New Vista Random Numbers to Include NSA Backdoor? 269
Schneier is reporting that Microsoft has added the new Dual_EC-DRBG random-number generator to Vista SP1. This random-number generator is the same one discussed earlier that may have a secret NSA backdoor built into it.
Re:Given the known problems of Dual_EC_DRBG (Score:5, Informative)
Insane - I know, they must be "out to get us".
Re:Given the known problems of Dual_EC_DRBG (Score:3, Informative)
Re:Really... (Score:5, Informative)
You can do what TFA said:
"It's possible to implement Dual_EC_DRBG in such a way as to protect it against this backdoor, by generating new constants with another secure random-number generator and then publishing the seed. This method is even in the NIST document, in Appendix A."
Re:Really... (Score:3, Informative)
This is not Trivial... (Score:3, Informative)
|Cryptanalytic Attacks on Pseudorandom Number Generators
J. Kelsey, B. Schneier, D. Wagner, and C. Hall
Fast Software Encryption, Fifth International Workshop Proceedings (March 1998), Springer-Verlag, 1998, pp. 168-188.
ABSTRACT: In this paper we discuss PRNGs: the mechanisms used by real-world secure systems to generate cryptographic keys, initialization vectors, "random" nonces, and other values assumed to be random. We argue that PRNGs are their own unique type of cryptographic primitive, and should be analyzed as such. We propose a model for PRNGs, discuss possible attacks against this model, and demonstrate the applicability of this model (and our attacks) to four real-world PRNGs. We close with a discussion of lessons learned about PRNG design and use, and a few open questions. | http://www.schneier.com/paper-prngs.html [schneier.com]
If you have been keeping up with computer security, everyone should be aware of the weakness of Random Number generators and it's vast effects over large sections of the computer world. This is not trivial...
Re:Fuck You AmeriKKKa! (Score:2, Informative)
Hmmm.....America invented the:
Internet.....check
Computer.....check...holy crap...modern computing actually has it's roots in TEXAS of all places (see the integrated circuit)...so DOUBLE check
Motor Car....check again...lol - who would have thought, surely SOMETHING on this list was not invented by America
Light Bulb....check again, wow
Telephone.....and....wait for it.......check
Re:Fuck You AmeriKKKa! (Score:3, Informative)
An automobile powered by an Otto gasoline engine was built in Mannheim, Germany by Karl Benz in 1885 and granted a patent in January of the following year under the auspices of his major company, Benz & Cie. which was founded in 1883.
Although several other German engineers (including Gottlieb Daimler, Wilhelm Maybach, and Siegfried Marcus) were working on the problem at about the same time, Karl Benz is generally acknowledged as the inventor of the modern automobile.[5] In 1879 Benz was granted a patent for his first engine, designed in 1878. Many of his other inventions made the use of the internal combustion engine feasible for powering a vehicle and in 1896, Benz designed and patented the first internal combustion flat engine.
Approximately 25 Benz vehicles were built and sold before 1893, when his first four-wheeler was introduced. They were powered with four-stroke engines of his own design. Emile Roger of France, already producing Benz engines under license, now added the Benz automobile to his line of products. Because France was more open to the early automobiles, more were built and sold in France through Roger than Benz sold in Germany.
Daimler and Maybach founded Daimler Motoren Gesellschaft (Daimler Motor Company, DMG) in Cannstatt in 1890 and under the brand name, Daimler, sold their first automobile in 1892. By 1895 about 30 vehicles had been built by Daimler and Maybach, either at the Daimler works or in the Hotel Hermann, where they set up shop after falling out with their backers. Benz and Daimler seem to have been unaware of each other's early work and worked independently.
Daimler died in 1900 and later that year, Maybach designed a model named Daimler-Mercedes, special-ordered by Emil Jellinek. Two years later, a new model DMG automobile was produced and named Mercedes after the engine. Maybach quit DMG shortly thereafter and opened a business of his own. Rights to the Daimler brand name were sold to other manufacturers.
Karl Benz proposed co-operation between DMG and Benz & Cie. when economic conditions began to deteriorate in Germany following the First World War, but the directors of DMG refused to consider it initially. Negotiations between the two companies resumed several years later and in 1924 they signed an Agreement of Mutual Interest valid until the year 2000. Both enterprises standardized design, production, purchasing, sales, and advertising--marketing their automobile models jointly--although keeping their respective brands. On June 28, 1926, Benz & Cie. and DMG finally merged as the Daimler-Benz company, baptizing all of its automobiles Mercedes Benz honoring the most important model of the DMG automobiles, the Maybach design later referred to as the 1902 Mercedes-35hp, along with the Benz name. Karl Benz remained a member of the board of directors of Daimler-Benz until his death in 1929.
Re:"may have" (Score:4, Informative)
Re:Secret Back door code is pretty easy!! (Score:3, Informative)
But i think other konami games used it as well.
Re:Fuck You AmeriKKKa! (Score:4, Informative)
The first computer was a German invention (Konrad Zuse's Z3 in 1941).
The first automobile was a French invention (1881).
The light bulb had already been invented by several people, mostly European, before Edison perfected it.
Re:Fuck You AmeriKKKa! (Score:5, Informative)
Bzzzt, wrong! Even though he is dead, his guy: http://en.wikipedia.org/wiki/Konrad_Zuse [wikipedia.org] would argue with that.
Wait another dead guy wants a chat - http://en.wikipedia.org/wiki/Karl_Benz [wikipedia.org] - says he invented the automobile.Um, better check your's again, I think its a bit dim if not burnt out. If you refer to Edison, he was not even close to the first to demonstrate what is now known as the incandescent light bulb. http://en.wikipedia.org/wiki/Lightbulb [wikipedia.org]
Well, 2 out of 5 ain't bad right? Well, the telephone is not a sure thing, so lets make it 1.5.
Re:Given the known problems of Dual_EC_DRBG (Score:3, Informative)
Re:Secret Back door code is pretty easy!! (Score:2, Informative)
(not a shill, just love thier stuff) http://www.pennyarcademerch.com/pat070051.html [pennyarcademerch.com]
and
http://en.wikipedia.org/wiki/Konami_Code [wikipedia.org]
Re:Fuck You AmeriKKKa! (Score:2, Informative)
Computer: Arguable, depends on your definition of what constitutes a computer. Take a look at the work of Konrad Zuse. Yes, the US invented the integrated circuit.
Motor Car: No, Benz, Daimler and others invented the car. However, an American, Ford, was the first with an affordable mass-produced car.
Light Bulb: Edison may not have invented the light bulb but he did significantly improve it and mass produced the first long-lived incandescent.
Telephone: Given that telephone is the name of a specific invention by Alexander Graham Bell, yeah, we did. Other inventors claimed to have transmitted sound over wires contemporaneously or nearly so. The courts stood by Bell's patent. Bell was a naturalized citizen of the US so we get to claim him.
Re:From the article (Score:1, Informative)
Seriously, it doesn't.
Re:Given the known problems of Dual_EC_DRBG (Score:3, Informative)
actually matches any binaries provided via Windows Update.
Let me guess... (Score:2, Informative)
4, 8, 15, 16, 23, & 42
Hmmm...
Re:Fuck You AmeriKKKa! (Score:1, Informative)
Well it is 1 out of 5 because Antonio Meucci, who originally developed his invention in Italy, was recognized as the inventor by Congress in 2002 under resolution 269:
http://en.wikipedia.org/wiki/Invention_of_the_telephone#Antonio_Meucci [wikipedia.org]
Re:"might know" (Score:3, Informative)
Whether the NSA have the second set of numbers or not is immaterial - the fact that they might have them is sufficient to make this implementation insecure.
Now with OSS, we can change the set of numbers used to one of our own choosing, and use the algorithm with a reasonable expectation of security.
With Vista? Sorry, mate, but there's no way to change the numbers.
Hope that explains why people are concerned about this.