3 ms·
It seems to me that she addressed those exact concerns: > So, yes, it is possible that, in 2004, nobody at RSA had any articulable suspicions about Dual EC. T
by chilldream 13y ago
It seems to me that she addressed those exact concerns:
> So, yes, it is possible that, in 2004, nobody at RSA had any articulable suspicions about Dual EC. They may have taken it on faith that this was another DES situation where the NSA knew it was better but couldn't disclose why. Okay. Is that fair? I think that's fair.
> If that were the end of the story, I would be standing here saying “poor RSA! How cruelly the NSA mistreated them!” But, guess what, it isn't. In 2007 the possibility of a backdoor was made very public, and after that “everyone knew” not to use it. None of us knew for sure it was backdoored (even if some people retroactively pretend they did) but that was kind of a crazy risk to take when there were other RNGs to pick from with no known risks and were faster to boot.
- diminoten 13y agoThe point is it's not a crazy risk to take when you trust the NSA, even in 2007, when everyone else knew not to use Dual EC. I just don't see how the RSA is supposed to realize the NSA is evil before the Snowden leaks.
- ska 13y agoYou don't have to assume the NSA is evil to understand that its mandate means you can never trust their incentives in something like this. You don't have to have any bad guys to have conflicts in purpose and incentive, and this has clearly been true for the entire existence of such interactions.
- aragot 13y ago> how the RSA is supposed to realize the NSA is evil before the Snowden leaks. I'm surprised at this interrogation. I've classes in schools talking about economic/state intelligence methods. The responsibility of a big corp is to secure itself from outside threats and visible links to state agencies will be analyzed by observers.