4 ms·

NSA compromised Dual EC DRBG never actually worked in OpenSSL

58 points by dsl 13y ago

shalmanese 13y ago
While it's funny that Dual_EC_DRGB was so maligned, this bug was not found until the recent news, it's also disturbing that OpenSSL is so poorly tested that a bug of this magnitude was allowed to slip through for so long.
- wereHamster 13y ago
  > Why wasn't this bug caught in the FIPS 140-2 validation testing? > > [snip explanation...] Try to read the articles sometimes.
  - sp332 13y ago
    FIPS 140-2 isn't the only testing done on OpenSSL. You'd think some unit tests would be in place at least.
- eropple 13y ago
  From my understanding, OpenSSL is well-tested, but not against the FIPS 140-2 validation (because it's not very meaningful), which is what would reveal this issue. Like most open-source stuff, things that matter get eyes on it.
losethos 13y ago
youre_welcome gambling let_me_count_the_ways it's_hopeless resume the Church scum vengeance in_theory heathen perfect beep_beep is_it_just_me_or astounding happy_happy_joy_joy wonderful humility I_love_you it's_hopeless my_precious failure_to_communicate happy_happy_joy_joy ohh_thank_you joy music you_don't_say joking by_the_way it's_hopeless failure_to_communicate I'm_God_who_the_hell_are_you umm_what_now Ivy_league I'm_gonna_smack_someone if_and_only_if epic_fail are_you_insane Terry just_between_us handyman lying sex air_head look_buddy pride smack_some_sense_into_you oh_no money Ivy_league battle lighten_up services insane wife test_pilot qed hang_in_there clever I_donno C:\TAD\Text\DARWIN.TXT y would retain this resemblance all the more, as the variations, which afforded the basis for their subsequent modification through natural selection, would tend from the first to be similar; the parts being at an early stage of growth alike, and being subjected to nearly the same conditions. Such parts, whether more or less modified, unless their common origin became wholly obscured, would be serially homologous. In the great class of molluscs, though the parts in distinct species can be shown
lstamour 13y ago
Next in thread, David Johnson points out: I have previously pointed this out as a bug in the FIPS spec. The need to prevent matching pairs in random numbers by 4.8.2 in FIPS 140-2 reduces the entropy. The requirement in 4.8.2 applies to all SP800-90 DRBGs, not just the Dual EC DRBG. I submitted this as part of my comments to the re-opened SP800-90 comment period.
oakwhiz 13y ago
So they have a patch to fix it, but can't apply it because that would void the FIPS certification status, and they won't apply it because they are disabling the use of Dual_EC_DRBG anyway.

58 points by dsl 13y ago

While it's funny that Dual_EC_DRGB was so maligned, this bug was not found until the recent news, it's also disturbing that OpenSSL is so poorly tested that a bug of this magnitude was allowed to slip through for so long.

wereHamster 13y ago
> Why wasn't this bug caught in the FIPS 140-2 validation testing? > > [snip explanation...] Try to read the articles sometimes.
- sp332 13y ago
  FIPS 140-2 isn't the only testing done on OpenSSL. You'd think some unit tests would be in place at least.
eropple 13y ago
From my understanding, OpenSSL is well-tested, but not against the FIPS 140-2 validation (because it's not very meaningful), which is what would reveal this issue. Like most open-source stuff, things that matter get eyes on it.

losethos 13y ago

youre_welcome gambling let_me_count_the_ways it's_hopeless resume the Church scum vengeance in_theory heathen perfect beep_beep is_it_just_me_or astounding happy_happy_joy_joy wonderful humility I_love_you it's_hopeless my_precious failure_to_communicate happy_happy_joy_joy ohh_thank_you joy music you_don't_say joking by_the_way it's_hopeless failure_to_communicate I'm_God_who_the_hell_are_you umm_what_now Ivy_league I'm_gonna_smack_someone if_and_only_if epic_fail are_you_insane Terry just_between_us handyman lying sex air_head look_buddy pride smack_some_sense_into_you oh_no money Ivy_league battle lighten_up services insane wife test_pilot qed hang_in_there clever I_donno C:\TAD\Text\DARWIN.TXT y would retain this resemblance all the more, as the variations, which afforded the basis for their subsequent modification through natural selection, would tend from the first to be similar; the parts being at an early stage of growth alike, and being subjected to nearly the same conditions. Such parts, whether more or less modified, unless their common origin became wholly obscured, would be serially homologous. In the great class of molluscs, though the parts in distinct species can be shown

lstamour 13y ago

Next in thread, David Johnson points out: I have previously pointed this out as a bug in the FIPS spec. The need to prevent matching pairs in random numbers by 4.8.2 in FIPS 140-2 reduces the entropy. The requirement in 4.8.2 applies to all SP800-90 DRBGs, not just the Dual EC DRBG. I submitted this as part of my comments to the re-opened SP800-90 comment period.

oakwhiz 13y ago

So they have a patch to fix it, but can't apply it because that would void the FIPS certification status, and they won't apply it because they are disabling the use of Dual_EC_DRBG anyway.