Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

RSA Warns Developers Not To Use RSA Products

timothy posted about a year ago | from the surely-they-have-some-alternatives-to-suggest dept.

Encryption 128

rroman writes "RSA has recommended developers not to use Dual_EC_DRBG random number generator (RNG), which has been known to be weak and slow since 2006. The funny thing is, that even though this has been known for so long, it is the default RNG in BSafe cryptographic toolkit, which is product of RSA."

cancel ×

128 comments

Sorry! There are no comments related to the filter you selected.

Doesn't matter (5, Insightful)

Anonymous Coward | about a year ago | (#44913709)

Surely no-one in their right mind is still using crypto software from US companies? None of it can be trusted any more.

Re:Doesn't matter (5, Funny)

Anonymous Coward | about a year ago | (#44913771)

I see that you're not using American software, let's go into this back room and you can tell me why you hate America.

Re:Doesn't matter (-1, Troll)

Anonymous Coward | about a year ago | (#44913773)

The Beaners in Latin America are pissed, the Russians are readying for all-out war, the Chinks are hacking and cracking systems to steal secrets. It looks like World War III is about to kick off with a false-flag incident.

Wow, fuck! Do you understand the implications of this? Shit is going to go down, motherfucker. For real. Fuck! Shooting a squirrel's scrotum with a BB gun! That's how fucking crazy this is, dude. Dude! What the fuck? God Damn! This crypto is some weak-ass compromised shit!

You can't stop Edward Snowden, he's making the United States look like a bunch of goddamn savage fools! Of course, that's what they are. They launched significant overseas assaults on average every forty months since the early sixties. Fuck! Can you believe that? Holy, holy, holy shit. Man, things are crazy, times are crazy. Americans are crazy, crazy, stupid-ass pigs who are going to get us all killed! The rabid swine must be stopped!

I'm praying to fucking Jesus Christ right now while giving myself a coffee enema. The sound of it coming out of my ass is a lot like, "Pffffffblugugugubbbbbbppppght!" I'm scared. Somebody please hold me, I'll try not to get an erection, even if my prostate is soaked in civet shit and facceine...or was that caffeine? Fuck!

Re:Doesn't matter (0)

ColdWetDog (752185) | about a year ago | (#44914149)

And here, sports fans, is exactly why we need better controls on firearms and video games in the US.

Re:Doesn't matter (0)

davester666 (731373) | about a year ago | (#44914487)

Or some kind of passport to control who is permitted to post on these internets.

Re:Doesn't matter (-1)

Anonymous Coward | about a year ago | (#44914011)

Two-time world war champs! Suck it!

USA! USA! USA!

Re:Doesn't matter (0)

Anonymous Coward | about a year ago | (#44914501)

Yup, certainly following a pattern there, USA. Happy to stay out of both wars and profiteer until your own citizens come under attack. Something I'm sure you can be morally proud of.

Re:Doesn't matter (0)

Anonymous Coward | about a year ago | (#44914527)

Actually I can't help but feel this explains something about the American psyche ever since, trying to act as an international police force and not happy to stand back any longer. I think the USes self-serving disinterest was probably historically more successful than its current self-serving overbearing interest, unfortunately.

Re: Doesn't matter (2, Informative)

Anonymous Coward | about a year ago | (#44915825)

The "global police force" metaphor is used a lot but it is completely wrong.

The actions on the international stage are driven entirely by economical and geopolitical interests. If it so happens that the operation appears to "do good" then a media spin will be applied, furthering the "global policeman" illusion.

On the other hand, operations which topple democratic governments, install anti-leftist dictators, support smaller third world dictatorships in their abuses, grab the resources of a country, fund terrorists to keep on destabilizing a country, etc., etc., these are not mentioned in the policing context.

The purpose of force projection has been and will be the assertion of a superstate status, though this status has been progressively more and more inapplicable since the fall of the Soviet Union. Without a clearly defined bogeyman, the media spin becomes harder to manufacture.

Re: Doesn't matter (2)

Internetuser1248 (1787630) | about a year ago | (#44916833)

On the other hand, operations which topple democratic governments, install anti-leftist dictators, support smaller third world dictatorships in their abuses, grab the resources of a country, fund terrorists to keep on destabilizing a country, etc., etc., these are not mentioned in the policing context.

This would be logical. The weird thing is they are. I have seen for example Vietnam, Cuba and Chile used in exactly the context you describe, including here on slashdot. It appears that most people in the US don't actually understand the details of what happened in those cases so people get away with such absurd and outrageous nonsense without being called on it.

Re:Doesn't matter (0)

Anonymous Coward | about a year ago | (#44914971)

So we SHOULD get involved in wars which don't involve us?

Re:Doesn't matter (0)

Anonymous Coward | about a year ago | (#44915115)

Wait, so the US should routinely get involved in wars that don't involve US citizens being attacked?

Re:Doesn't matter (0)

Anonymous Coward | about a year ago | (#44917101)

The answer to your question is simple - no, they should not routinely get involved. Other than that, there are no simple black or white answers; every situation is different, and should be judged appropriately on its own merits. However, since WW2 the US has routinely started wars against countries that have not attacked US citizens, which is what I would say most people have the biggest problem with.

Re:Doesn't matter (0)

kthreadd (1558445) | about a year ago | (#44917119)

Because no one else would. Maybe not always the best thing, but often a lesser bad thing than to stay aside and watch.

Re:Doesn't matter (0)

Anonymous Coward | about a year ago | (#44914933)

In the USA, your crypto software doesn't trust you.

Re:Doesn't matter (1)

runeghost (2509522) | about a year ago | (#44915981)

In the USA, your crypto software doesn't trust you.

Ah, that explains TPM.

RSA ?? NSA ?? (-1)

Anonymous Coward | about a year ago | (#44913725)

See ??

The obligatory NSA question (5, Interesting)

hsa (598343) | about a year ago | (#44913753)

Is NSA finding this RNG hard to crack, or did NSA tell RSA to slip in a backdoor back in 2006 - and RSA folks are trying to crawl out of the hole they dug for themselves?

Re:The obligatory NSA question (4, Interesting)

Jane Q. Public (1010737) | about a year ago | (#44913827)

"Is NSA finding this RNG hard to crack, or did NSA tell RSA to slip in a backdoor back in 2006 - and RSA folks are trying to crawl out of the hole they dug for themselves?"

Evidence very strongly suggests the latter.

Re:The obligatory NSA question (5, Insightful)

jthill (303417) | about a year ago | (#44915683)

It wasn't RSA. They trusted the NSA, with good reason. The NSA had earned the trust of just about everybody in the community by improving DES with changes nobody understood until fifteen years later.

Then someone figured out that the way this new RNG is set up, the constants the NSA chose *could be* the public half of an asymmetric key, and if so the RNG's state could be read with very little effort by anyone in possession of the private half. There is no mathematical way at all to tell whether this is the case, but apparently something in the Snowden documents at least strongly suggests the NSA did know about it and did use it.

It's important to highlight that this isn't the kind of weakness anyone _else_ can take advantage of; a blackhat would still have to discover their private key, the exact same problem he was facing before. The NSA are apparently not dumb enough to rely on keeping math a secret.

But it seems every successful security service forgets the basic lesson: set up a system with unchecked power, the scum of the earth will eventually take notice. From that moment they'll dedicate their lives to getting control of it. They'll eventually succeed.. Snowden took advantage of criminally slack security in the NSA. Just the the fact that he could reveal the documents he revealed is proof the NSA have already gotten arrogant and sloppy, never mind what's in them.

Re:The obligatory NSA question (1)

Anonymous Coward | about a year ago | (#44916487)

Of course it is easy to foreign agents to get ahold of any secret. The more info collected into one place, the bigger the carrot.
They're trained to wrestle information out of government and corporate hands. What will it take? Money? Threats? Violence? Brainwashing?

Google up how successful China is for instance.

Re:The obligatory NSA question (1)

Bert64 (520050) | about a year ago | (#44916825)

It's likely that the issues with DES would have been discovered sooner had they not been fixed, after all an actively used system is far more worthy of study than something thats been superseded and is no longer used.

As for discovering the private key, who's to say Snowden doesn't have a copy of it? And for all we know, that key could have been leaked to others long ago, the US is not the only country that conducts spying...

Re:The obligatory NSA question (1)

Jane Q. Public (1010737) | about a year ago | (#44916839)

"The NSA had earned the trust of just about everybody in the community by improving DES with changes nobody understood until fifteen years later. "

Are you being sarcastic? The "improvements" they made are now being looked at, 15 years later, as examples of Government backdoors in their encryption.

(I know it's not every case, but the consensus is that it was in THIS case, and possibly several others. I have friends in the field and they knew about this particular instance of PRNG for elliptiical curve crypto way back when. Few trusted it except, apparently, RSA and its customers.)

So any "improvements" from the NSA have to come with a grain of salt. You might have the best encryption system in the world, but if your credibility is shit (as the NSA's now is), it doesn't matter much because nobody will use it.

Re:The obligatory NSA question (1)

jthill (303417) | about a year ago | (#44916947)

The "improvements" they made are now being looked at, 15 years later, as examples of Government backdoors in their encryption.

I suspect you're talking about some other DES [wikipedia.org] .

Re:The obligatory NSA question (4, Interesting)

KiloByte (825081) | about a year ago | (#44913839)

Considering the consequences of defying the spooks, they had no real choice but to dig that hole or close the company.

Re:The obligatory NSA question (1)

flyingfsck (986395) | about a year ago | (#44915695)

Yeah, well, now they will have close the company anyway, since all their customers are running for the hills. They have already announced lay-offs.

Re:The obligatory NSA question (5, Informative)

Billly Gates (198444) | about a year ago | (#44913861)

Yep NSA did play a hand in this insecure logarithm [arstechnica.com] .

Sadly just a month ago such a comment would be modded -1 offtopic or -1 flamebait as the equailivant of that crazy guy drunk talking to himself on the subway.

Slightly different topic, this algorithm seems very strong as it is what slashdotters say is a perfect encryption mathmatical algorithm. It is Elispse based so there are more numbers to guess and the seed process is very stenious to make it harder to crack. It seems like the best one which is why BASE libraries use it just on that evidence. Can a mathmatician or crypto expert explain why this NSA endorsed algorithm has so many problems compared to SHA-2 or BES?

Re:The obligatory NSA question (1)

Anonymous Coward | about a year ago | (#44914009)

So where are all those clowns who parroted the "tinfoil hat" comments now, huh? Eating their humble pie, no doubt.

I TOLD YOU SO!

Re:The obligatory NSA question (5, Interesting)

Anonymous Coward | about a year ago | (#44914111)

The problem is that the magic numbers used in the algorithm have no known source so no one in the community can go back and find the justification for them. They are just there. I see the potential vulnerability here is that if you know the base numbers here, and since it is elliptical, that it simplifies the brute-force decryption process. How much? We don't know, yet. The problem is being looked at as I type.

Re:The obligatory NSA question (1)

AHuxley (892839) | about a year ago | (#44914415)

From the 1920's on the ~GCHQ and ~NSA gave UK and US political and military leaders limited and then full plain text about the world.
With the generational (1950-80's) change from dedicated cryptography machines to the 'internet' that same political and military deal had to be met.
How do you get the world chatter? You have to create any emerging digital standards. Just as the cryptography machines and telco equipment where interfered with and sold cheap to friendly nations.
If the UK and US encounter perfect encryption, they get to the firm making it, swap staff, buy in, buy up, create negative press or bolster the prestige of a more tame firm. Product prices can also be fixed until the perfect encryption never makes a profit or has to change methods to keep up.

Re:The obligatory NSA question (0)

Anonymous Coward | about a year ago | (#44914657)

What do the Russians, Chinese, French, Germans, Japanese, and Italians do? They are all known to have read other people's codes in the past, and many of them in the present. You just keep bringing up the US, and sometimes the UK, and usually ignore the Russians / Soviets and the role they played.

Re:The obligatory NSA question (2)

AHuxley (892839) | about a year ago | (#44914883)

French, Germans, Japanese, and Italians wanted US political aid, trade, mil support, they did what they where 'told' and kept to a US/UK set standard.
If any national crypto private or public sector standards emerged from with in Asia or the forming NATO/EU the UK and US where quick to request individual firms or nations come back to the set 'NSA/GCHQ' weakened standard.
How would any nations mil or political leader say 'no' to the full might of NATO or the USA crypto?
Saying yes to the NSA/GCHQ bought in amazing new tech, local jobs, generational trust and contracting wealth to trusted local ex mil.
Questions bought in political issues, legal friction, trade issues, treats, cash flow issues, private sector bankruptcy and a loss of standing internationally.
The Soviet Union went for the human side of US/UK tech and wanted weak/ideological conflicted or cash poor staff to sell out their western govs and where always waiting for the next offer.
What did the Soviets have? Cuba was safe for a big listening station. Bits of Africa? Asia? South America? Huge spy ships and expensive satellites never gave the results and coverage demanded.
The UK and US always had the global banking, telco systems and crypto. The Soviet Union had to connect if it wanted to export on NSA terms too :)
China just sat back and flooded the West with their students and products- learning their way up until they could trade their way to any project at any quality or price. Win contracts or offer aid projects and make friends.
So really beyond the junk encryption setting NSA and GCHQ you where stuck with age old human spying, spy ships, satellites or doing what you where told by US/UK experts.
ie the "Russians / Soviets" could not even keep their own crypto traffic safe beyond the 1950's (very wise one time pad use was stopped).
Their radio and communications networks became huge, sloppy and totally useless into the ~1960-80's.
The role the Soviet played is a bit like our 'internet' now or Enigma and Germany - back to plain text. China went smart and offered layers of regional and national data - mixed with propaganda, missing data, fake data and politics - good luck with working that out at a spy or database level.

Re:The obligatory NSA question (5, Interesting)

icebike (68054) | about a year ago | (#44914771)

I've never seen any examples of negative press from government sources.

More likely the US simply developed an entire line of dedicated processors that can crack almost any code.
This probably happened about the same time they dropped their designation of encryption as a munition.
They already had the solution in hand.

However, when real time continuous encryption started to be the norm, (like encrypted Skype, VPNs in routers, and SSL everywhere)
they simply bought their way into the companies doing it, and induced them with money and contracts.

I've stated more than once here that I believe it will be eventually revealed that the NSA fully funded Microsoft's acquisition of SKYPE.
Probably because EBay was incompetent and not terribly interested in ripping out the un-traceable routing via small
remotely distributed groups of nodes and many volunteer notes.
Even if Ebay did provide access to the encryption technology, they couldn't circumvent the routing issues to provide taps.

The first thing Microsoft did was route all traffic through their servers. No more routing via anonymous "volunteers" or off-shore
peer-to-peer technology. It now goes direct to Microsoft and then to the other party. There was never a business case to do this.
It was working just fine, and hasn't improved since Microsoft took over. There was ONLY ever an intelligence case to make this change.
Why would Microsoft take on that expense for free? Because the NSA bought Skype for them.

Re:The obligatory NSA question (2)

kasperd (592156) | about a year ago | (#44916481)

The first thing Microsoft did was route all traffic through their servers. No more routing via anonymous "volunteers" or off-shore peer-to-peer technology.

That's not true. Earlier this month I have seen my Skype calls get routed through peers, who were not participating in the call. That however resulted in very unreliable calls, so I got the machine running Skype onto a public IP address. With that in place I could see the traffic was going directly between me and the IP addresses of the people I was communicating with. At one occasion I did however notice other people's calls getting routed through my computer, now that it had a public IP.

Anybody using Skype can look at their own network traffic to verify my observations.

Why Skype hasn't started supporting IPv6 is beyond me. It is so abundantly clear how Skype user experience is suffering from NAT. They could even have a Teredo client built into the client as a fallback when all other methods fail. Teredo is the only standardized tunnel protocol I know, which can be implemented in user mode without administrator privileges.

Re:The obligatory NSA question (1)

omkhar (167195) | about a year ago | (#44915103)

for one, SHA-2 is a hashing algorithm, not encryption. Secondly, although the math is sound, the algorithm which generates the seed for the PRNG is allegedly based on constants which make the crypto trivial for the NSA to brute force.That algorithm is known as Dual_EC_BRDG.

Re:The obligatory NSA question (4, Insightful)

Solandri (704621) | about a year ago | (#44915265)

Up to a month ago such a comment would've been modded to -1 because historically, NSA had helped improve [schneier.com] the security of encryption standards. As Schneier has said, the revelations about recent NSA activity has completely evaporated the goodwill NSA earned in the cryptographic community from back then.

Re:The obligatory NSA question (2)

kasperd (592156) | about a year ago | (#44916519)

Up to a month ago such a comment would've been modded to -1 because historically, NSA had helped improve [schneier.com] the security of encryption standards.

Schneier has been speculating [schneier.com] about the possibility of an NSA planted backdoor in Dual_EC_DRBG since 2007. Which by the way took me a few attempts to find again since there are many hits if you search for NSA backdoor on his site.

As Schneier has said, the revelations about recent NSA activity has completely evaporated the goodwill NSA earned in the cryptographic community from back then.

Goodwill might be an exaggeration. Learning that NSA had improved security of DES did reduce the distrust in NSA, but it did not eliminate it. The first evidence of the Dual_EC_DRBG probably brought that distrust back to the previous level. By now I guess the trust in NSA is at an absolute low. (If it got any lower you would start trusting anything from the NSA not to be trustworthy.)

Re:The obligatory NSA question (1)

flyingfsck (986395) | about a year ago | (#44915699)

Some smart guys at Microsoft already explained it years ago. A quick Google wil get the info for you.

Re:The obligatory NSA question (0)

Anonymous Coward | about a year ago | (#44913993)

Why now though? One may imagine that the NSA has discussed with RSA the possibility that one of Snowden's yet-to-be-leaked documents reveals this coercion. What should RSA do? Nothing is one possibility, but better to limit the damage by announcing this weakness in advance of the leak.

Re:The obligatory NSA question (3, Insightful)

gweihir (88907) | about a year ago | (#44914179)

The problem is that RSA made the worst generator (in every respect) of several the default. That cannot have been an engineering decision or a business decision in the interest of their customers. It is dead certain that NSA coercion is behind it, anybody that can build a working crypto library cannot be that incompetent.

Maybe not RSA, but certainly NSA (4, Informative)

Frosty Piss (770223) | about a year ago | (#44914543)

or did NSA tell RSA to slip in a backdoor back in 2006

It's not so much the possibility that the NSA influenced RSA, rather they influenced the standard itself.

Here's the whole story according to Bruce Schneier:

http://www.wired.com/politics/security/commentary/securitymatters/2007/11/securitymatters_1115 [wired.com]

RNG (0)

Anonymous Coward | about a year ago | (#44913761)

I suggest randomly selecting which random number generator you use to randomly select things.

stoopit niggers (-1)

Anonymous Coward | about a year ago | (#44913775)

http://biblehub.com/proverbs/16-33.htm

We may throw the dice, but the LORD determines how they fall.

Yer so fucked.

No point pussy-footing around (5, Insightful)

innocent_white_lamb (151825) | about a year ago | (#44913785)

There's no point in pussy-footing around this. It's obvious that RSA was either forced or "rewarded" into using an insecure method. And that they knew it at the time (because they are cryptographers and because they don't live in the bottom of a well.)

Therefore, RSA has proven themselves untrustworthy at best, corrupt at worst, and quite likely both.

The question is what to do next? Rip out everything RSA in all infrastructure and replace it with something that works appears to be the best approach, but how should that be done and what should it be replaced with? And, most importantly, how can we verify that replacement?

Re:No point pussy-footing around (4, Interesting)

Jane Q. Public (1010737) | about a year ago | (#44913901)

"Therefore, RSA has proven themselves untrustworthy at best, corrupt at worst, and quite likely both."

And don't forget that their "super security" ID dongles were hacked just a year or so ago.

All in all, it's looking like RSA is a corporation to avoid.

Re:No point pussy-footing around (4, Interesting)

93 Escort Wagon (326346) | about a year ago | (#44914315)

An interesting scenario just came to mind...

1) RSA intentionally weakens their crypto at the behest of the NSA (this is fairly certain)
2) Chinese hack RSA - the only question is just how thoroughly (a known fact)

Now comes the speculation.

3) China analyzes what they got from RSA and discover the crypto is weaker than expected.
4) Quietly, China also begins to take advantage of this breakable crypto the NSA foisted on US companies and citizens.
5) China deduces why it was done and starts looking for weaknesses in other US crypto products - possibly succeeding, given they have a decent idea what to look for.

Followed by

6) China successfully and quietly penetrates most US defense contractors and financial institutions.

Re:No point pussy-footing around (1)

Anonymous Coward | about a year ago | (#44914997)

6) China successfully and quietly penetrates most US defense contractors and financial institutions.

So, you are saying you think the NSA deliberately weakens an encryption method, then proceeds to use that method itself? Because the NSA sets the standards for the DoD and defense contractors.

I can't tell, do you think the NSA is brilliant or stupid beyond belief?

Re:No point pussy-footing around (1)

Jane Q. Public (1010737) | about a year ago | (#44915129)

"I can't tell, do you think the NSA is brilliant or stupid beyond belief?"

I'm pretty sure it means a little bit of both.

Re:No point pussy-footing around (3, Interesting)

93 Escort Wagon (326346) | about a year ago | (#44916097)

I think the NSA believed it was okay to weaken cryptography because they assumed they would be the only one who knew about what they'd done and specifically how they'd weakened it.

So really, what I believe is they were very clever and, at the same time, very naive... Or perhaps sophomoric and arrogant would be a better fit.

Re:No point pussy-footing around (1)

Jane Q. Public (1010737) | about a year ago | (#44916787)

I think we're on the same channel here. But the exact mix of brilliance and stupidity is really not so important. Whatever the magnitude of the individual parts, the end result is still that NSA can't be trusted to act in the public good.

Re:No point pussy-footing around (1)

wisnoskij (1206448) | about a year ago | (#44915215)

The more bigger of a threat that China is, and the more hacking groups break into goverment files the more power the NSA is given, and they get the benifit of spying on themselves.

So it is a win/win to compromise your own systems.

Re:No point pussy-footing around (1)

steelfood (895457) | about a year ago | (#44915633)

It certainly explains how they've managed to penetrate so many large corporations, and in such a short window. There was a common weak security element between all these companies, and this was likely it.

I do remember the RSA was hacked into not so long ago, and a good chunk of their data was stolen. I wonder if they got a dose of their own medicine. In fact, I wonder if they allowed it to happen deliberately, to show the spooks what happens when they try to sabotage everybody indiscriminately.

Re:No point pussy-footing around (1)

flyingfsck (986395) | about a year ago | (#44915703)

Yup, all that already happened a few years ago.

Re:No point pussy-footing around (0)

Anonymous Coward | about a year ago | (#44914485)

And don't forget that their "super security" ID dongles were hacked just a year or so ago.

The dongles weren't hacked. Someone broke into RSA and stole the seed records, which is what goes inside the security dongle (and is supposedly impossible to extract from the dongle).

A copy of the seed record lets you create a duplicate dongle.

Of course, once the dongles have been delivered to customers, there is no reason for RSA to keep the seed records - they should have been wiped, let alone be stored on computers with internet connectivity.

Re:No point pussy-footing around (1)

Jane Q. Public (1010737) | about a year ago | (#44915167)

"The dongles weren't hacked. Someone broke into RSA and stole the seed records, which is what goes inside the security dongle (and is supposedly impossible to extract from the dongle)."

Technically correct. I almost wrote "but it's a distinction with no difference"... except that's wrong. It's actually WORSE. It means it wasn't just a bug... RSA was woefully irresponsible with vital user data.

Re:No point pussy-footing around (1)

Bert64 (520050) | about a year ago | (#44916893)

There is no reason for them to provide dongles pre-seeded... And if you buy such devices, you have no proof that the records have been destroyed even if the company claims they have.
Customers should be able to seed their own dongles.

Ofcourse i've been saying this for years, asking what happens if rsa get hacked and all the seeds taken... People said that was crazy talk, rsa would never get hacked etc.

Re:No point pussy-footing around (3, Informative)

mysidia (191772) | about a year ago | (#44913907)

The question is what to do next? Rip out everything RSA in all infrastructure and replace it with something that works appears to be the best approach, but how should that be done and what should it be replaced with?

I have no need to, because I don't use any of RSA's software toolkits.

I use Microsoft CryptoAPI, GPG, GnuTLS, and OpenSSL, php-Mcrypt/php-Mhash, and some dedicated non-RSA special purpose libraries, for all my cryptography requirements.

Re:No point pussy-footing around (0)

Anonymous Coward | about a year ago | (#44914069)

Yeah, if you're running on Windows, you have no need to worry about RSA backdoors.

Re:No point pussy-footing around (-1)

Anonymous Coward | about a year ago | (#44914269)

Yeah, if you're running on Windows, you have no need to worry about RSA backdoors.

son thanks vry muchhttp://www.carloseduardogutierrezvillegas.com/

Re:No point pussy-footing around (0)

Anonymous Coward | about a year ago | (#44914831)

There is a difference between "you have no need to worry" and "that worry is the least of your concerns."

Re:No point pussy-footing around (0)

Anonymous Coward | about a year ago | (#44915545)

I use Microsoft CryptoAPI...

And you feel perfectly secure... Alrighty then.

Re:No point pussy-footing around (1, Redundant)

chill (34294) | about a year ago | (#44913923)

Putting it bluntly, you can't.

Here's the problem. Dual_EC_DRGB is flawed, but is *required* to be implemented as part of anything that claims FIPS 140-2 compliance. Anything cryptographic you sell to the government is *required* to be FIPS 140-2 compliant, and operated in FIPS 140-2 compliant mode.

This includes just about all routers, switches, firewalls, operating systems and any other network or security gear in use by the U.S. gov't. Companies that supply this equipment include Cisco, HP, Dell, IBM, Juniper, EMC/RSA, Red Hat and others. In short -- everyone.

Granted, Dual_EC_DRGB is only one of four RNGs in the NIST suite, there is no way a user can specify *which* of those RNGs are actually used. Unlike setting cryptographic algorithms for SSL/TLS, there isn't any frontend for RNGs. They're implemented by the vendors. They're enabled in the products by a simple checkbox setting a registry entry (Windows), a kernel boot parameter (Red Hat) or config setting (most network infrastructure equipment).

Which is your vendor using? Who knows. But if we take the Snowden leaks seriously, the NSA has pressured many major companies to insert "weaknesses" or "backdoors" in various crypto-enabled gear.

Most people are thinking along the lines of "look for malicious code, odd errors or the like". But in the world of crypto, if the RNG isn't R, the entire thing collapsed like a house of cards. All tPutting it bluntly, you can't.

Here's the problem. Dual_EC_DRGB is flawed, but is *required* to be implemented as part of anything that claims FIPS 140-2 compliance. Anything cryptographic you sell to the government is *required* to be FIPS 140-2 compliant, and operated in FIPS 140-2 compliant mode.

This includes just about all routers, switches, firewalls, operating systems and any other network or security gear in use by the U.S. gov't. Companies that supply this equipment include Cisco, HP, Dell, IBM, Juniper, EMC/RSA, Red Hat and others. In short -- everyone.

Granted, Dual_EC_DRGB is only one of four RNGs in the NIST suite, there is no way a user can specify *which* of those RNGs are actually used. Unlike setting cryptographic algorithms for SSL/TLS, there isn't any frontend for RNGs. They're implemented by the vendors. They're enabled in the products by a simple checkbox setting a registry entry (Windows), a kernel boot parameter (Red Hat) or config setting (most network infrastructure equipment).

Which is your vendor using? Who knows. But if we take the Snowden leaks seriously, the NSA has pressured many major companies to insert "weaknesses" or "backdoors" in various crypto-enabled gear.

Most people are thinking along the lines of "look for malicious code, odd errors or the like". But in the world of crypto, if the RNG isn't R, the entire thing collapsed like a house of cards. All the NSA has to do is have essentially a single obfuscated line of code in the RNG. Something along the lines of "if Backdoor then RNG=Dual_EC_DRGB". Hell, in assembly it could probably be a simple JNE instruction.he NSA has to do is have essentially a single obfuscated line of code in the RNG. Something along the lines of "if Backdoor then RNG=Dual_EC_DRGB". Hell, in assembly it could probably be a simple JNE instruction.

The answer is don't use FIPS 140-2 mode, but if you're dealing with the government -- and a huge number Putting it bluntly, you can't.

Here's the problem. Dual_EC_DRGB is flawed, but is *required* to be implemented as part of anything that claims FIPS 140-2 compliance. Anything cryptographic you sell to the government is *required* to be FIPS 140-2 compliant, and operated in FIPS 140-2 compliant mode.

This includes just about all routers, switches, firewalls, operating systems and any other network or security gear in use by the U.S. gov't. Companies that supply this equipment include Cisco, HP, Dell, IBM, Juniper, EMC/RSA, Red Hat and others. In short -- everyone.

Granted, Dual_EC_DRGB is only one of four RNGs in the NIST suite, there is no way a user can specify *which* of those RNGs are actually used. Unlike setting cryptographic algorithms for SSL/TLS, there isn't any frontend for RNGs. They're implemented by the vendors.

Which is your vendor using? Who knows. But if we take the Snowden leaks seriously, the NSA has pressured many major companies to insert "weaknesses" or "backdoors" in various crypto-enabled gear.

Most people are thinking along the lines of "look for malicious code, odd errors or the like". But in the world of crypto, if the RNG isn't R, the entire thing collapsed like a house of cards. All the NSA has to do is have essentially a single obfuscated line of code in the RNG. Something along the lines of "if Backdoor then RNG=Dual_EC_DRGB". Hell, in assembly it could probably be a simple JNE instruction.of companies do -- you have no choice.

Even if you turn don't turn it on,if your equipment is something that the vendor WANTS to sell to the gov't then Dual_EC_DRGB is implemented in there whether you want it or not. How can you ensure there is no "if Backdoor then RNG=Dual_EC_DRGB" in there?

Before answering, please go visit the Obfuscated C Code Contest webpage and browse around.

Okay, it *IS* possible to ensure it with 100% open source code you compile yourself(1) that has been publicly vetted by people who have expertiese in this area. One suggestion is NaCL [cace-project.eu] .

Good luck, and may the source be with you.

(1) -- If the people who are going to cite Ken Thompson's Reflections on Trusting Trust can keep themselves confined to one subthread, I would appreciate it.

Re:No point pussy-footing around (2)

bill_mcgonigle (4333) | about a year ago | (#44913929)

what should it be replaced with?

To be trustable it has to be open source, but to be trustworthy will require both code scrutiny and careful analysis.

New maxim: you can't keep secrets with secrets.

Re:No point pussy-footing around (1)

Lumpy (12016) | about a year ago | (#44914065)

Screw that. Simple 1 time pad will do the trick. Uncrackable by even the best crypto minds on the planet.

Re:No point pussy-footing around (1)

interval1066 (668936) | about a year ago | (#44914137)

Yeah. Good luck with making that a standard. No one wants a standard that has to be re-standardized everytime its used. The obvious answer is using cryptographic methods that are not part of anything to do with RSA. And let the standard play ketchup. I don't give a fuck if its not compliant, I want it to be secure.

Re:No point pussy-footing around (0)

Anonymous Coward | about a year ago | (#44914719)

Tell that to an auditor who is examining one's business for due diligence with security issues. There is a good chance a company going cowboy and writing their own standards may get their license pulled, or if they are publically traded, may face heavy fines for Sarbanes Oxley violations.

Re:No point pussy-footing around (1)

Bert64 (520050) | about a year ago | (#44916901)

Well, using a known flawed system is also going to make you in violation of sarbanes-oxley...

So what do you do?

Re:No point pussy-footing around (1)

0123456 (636235) | about a year ago | (#44914143)

Screw that. Simple 1 time pad will do the trick. Uncrackable by even the best crypto minds on the planet.

Not if you use an insecure random number generator (i.e. pretty much anything that's pure software with no hardware component) to generate the pad.

Re:No point pussy-footing around (1)

Lumpy (12016) | about a year ago | (#44914219)

5, 10 sided dice are kind of hard for the NSA to "tamper with".

Re:No point pussy-footing around (1)

Anonymous Coward | about a year ago | (#44914339)

I would think that dice qualify as a "hardware component".

Re:No point pussy-footing around (1)

chihowa (366380) | about a year ago | (#44914869)

Unless they're perfect dice (and they certainly won't be after generating gigabytes of material), there may still be a bias [springer.com] in the pad you generate with them.

Re:No point pussy-footing around (1)

Desler (1608317) | about a year ago | (#44914239)

Uncrackable by even the best crypto minds on the planet.

Only theoretically [wikipedia.org] . There are plenty of issues with using one-time pads that can make them suspectible to be cracked.

Re:No point pussy-footing around (1)

flyingfsck (986395) | about a year ago | (#44915723)

One time pads are useless.

Re:No point pussy-footing around (1)

chill (34294) | about a year ago | (#44917149)

One of the major reason public key crypto was invented is the difficulty associated with securely distributing symmetric crypto keys.

A one-time pad is essentially a massive symmetric crypto key, so you're back to square one. And good luck distributing a copy of your one-time pad to everywhere you do e-commerce with, like your bank, Amazon.com and the like.

Re:No point pussy-footing around (0)

Bite The Pillow (3087109) | about a year ago | (#44913959)

No. The entire purpose of RSA is providing security. And plenty of their products do not use this PRNG. If they allow themselves to be tainted, their entire business goes poof and lawsuits ensue.

Go read up a little more and see if you still think the same thing. I won't even provide links - if you trust CNN, google "RSA Dual_EC_DRNG site:cnn.com" - or choose your own news source. Ars Technica, Fox News, I don't care where. Just go read, and then come back.

The reason they chose this method is that elliptical curve was in vogue at the time, and hash-based cryptography was coming under attack, like MD5. Especially, this method is a lot slower. Slower to make hopefully meant slower to break.

This is all on the record, and makes a lot more sense than RSA intentionally breaking security. I have not been convinced, and you're going to have to refute the hash-based attacks, EC being popular, the speed advantage, and the timing of the decisions in order to refute RSA's defense.

And it is actively telling people not to use it. Sure blame that one on ass-covering. If they were forced, this would be a half-assed attempt, or they would continue to defend it as "not entirely broken" or "no known attacks".

You're jaded, we get that. But you can't leap to conclusions that otherwise don't make sense just because you are jaded. You have to have something to fall back on.

Re:No point pussy-footing around (0)

Anonymous Coward | about a year ago | (#44914399)

"Especially, this method is a lot slower. Slower to make hopefully meant slower to break."

Nothing in cryptography is ever done "hopefully" (except for crap like using PBKDF for password storage), and just because ECC was hot doesn't mean it was hot for PRNGs. Dual_EC_DRNG is slower because it's a stupid algorithm. You can make PRNGs from RSA or Diffie-Hellman, too, but nobody uses those. And while they're secure and slow, there are lots of slow PRNGs which are completely insecure. Finally, to quote another Anonymous poster, exponents make security, not multipliers (which is why PBKDF is stupid for basic password hashing, as opposed to key material generation).

No matter how you spin it, RSA was idiotic for making this the default algorithm. There are only two reasonable explanations: either RSA is careless, or RSA was tapped by the NSA.

Re:No point pussy-footing around (2)

lennier (44736) | about a year ago | (#44914475)

No. The entire purpose of RSA is providing the illusion of security.

Fixed. The problem with security is that you can't actually sell it; the customer has no way to tell if they are really secure, or just feeling secure. But the customer can certainly tell if they feel secure. So all security vendors tend to major on the warm fuzzy feelings. That means a lot of "trust us, we're the experts" and "you don't need to know the details, put your mind at ease" and not a lot of "here is the exact proof that you are secure, including every line of our source code and every mask in our circuitry, run the analysis yourself".

The other problem is that despite the free-market view that "they wouldn't be in business if they were faulty", proprietary security vendors actually have an extremely strong perverse incentive: the stronger the illusion of security, and the more powerful and secretive the clients, the more gain there is in working with an intelligence organisation to subvert that security. And since, when the clients are nation-states and militaries, working with intelligence agencies may be a requirement for getting the sales contract... and refusing to work with those agencies may result in treason charges and jail time... well, you don't need a doctorate in either cryptoanalysis or economics to see where those incentives might lead.

It's the classic confidence-trickster problem. You have a secret. You want to keep your secret. To keep your secret and come out ahead of the game you have to deal with someone who has bigger secrets, a bigger bankroll, and is smiling a lot. You sit down at the table, and look around. Do you see who the mark is? Even if you think you do, there's no guarantee that you're not all marks for the house.

And it is actively telling people not to use it.

Sure, now RSA are, now that the beans have been spilled by Edward Snowden and the NIST themselves are reopening the standard for discussion. If they didn't say anything it would look even more suspicious and whatever tattered remnants of trust they had would be gone.

Unfortunately the illusion's pretty much torn at this point. By the way, how are Crypto AG [spray.se] doing [meta-religion.com] ?

Re:No point pussy-footing around (0)

Anonymous Coward | about a year ago | (#44914789)

The RSA SecurID source code loss fiasco a few years back (IIRC) didn't affect them in the slightest. What this shows is that a device that has been breached can be possibly sold with many buyers regardless of security issues.

I could make a device that could use $RANDOM for a RNG and sell one time pads, and likely make tons of money, especially if I'm coy about how things are done and hit anyone snooping on the algorithm on the head with numerous DMCA takedowns. Would I? I like sleeping at night, but I've seen it done. Devices that say they use 4096 bit RSA keys, but use sixty-four 64-bit keys (yep, 64 bits are quite easy to break, so in reality, you are getting a 72 bit key, not a 4096 bit key.) When exposed, nobody stopped buying the problem, nor did they file a lawsuit, because the program still worked, and encrypted text still looks jumbled up.

Re:No point pussy-footing around (2)

Pinky's Brain (1158667) | about a year ago | (#44914843)

I see some RSA shills repeating this argument ... but I don't see any explanation why they used it as the default after 2006. We really have no greater proof it's backdoor'd now than we had then ... if we didn't have the 2006 analysis of Dual_EC_DRNG then Snowden's leak could be referring to a whole lot of things.

All that has happened is that the legal threshold of plausible deniability has disappeared ... but the common sense threshold for plausible deniability disappeared in 2006, they knew and they kept it default. Why?

Re:No point pussy-footing around (0)

Anonymous Coward | about a year ago | (#44914019)

It's obvious that RSA was either forced or "rewarded" into using an insecure method. And that they knew it at the time (because they are cryptographers and because they don't live in the bottom of a well.)

Interesting claim, but where is the proof that it is insecure? The most informed commentary that I've seen only says that it might be possible that it is, not that there is actual proof that it is insecure.

Re:No point pussy-footing around (1)

Pinky's Brain (1158667) | about a year ago | (#44914871)

There is no proof outside of mathematics, but it makes no more sense to doubt it than to doubt the sun will come up in the morning.

Re:No point pussy-footing around (1)

Anonymous Coward | about a year ago | (#44914033)

Actually this is not true, and it is obvious you have never done any crypto work yourself, having taken graduate level courses on the topic, I can tell you that 1) it is hard to prove that an encryption system (b/c thats what PRNG is at the core) is 'slightly' insecure, Proving glaring obvious faults is easy. 2) not every crypto secret is publicly known, look at DES and EC attacks

Take AES for example, its the standard that pretty much everything uses for symmetric enrcryption, but it is NOT a feistel cipher, and 'could' in the future have an algebraic solution to it (allowing trivial decryption), but we don't know (publicly) if that is even going to be possible in the future.

Hell, look at DES, its s:boxs were secure to EC attacks 20+ years before they were publicly known to even exist, b/c the NSA (back when it actually tried to keep encryption secure) and AT&T discovered the system of attacks, and kept the even existence of EC attacks secret, while at the same time picking sboxs for DES that were secure against the EC attacks.

Re:No point pussy-footing around (1)

Carlos Dias (2869641) | about a year ago | (#44914089)

Well if they were forced as you stated, it means they did have no option. In that case you should not blame them for a faulty product.

Re:No point pussy-footing around (1)

flyingfsck (986395) | about a year ago | (#44915749)

No, I still blame them. They should have shut down their shop and moved overseas to a better location. Instead, they chose to defraud all their customers by selling snake oil for millions of dollars. The RSA company is a bunch of immoral fraudsters and they all deserve to be thrown in jail.

Re:No point pussy-footing around (2)

gweihir (88907) | about a year ago | (#44914199)

Don't forget that this default also selected the slowest generator and the one with the worst security analysis. There is no way this was an engineering decision. In fact I would not be surprised if some people working on the library resigned right at the time this decision was made...

RSA is poor quality, as VMware learned (2)

angryargus (559948) | about a year ago | (#44914649)

There's the proverb about not attributing to maliciousness that which can be explained by stupidity.

VMware (also an EMC subsidiary) used an RSA implementation for their SSO product. It had a ton of problems and bugs, and each new patch release introduced more bugs. Applying pressure to RSA via EMC didn't help, so VMware ripped out the RSA implementation with a band new in-house implementation.

Re:RSA is poor quality, as VMware learned (0)

Anonymous Coward | about a year ago | (#44914673)

regarding sso why do companies constantly reinvent Kerberos in a more buggy less interoperable proprietary way ?

Re:No point pussy-footing around (0)

Anonymous Coward | about a year ago | (#44916353)

There's no pussy-footing around this.

You post unsubstantiated allegations, backed by no evidence whatsoever, of collusion. You make a statement about the company which is equally unsubstantiated (RSA has very few cryptographers left: it's crypto product line is tiny compared to the remainder of the company).

You accuse RSA of corruption. Then you spread FUD about the company's products.

Here's an allegation: you're a fucking moron. Go make another tin-foil hat, but make sure it has a pointy end so when you shove your head up your ass where it belongs, it goes in easier.

What a dimwit.

It puts EMC in an awkward position (0)

Anonymous Coward | about a year ago | (#44913847)

The problems with that random number generator were known from the start. It put EMC (RSA parent company) in an awkward position because the mistake was either stupid or deliberate. The management might not even know the answer because the NSA plants spies directly within companies to sabotage their products without management approval.

What does this say about other EMC products?

My advise on this is to never pretend to be stupider than you are. If it was deliberate, then it's better to own up and admit it was deliberate and promise to remove any other NSA backdoors. If it was stupid, then admit it and hire external auditors to help you find the other NSA backdoors.

Re:It puts EMC in an awkward position (2)

gweihir (88907) | about a year ago | (#44914247)

"stupid" is not in the picture. Making the slowest generator, and the one with doubtful security at the same time, the default is not stupid, it has to be deliberate. Now if the NSA people were any good at their business, they would have made sure that their compromised generator was the fastest, so as to give a plausible reason for making it the default. They failed event at this simple Deception-101 idea.

The more I hear, the more I think the NSA is a ham-handed, incompetent, slow and stupid bureaucracy that survives on sheer power to coerce others to do its bidding and on brute-forcing everything by spending incredible amounts of money.

Re:It puts EMC in an awkward position (2)

AHuxley (892839) | about a year ago | (#44914463)

Recall the NSA funding and internal standing in the US gov structure in the 1990's?
They had to deliver plain text 24/7 or face even less funding or other groups would have offered language contractors and bulk clearances.
The only trick was keeping the citation needed over generation.

In Soviet USA (0)

Anonymous Coward | about a year ago | (#44913893)

Old expats from communist Russia love their new country.
Soviet USA, Soviet USA We love Soviet USA

The other half of the backdoor (1)

l2718 (514756) | about a year ago | (#44914189)

When it was discovered in 2007 that the NSA insisted on adding this PRNG to the standard, with constants they chose the general reaction was "so what? after all, this is one of many alternatives, and it is the slowest and least efficient". I assumed their idea was to somehow choose the PRNG in applications where they were one of the parties, but that seemed unlikely.

It's now clear what the idea was: secretly having companies use this PRNG. The original assumption was that companies voluntarily choose what products to put out, and that no-one would choose the obviously worst alternative. But if the NSA chould be the ones choosing ...

horrible headline (0)

Anonymous Coward | about a year ago | (#44915053)

The headline is horribly misleading. If you read the RSA communications, it's recommendations to use non-default PRNG where the default is now suspect. It's not about abandoning their own products.

Snarkly headline is off base (0)

Anonymous Coward | about a year ago | (#44915347)

"It's time to upgrade from our old stuff, which is buggy and slow." Microsoft does marketing like that all the time.

Stupid defaults only allowed in open source (0)

radarskiy (2874255) | about a year ago | (#44915413)

Shipping with config values that are dangerous if you start open source program before edits: the stupid user gets what they deserve!
Shipping with config values that are dangerous if you start closed source program before edits: OMG they're in league with $BAD_GUY.

Holy Shit, This is Stupid (0)

Anonymous Coward | about a year ago | (#44915431)

Do you want to know why PRNG is the default standard in RSA's encryption product? Because US DOD and related companies that sell to and do business with DOD mandate following the encryption standards set by NIST, which is PRNG. I'd have to guess that the companies providing RSA with 90% of their revenue for this product are in that space and thus by making it the default they are serving their market. Meanwhile, blaming RSA for it being the default is as stupid as blaming other software vendors when the Sys Admins don't change the DEFAULT administrator password from 'admin'.

What's a cryptographer to do? (1)

Waikido (3125897) | about a year ago | (#44916299)

In the article linked to on ArsTechnica a cryptographer wishes to remain anonymous, though his comment is perfectly reasonable and very safe:

"I personally believed that it was some theoretical cryptographer's pet project," one cryptographer who asked not to be named told Ars.

He (or she) is not accusing anyone or suggesting anything. Why the desire to remain anonymous? I bet that many people active in cryptography even in academic circles are afraid. Indeed, chances are that active researchers are being monitored. You know, just in case.

OpenBSD entropy (4, Informative)

funkboy (71672) | about a year ago | (#44916697)

Yet another reason that validates OpenBSD developers having spent years improving the quality of random number generation [openbsd.org] .

Say what you want about Theo, but their developers are top-notch and their stuff really works.

Re:OpenBSD entropy (0)

Anonymous Coward | about a year ago | (#44917131)

It also uses Apache 1.3.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>