4 ms·

Re: RSA having security and compliance products. This comment does nothing to dispel the thesis. RSAs primary business is secure software solutions, a major com

Re: RSA having security and compliance products. This comment does nothing to dispel the thesis. RSAs primary business is secure software solutions, a major component of which is sound cryptography. If the financial kickback to RSA was 'small' (care to post an analysis) then they added the backdoor to BSAFE for other reasons. Therefore I don't think that argument addresses the thesis. Here are a list of suites NIST validated with DUAL_EC. http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgval.html http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgval.... Plenty of products relied on BSAFE including enterprise security products like McAfee. https://lwn.net/Articles/566329/ https://lwn.net/Articles/566329/ But practical impact aside, you haven't addressed the primary thesis.

tptacek 12y ago
Sound cryptography is a tiny, tiny portion of software security. Most software security --- in fact, most information security in general --- doesn't touch on cryptography at all. Certainly most enterprise security and compliance products don't. Indeed, many random enterprise security products did use BSAFE. Most of them did so because during the mid/late '90s, a BSAFE license was how you shipped certificate-based public key features, because RSA was enforcing their patent. Many of those products include BSAFE on their manifest but use OpenSSL and Microsoft SChannel instead. And the features we're talking about are things like login pages or agent/server communications for things running on 10-net addresses. How many of those enterprise security products did end users rely on to protect their secrets from the USG? I'm going to go out on a limb and suggest that number is zero.
- xnull2guest 12y ago
  We are in mostly full agreement on this comment. (I do not think it challenges the thesis.)

tptacek 12y ago

Sound cryptography is a tiny, tiny portion of software security. Most software security --- in fact, most information security in general --- doesn't touch on cryptography at all. Certainly most enterprise security and compliance products don't. Indeed, many random enterprise security products did use BSAFE. Most of them did so because during the mid/late '90s, a BSAFE license was how you shipped certificate-based public key features, because RSA was enforcing their patent. Many of those products include BSAFE on their manifest but use OpenSSL and Microsoft SChannel instead. And the features we're talking about are things like login pages or agent/server communications for things running on 10-net addresses. How many of those enterprise security products did end users rely on to protect their secrets from the USG? I'm going to go out on a limb and suggest that number is zero.

xnull2guest 12y ago
We are in mostly full agreement on this comment. (I do not think it challenges the thesis.)