red, rogue = villain/scoundrel/etc... I hate being that guy but it happened twice and triggered my have to post response. Tshuß!

waqf 13y ago
Just a side note, "Tschüß!" = bye/cheers/etc; "Tshuß!" = I can't spell German. I hate being that guy but … wait, I'm lying, I love it, but I normally try to restrain myself.
- vdaniuk 13y ago
  How many times did you check your comment to make sure all grammar and punctuation is perfect? :)
  - elwell 13y ago
    Is wasn't perfect. There was a space between "but" and the ellipsis. Not to mention the several other mistakes.
    - guiambros 13y ago
      It wasn't... You know, I hate being the guy that hate those who hate being that guy, but couldn't resist.
      - elwell 13y ago
        ah, nice!
      - kirubakaran 13y ago
        "You know, I hate being the guy that hate those who hate being that guy, but couldn't resist." It is "I hate being the guy that hates those who hate being that guy" :-)
        guiambros 13y ago
        Mate! :)
      - qbrass 13y ago
        *hates those
    - waqf 13y ago
      I disagree that the space between "but" and the ellipsis is a mistake, and the first citation I found (http://grammar.ccc.commnet.edu/grammar/marks/ellipsis.htm http://grammar.ccc.commnet.edu/grammar/marks/ellipsis.htm) supports me. However, lest anyone think I think I'm perfect, I'll point out that I omitted the period after "etc".

swordswinger12 13y ago

>Any sufficiently skilled rouge actor Not quite - finding the actual magic number that enables the backdoor would involve solving the discrete log problem for the suspicious constant in the spec. A more likely scenario is some disgruntled employee steals the number and sells it to the highest bidder.

jballanc 13y ago

There's enough wrong with what the NSA has been doing, and enough reasons to encourage people to take an interest in how to curtail, or at least better police, their actions without resorting to tawdry conspiracy theories. The NSA doesn't "protect" anyone. They are an intelligence agency. Their mandate is to collect information. The group you're thinking of, the one that's actually supposed to "protect" the network, is US Cyber Command: http://en.wikipedia.org/wiki/United_States_Cyber_Command http://en.wikipedia.org/wiki/United_States_Cyber_Command

lawnchair_larry 13y ago
USCC doesn't protect anyone either. They, like most of the Department of "Defense", are almost entirely offense in nature.
- ihsw 13y ago
  The best defence is a good offence.
  - mousefad 13y ago
    A catchy sound byte, but in almost all practical situations, the best defence is avoiding conflict. In fights: flee. In international affairs: diplomacy.
    - javert 13y ago
      That is disasterous. That logic is why Chaimberlain allowed Hitler to get more and more and more power. ("Surely they'll agree to peace if we just let them have Poland.") It is also why my generation (I'm 27) will eventually have to fight a nuclear war that pits Iran against Israel and possibly the US. That war will potentially kill millions. And whose fault will it be? Obama's and Bush's. They will (if history is just and we don't change course) go down in history as potentially making mistakes that killed millions, just as Stalin and Hitler did. Or we could insist now (or, ideally, a few years ago) that Iran not develop nuclear weapons capability, if necessary fighting a minor tactical war to stop them. (There is NO reason to have Vietnam IV, where Afghanistan and Iraq are Vietnam II and III. Except of course socialism for defense contractors and altruism as we throw away trillions "re-building" the latter two countries.)

bri3d 13y ago

Lucky Green, who appears to have had inside knowledge of this deal based on this mailing list post from September, seems to disagree that this was a good investment: http://lists.randombit.net/pipermail/cryptography/2013-September/005341.html http://lists.randombit.net/pipermail/cryptography/2013-Septe... The particularly relevant portion is this: "This was $10M wasted. While this vendor may have had a dominating position in the market place before certain patents expired, by the time DoD/NSA paid the $10M, few customers used that vendor's cryptographic libraries. There is no reason to believe that the $250M per year that I have seen quoted as used to backdoor commercial cryptographic software is spent to any meaningful effect." Interestingly the mailing list post doesn't seem to mention the use of RSA's adoption as a factor in the NIST standard, so it's possible that while their knowledge was more advanced than the public's they didn't know about that side-effect.

tomp 13y ago

You're wrong on points 5 and 6. Dual_EC_DRBG is not "unsafe" per se; it's just that the constants chosen could be precalculated so as to allow easier prediction of the resulting random numbers. This doesn't mean that the numbers the constant was calculated from are easily calculable by an attacker.

gaius 13y ago

The problem of a backdoor is that actually, anyone can use it http://www.nytimes.com/2011/06/04/technology/04security.html?_r=0 http://www.nytimes.com/2011/06/04/technology/04security.html...

blazespin 13y ago

Not that many people use / used BSAFE. However, the news is still pretty mind blowing because it makes you wonder what else the NSA is doing.