4 ms·
It did. First paragraph in fact > Recent press coverage has asserted that RSA entered into a “secret contract” with the NSA to incorporate a known flawed rando
by btian 13y ago
It did. First paragraph in fact
> Recent press coverage has asserted that RSA entered into a “secret contract” with the NSA to incorporate a known flawed random number generator into its BSAFE encryption libraries. We categorically deny this allegation.
- mnordhoff 13y agoHypothesis: They don't say which "[r]ecent press coverage". They could be referring to some badly-worded rehash of the Reuters story.
- Spooky23 13y agoActually, because they were writing doublespeak, they said nothing of the sort. Since they declared NIST the ultimate arbiter of encryption quality, by definition they didn't do anything wrong.
- wfunction 13y agothe word "known" is the key there. The rest of the sentence is fluff.
- spikels 13y agoWrong RSA is denying incorporating "a known flawed random number generator" into BSAFE in 2004. Elsewhere in the same press release RSA states that they did not consider Dual EC DRBG to be considered flawed until September 2013 despite being aware of concerns dating back to 2007. Therefore in 2004 when RSA added Dual EC DRBG into BSAFE it was not "a known flawed random number generator". They also admit to a business relationship with the NSA but refuse to discuss it.
- Aloha 13y ago'Concerns' and 'known flawed' are not the same thing.
- bmelton 13y agoIt was 'known flawed' in 2007. What was not know was whether or not anyone possessed private keys that would have made that known flaw a known exploit. The knowledge that the NSA did indeed have a backdoor didn't come along until Snowden.
- PeterisP 13y agoAll they deny is that their secret contract with NSA didn't require them to incorporate "a known flawed RNG". They do admit that they agreed to incorporate that specific RNG for the money, that such a contract existed. They do admit that the contract was secret - the explicit influence it was not disclosed to the customers of that product. In essence they deny only that the specific RNG was known to be flawed, but don't even apologize for the fact that they had a clear conflict of interest that they didn't disclose to customers at the time, and didn't treat "please use method X, we'll pay you" as an unacceptably suspicious request in the first place.