New Vista Random Numbers to Include NSA Backdoor?

Schneier is reporting that Microsoft has added the new Dual_EC-DRBG random-number generator to Vista SP1. This random-number generator is the same one discussed earlier that may have a secret NSA backdoor built into it.

Really...

I guess it's not so secret then, is it?

Re:Really...

What you're essentially proposing is encrypting the same data twice, first with the questionable algorithm, then with another algorithm of your choice. If that's the case, you might as well just encrypt it with the second algorithm, hopefully more complicated than just shifting and adding. ;)

Re:Really...

"Wait... couldn't you just add something to the random number? Or perhaps shift the digits over?"

You can do what TFA said:

"It's possible to implement Dual_EC_DRBG in such a way as to protect it against this backdoor, by generating new constants with another secure random-number generator and then publishing the seed. This method is even in the NIST document, in Appendix A."

Secret Back door code is pretty easy!!

Maybe the NSA could have thought a little harder at entering a back door code. Secret sources have revealed the NSA back door code to be.

up, up, down, down, left, right, left, right, B, A

Re:"may have"

Well it *does* have a backdoor, the only question is does anyone have the constants? FTFA:

What Shumow and Ferguson showed is that these numbers have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can predict the output of the random-number generator after collecting just 32 bytes of its output.

Also FTFA:

The researchers don't know what the secret numbers are. But because of the way the algorithm works, the person who produced the constants might know; he had the mathematical opportunity to produce the constants and the secret numbers in tandem.

Section Tag

Wouldn't this go under "Your Rights Online"?

Re:Section Tag

Don't know about our rights online, but I gladly noticed that this was tagged quite appropriately

ahhjeezenotthisshitagain

It was not exactly a dupe, but clearly an "ahhjeezenotthisshitagain".

Conspiracy theorists come forth! Now it the time..

To regale us with the myriad ways in which government plots are about to unfold with this. But sincerely, this is ripe for negative speculation. There is no good reason for something of this nature. Sure, some will say it's for the kids and what about the terrorists being thwarted before they can act and all, but I still say this is BS. Closed source buffoonary if you ask me.

Re:Conspiracy theorists come forth! Now it the tim

I disagree.

This has absolutely nothing to do with open or closed source. A completely open source random number generator would have precisely the same vulnerability, because the problem isn't potential skulduggery by the vendor, it's potential skulduggery by the people who designed the standard.

What Microsoft has done is to implement a questionable standard. It makes no sense in this case to blame them for its shortcomings, especially since developers have alternative standards they can use.

Now when it comes to application software using a random number generator, then there actually is a closed/open source argument to be made. Do you know which random number generator is used by the software you use? With closed source, almost certainly not. With open source, programmers can undo the choice of the dodgy elliptic curve RNG and replace it with a more solid, equally standards compliance alternative. And get a speed boost too. You also know that you might not want to trust the source for your software if they use the inferior algorithm.

From the article

"It's not enabled by default, and my advice is to never enable it. Ever."

Re:From the article

It's not enabled by default ... until the next Automatic Update rolls around.

=Smidge=

Given the known problems of Dual_EC_DRBG

Given the known problems of Dual_EC_DRBG, which, from the Bruce Schneier article, include the fact that's slow, that it's got an obvious backdoor, and that it was inexplicably pushed for the NSA for seemingly no reason, why would Microsoft add it to Vista SP1?

Now adding the algorithm itself isn't really a backdoor per se, because no one is forcing you to use that particular random number generator. But it is also interesting to note that this isn't the first time Microsoft has been accused of inserting backdoors for the CIA or the NSA. Of course, Microsoft vehemently denies such allegations, but I would assume that they would. Given what the telcos did for the NSA, would anyone be surprised if it really did come out that the NSA actually forced Microsoft to put backdoors in Office or Windows?

Re:Given the known problems of Dual_EC_DRBG

I know this is crazy talk, but maybe there's a simple explanation. Microsoft put it in the OS as an option so that people who want to use it (hmm...government contracts?) can if they so choose. So maybe Microsoft sees the NSA as a "customer" and decided they were important enough to include it for their use and for other government use.

Insane - I know, they must be "out to get us".

Re:Given the known problems of Dual_EC_DRBG

Who even says that at an RNG has to be at the OS level? If NSA or its customers want to use Dual_EC_DRBG, there is nothing stopping them from doing so on Vista or any other OS.

As another poster said, where in the OS is this used? Do you know? Does anyone but Microsoft?

Re:Given the known problems of Dual_EC_DRBG

This random number generator is not used by default.

Prove it. Oh, that's right, you can't because you don't have the source code. Unless maybe you're astroturfing. Even then you'd be under an NDA anyhow.

Other governments are not going to be willing to buy a system with a NSA backdoor.

And other governments have replaced Windows with custom Linux distros due to the potential of this very problem. This is a fact that cannot be denied.

Re:Given the known problems of Dual_EC_DRBG

I don't have to prove it. Not only that, but you wouldn't believe me if even if the code was released - after all, how do you know that the code corresponds to the actual binary?

Look at the FIPS and CC documentation. Governments do use these systems in security critical environments, but they configure them very carefully. There is configuration data available on how to configure system for security critical environments. Selecting your random number generator is one of the things you can do.

The staff working on this are noted cryptographers who do know what they are doing. I have been working with the cryptographers at Microsoft for some time and I have been working in crypto related areas for > 20 years.

Re:Given the known problems of Dual_EC_DRBG

> As for backdoors, anybody who is paranoid about this issue will ignore or disbelieve me when I say that there is no backdoor that I am aware of.

I can believe that you don't know, but would they really tell you if there were such backdoors?

> Governments both in the US and elsewhere do this, which suggests that no backdoor is available.

If you had a backdoor which allows you to access remote computers anywhere would you
a) Tell everyone that you can do it
b) Use some dummy keyloggers and malware to suggests that you can't do it

Well...

I worry more about the 0-day backdoors in Vista than I do about the NSA backdoors.

n-th sensationalist headline of the day

Boy, this is getting tiring.

Concerned About Security...

You're concerned about security, and you're using WINDOWS VISTA???

it's true

i seeded the dual_EC-DRBG with the following ASCII strings the and got the following output in ASCII:

missionaccomplished -> LOL

waterboard -> buckshottotheface

osamabinladen -> loofahnotfalafel

iraq -> vietnam

No surprise here

No surprise, really. After all, Microsoft did this a long time ago (remember the whole "NSA KEY" fiasco?)

http://en.wikipedia.org/wiki/NSAKEY [wikipedia.org]

Is this "feature" back-ported to XP SP3, too?

Is this "feature" back-ported to XP SP3, too?
SP3 is supposed to have some of Vista's most useful features as well as all previous bug fixes.
Would a shame to ruin a good service pack that speeds up XP by 10%.

Correct me if I'm wrong but...

... can't they just include their own list of secret numbers in order for the generator to be semi-secure? The NSA has the numbers that generate the random numbers in the base code but even they say to make your own reference numbers if you are to use the code. So if Microsoft were to ultimately use the numbers the numbers would probably end up being both random and not known to anyone in the development team if they so wanted.

Why...

...does every article about Vista make me less likely to ever use it? Aren't things like this supposed to _improve_ with time?

More important question

The posted Microsoft website states:

The Dual Elliptical Curve (Dual EC) PRNG from SP 800-90 is also available for customers who prefer to use it.

How does Joe User know if he is using it or not? Is it a setting in the control panel? Why would anybody want to use it?

OK, this is just stupid.

So, let's review:

1. Government introduces a new cryptography standard (which it will presumably require for some applications) that requires that systems provide a choice of 4 random number generators, one of which MAY have a flaw.
2. Manufacturers implement the new standard.
3. Grand conspiracy!!!

Come on, could it just possibly be that Microsoft wants to be able to claim to be NIST 800-90 compliant for customers who want that kind of thing and that the NSA likes the idea of there being a variety of random number generators available? The only way that making this function available is a risk is the NSA also has control of the application and can force it to call this random number generator without properly seeding it. If they have that level of control, they have enough control to do whatever else they want in a much more direct way.

Trust Us, We're From the Government

What kind of commie doesn't just trust the NSA? I mean, we've got a FISA to protect us from the government and from corporations cooperating with rogue regimes [slashdot.org], right?

There is no truth to the existence of a back door

Just as it is untrue that the US used printers (small 68000 series computers) to disrupt the Iraqi networks and sniff traffic, and they are not diverting telephone cable Net traffic at the main connection sites in San Francisco and other locations.

And, I never was in the shack at Yakima, and we never listened to your long-distance phone calls and made fun of you going kissy-kissy with your wife overseas.

Really.

Pay no attention to the curtain, nothing is behind it. Really. And get that dog away from it!

tee hee

finally, Microsoft is taking it in the backdoor - about freaking time.

Could be a problem!

I hope the NSA thought to put a screen door on their backdoor, what with all the bees in the internet

there must be a ulterior motive

...because this one seems too obvious. So, perhaps the NSA crypto folks have a couple of found back doors in some of the other algorithms, and this is a bit of misdirection to keep people from noticing what they really intend to use... :)

Does anyone who uses Vista...

Have any expectation of privacy or security in the first place?

IIRC, some of the key SCOTUS decisions regarding the Fourth Amendment have centered around a person's expectation of privacy. They've argued:

• That someone doesn't have a reasonable expectation of privacy regarding their garbage.
• That email doesn't have a reasonable expectation of privacy...
• That a person's car is subject to Fourth Amendment protection.

That said, the government could persuasively argue that someone who runs Windows, especially Vista, has no expectation of privacy in the first place:

• More malware and trojans run on Windows than Mac and Linux combined. In fact, there are more viruses available for Windows than there are editors - even applications - for Linux.
• Microsoft has continued a trend of introducing software with gaping holes for that past 10 years. No OS vendor in the last decade has produced a less secure OS than Microsoft. Surely the user must be aware of this, and have accepted the risk.
• Users accept the Windows EULA, which, among other things, allows Microsoft to remotely check Windows for proper activation - so they already have given up their privacy to a corporation.

Now the sad thing is that this does come across as a troll, but sadly, it's true. And it needs to be addressed. For some reason, the /. crowd thinks it is acceptable that a majority of the population uses an OS which is horribly less secure than the ones we ourselves use (Linux, Macs, etc...). We're supposed to be the technical ones who have the solution to these problems, and yet, most /.ers just choose to blame the victim and whine about Microsoft being evil. Granted, we already know that.

Is it really acceptable that our collective rights are surrendered because a major corporation finds more profit in insufficient design and testing of its software? I realize that most of you loathe Windows, but unless we actually do something to fix the social barriers to the adoption of Linux, we can expect that, because Windows is so insecure, our government will be able to convince SCOTUS that a computer user has no "reasonable expectation of privacy".

It doesn't matter so much that this PRNG is insecure. A knowledgeable cryptographer isn't going to trust the OS for random numbers, anyway - unless it is in compliance with some standard to which their code must comply. What matters is that Vista is full of holes, and we're talking about a PRNG which no software of cryptographical consequence is going to use anyway.

Instead, we ought to worry that Windows itself is easily compromised by the government. That is the real problem. Why would you break the PRNG when you can rootkit even a fully patched Vista box with an email?.

This is not Trivial...

Supporting Information from Original Author:

|Cryptanalytic Attacks on Pseudorandom Number Generators

J. Kelsey, B. Schneier, D. Wagner, and C. Hall

Fast Software Encryption, Fifth International Workshop Proceedings (March 1998), Springer-Verlag, 1998, pp. 168-188.

ABSTRACT: In this paper we discuss PRNGs: the mechanisms used by real-world secure systems to generate cryptographic keys, initialization vectors, "random" nonces, and other values assumed to be random. We argue that PRNGs are their own unique type of cryptographic primitive, and should be analyzed as such. We propose a model for PRNGs, discuss possible attacks against this model, and demonstrate the applicability of this model (and our attacks) to four real-world PRNGs. We close with a discussion of lessons learned about PRNG design and use, and a few open questions. | http://www.schneier.com/paper-prngs.html [schneier.com]

If you have been keeping up with computer security, everyone should be aware of the weakness of Random Number generators and it's vast effects over large sections of the computer world. This is not trivial...

Worth Noting

The talk [cr.yp.to] referenced by Schneier in his essay [schneier.com] as being the one that publicly disclosed the backdoor was given by two Microsoft researchers. So all the "OMG micro$oft iz so stoopid" posts might be a bit .... misdirected.

So...

The obvious joke here is that its a lot of trouble to go after the 12 people still using Vista. Baddump-bump!

But seriously, this is a continuation of Microsoft's vendor-first, consumer-second approach.

Random fun in the old days of computing

This kind of reminds me of the old days of computing where random number generators simply cycled through a fixed series of values that would be repeated over and over each time you powered up the computer. One fun exploit of these early random number generators was to place two identical computers on the same circuit, then flip the switch causing both machines to boot simultaneously. Assuming the factors were reasonably identical, you could simultaneously launch any program that used random numbers and use one computer to predict the results of the other with 100% accuracy.

For example, using this technique on a pair of Apple IIs (same series/configuration), you could load up a stock trading game on both machines and play one machine normally to see which companies were going to increase/decrease in value, then pour all the funds into the companies on the first computer that increased into those same companies on the second computer.

Near as I can tell, the random number generator (at least on the Apple II) would only change state when a new value was requested from it... otherwise it simply sat idly by waiting for the next request.

If true...

If true, do you really think Microsoft would 'want' to do this? They have been pretty strong privacy advocates, especially Gates, denying even backdoor access for Bitlocker in a fight several years ago when bitlocker was demonstrated to the FBI.

If the government is FORCING MS to do this, then we should be calling our representatives and not sitting around speculating or smacking on Microsoft.

The whole big brother NSA thing is very much a Republican/Bush/Neo-con era mechanism, and Gates and lots of others at Microsoft vote democrat, even when it was NOT in their best interest as during the DOJ trials of the 90s.

(Look up contributions, MS by far gives to Democratic canidates, and ironically companies that we think are on the side of the little people are ones shoving money toward pro-corporate/authoritarian canidates.)

Let me guess...

The constants were:

4, 8, 15, 16, 23, & 42

Hmmm...

why not upgrade to vista

another reason why no one should upgrade to vista...please just put it out of its misery already.
Bring out behind the shed and shoot it, let the penguin get caught holding the gun!

Obligatory quote

Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin.

John Von Neumann, 1951

Clever!

I see what you did there. You implied that anyone who criticizes the US or Vista is a paranoid loony. Now why would you do that? Do you just assume that people will criticize the US? Is the US that worthy of criticism that you have to defend it preemptively? I know that's a popular tactic these days, but is it entirely necessary? Nice how you posted AC, too. You sir are an all-around class act.

Re:Much Ado About Nothing

Agreed. The only interesting thing about this whole story is that the NSA apparently reviewed the PRNG function and rubber-stamped it, missing the critical vulnerability. Since the vulnerability really isn't that good of a backdoor, and doesn't seem to have been all that subtle, I think this is far more likely to be incompetence rather than malice on their part.

As an American, that doesn't make me feel a whole lot better -- in some ways, I'd really like to have the secret agencies of so many spy movies rather than the massive bureaucratic pile that I know exists in reality -- but disappointment in government is something I've gotten used to. You don't last long in Washington without it.

Re:Fuck You AmeriKKKa!

I'm 24 years old. I don't want to go through the next 50 years of my life living in an international air of worry and uncertainty. I don't want to live in a permanent state of fear, generated by a megalomaniacal American government taking advantage of the majority low IQ populous' capacity for being brainwashed.

Can I suggest you up your meds? Your current dosage isn't doing its job.

Re:Conpiracy theorists....

Yet one more reason I am glad I still use Xp and not the malware that is MS/NSA Vista Now, it begs to question, will SP3 for Xp have this same new random number generator with backdoor?

Re:Fuck You AmeriKKKa!

I'm with ya... America sucks... and i'm American. Sigh.

We're doomed.

Re:funny

i can't see how i got a troll for that - i was posting that with the unnoted refrence to my sig... i mean this "back door" isnt' even confirmed - it is jsut someones idea that it "might" exist.. without proof though you don't know - so MS is using it - sure give them bad press if it is "known to have" a "back door" but really without proof what do you have other than random people trolling about nothing..

come to think about it my comment isn't any better than the rest of the people's here.. feel free to read my sig and troll away..

Re:Fuck You AmeriKKKa!

"Children so stupid they think America invented the Internet, computer, motor car, light bulb, telephone etc ad infinitum...."

Hmmm.....America invented the:

Internet.....check
Computer.....check...holy crap...modern computing actually has it's roots in TEXAS of all places (see the integrated circuit)...so DOUBLE check
Motor Car....check again...lol - who would have thought, surely SOMETHING on this list was not invented by America
Light Bulb....check again, wow
Telephone.....and....wait for it.......check

Re:Fuck You AmeriKKKa!

Telephone was the culmination of the work of several people, and so the nationality of the inventor is in dispute. Bell did most of his work on the telephone in Canada.

The first computer was a German invention (Konrad Zuse's Z3 in 1941).

The first automobile was a French invention (1881).

The light bulb had already been invented by several people, mostly European, before Edison perfected it.

Re:Fuck You AmeriKKKa!

Computer.....check...holy crap...modern computing actually has it's roots in TEXAS of all places (see the integrated circuit)...so DOUBLE check

Bzzzt, wrong! Even though he is dead, his guy: http://en.wikipedia.org/wiki/Konrad_Zuse [wikipedia.org] would argue with that.

Motor Car....check again...lol - who would have thought, surely SOMETHING on this list was not invented by America

Wait another dead guy wants a chat - http://en.wikipedia.org/wiki/Karl_Benz [wikipedia.org] - says he invented the automobile.

Light Bulb....check again, wow

Um, better check your's again, I think its a bit dim if not burnt out. If you refer to Edison, he was not even close to the first to demonstrate what is now known as the incandescent light bulb. http://en.wikipedia.org/wiki/Lightbulb [wikipedia.org]

Well, 2 out of 5 ain't bad right? Well, the telephone is not a sure thing, so lets make it 1.5.

Re:Article summary follows

"Don't worry, our Chinese contractors assure us there are no NSA backdoors"

Re:Not against MSFT but the design

Read the details, Tom. The AES CTR_DRBG from SP 800-90 is the default PRNG and the ECDRBG is an optional PRNG that can be configured by the user or selected by the calling application.

So why does MS have both if you "know" they only added it for "blind compliance" with the spec?