Conversation

Replying to

and

This is the same way the Linux kernel adds entropy from untrusted sources. An attacker can overwrite this data so the standard might as well be calling these fields attacker_input and extended_attacker_input. I don't understand why they even have the original non-extended one.

Replying to

and

It only matters (negatively) for security if you happen to have a PRNG where a certain number of consecutive PRNG bytes *must* be placed on the wire for the backdoor to be effective. The only such PRNG is Dual EC. The only crypto library that useD DualEC by default is RSA BSAFE.

Replying to

and

There is exactly one library in the known universe that implemented both Dual EC and Extended Random. That’s RSA BSAFE.

Replying to

and

You might ask how a weird and unnecessary randomness extension got rejected by the IETF but still wound up included in one of the most important commercial crypto libraries of the 2000s, one that also uses Dual EC by default. Reuters had some thoughts. google.com/amp/s/mobile.r

Replying to

and

Is this proof? No. It’s just lots and lots of coincidences all leading to the same result in a very short span of time. 🤷‍♀️

Replying to

and

I don't understand is why they would take such a complicated approach focused on trying to backdoor cryptography primarily intended for use by the US government rather than others. No one in their right mind is using FIPS, etc. unless forced to do it for that.

Replying to

and

I thought it was farfetched too. And then I found out that *every* product that used RSA BSAFE, the most popular crypto library of that time period, had exploitable Dual EC enabled by default. I also found out that every Juniper NetScreen firewall sold after ‘08 did too.

Replying to

and

I'm just a lot more inclined to believe they're severely incompetent and ended up pushing sketchy cryptography primarily for usage by the US government and US government contractors while damaging the reputation of US companies and their own.

Replying to

and

Regardless of their motivation they damaged the reputation, economy and national security of the US while burning tons of money as usual. I'm pretty skeptical about their ability to keep something of this scale secret, at least if the people doing it understood the purpose of it.

Replying to

and

They didn’t keep it secret. A guy named Snowden leaked most of the details. All we’re doing is trying to tie up a few loose ends.

Replying to

and

Not saying that they haven't subverted cryptography but rather this seems overly elaborate along with it being openly tied to them from the start and primarily aimed at US government / contractor usage. I'm more inclined to believe they'd sneak a backdoor into OpenSSL than this.

2:46 AM · Feb 6, 2021Twitter Web App

Replying to

and

They did get a variant of this into OpenSSL. A USG contractor paid for it.

Replying to

and

Link:

A new Dual EC DRBG flaw

The dual elliptic curve deterministic random bit generator (Dual EC DRBG) cryptographic algorithm has a dubious history—it is believed to have been backdoored by the US National Security Agency...

Replying to

and

If she knew this was a backdoor and was willing to publicly tie her name to it this way, she was certainly willing to make some substantial sacrifices for her employer. I just don't believe that's how they approach something like this. They were pushing it for US government use.