4 ms·
If you read carefully, they don't deny what Reuters reported: taking $10M to make the RNG default. Reuters: "Undisclosed until now was that RSA received $10 mi
by pdknsk 13y ago
If you read carefully, they don't deny what Reuters reported: taking $10M to make the RNG default.
Reuters: "Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract."
And now the response.
RSA: "Recent press coverage has asserted that RSA entered into a “secret contract” with the NSA to incorporate a known flawed random number generator into its BSAFE encryption libraries. We categorically deny this allegation."
---> Only one part of the first sentence needs to be untrue for the allegation to be deniable. RSA did not incorporate a "known flawed" RNG, because it wasn't at that time. And that's not what the alleged contract was even about, but to make default.
RSA: "We have worked with the NSA, both as a vendor and an active member of the security community. We have never kept this relationship a secret and in fact have openly publicized it."
---> Focus on relationship not being secret, but contracts may be.
RSA: "RSA, as a security company, never divulges details of customer engagements, but we also categorically state that we have never entered into any contract or engaged in any project with the intention of weakening RSA’s products, or introducing potential ‘backdoors’ into our products for anyone’s use."
---> They had not positively known the RNG is flawed.
- btian 13y agoIt did. First paragraph in fact > Recent press coverage has asserted that RSA entered into a “secret contract” with the NSA to incorporate a known flawed random number generator into its BSAFE encryption libraries. We categorically deny this allegation.
- mnordhoff 13y agoHypothesis: They don't say which "[r]ecent press coverage". They could be referring to some badly-worded rehash of the Reuters story.
- Spooky23 13y agoActually, because they were writing doublespeak, they said nothing of the sort. Since they declared NIST the ultimate arbiter of encryption quality, by definition they didn't do anything wrong.
- wfunction 13y agothe word "known" is the key there. The rest of the sentence is fluff.
- spikels 13y agoWrong RSA is denying incorporating "a known flawed random number generator" into BSAFE in 2004. Elsewhere in the same press release RSA states that they did not consider Dual EC DRBG to be considered flawed until September 2013 despite being aware of concerns dating back to 2007. Therefore in 2004 when RSA added Dual EC DRBG into BSAFE it was not "a known flawed random number generator". They also admit to a business relationship with the NSA but refuse to discuss it.
- Aloha 13y ago'Concerns' and 'known flawed' are not the same thing.
- bmelton 13y agoIt was 'known flawed' in 2007. What was not know was whether or not anyone possessed private keys that would have made that known flaw a known exploit. The knowledge that the NSA did indeed have a backdoor didn't come along until Snowden.
- PeterisP 13y agoAll they deny is that their secret contract with NSA didn't require them to incorporate "a known flawed RNG". They do admit that they agreed to incorporate that specific RNG for the money, that such a contract existed. They do admit that the contract was secret - the explicit influence it was not disclosed to the customers of that product. In essence they deny only that the specific RNG was known to be flawed, but don't even apologize for the fact that they had a clear conflict of interest that they didn't disclose to customers at the time, and didn't treat "please use method X, we'll pay you" as an unacceptably suspicious request in the first place.
- deleted 13y ago[deleted]
- trauco 13y agoAlso key is the phrase "with the intention".