New Vista Random Numbers to Include NSA Backdoor?

Schneier is reporting that Microsoft has added the new Dual_EC-DRBG random-number generator to Vista SP1. This random-number generator is the same one discussed earlier that may have a secret NSA backdoor built into it.

Really...

[2names]

I guess it's not so secret then, is it?

Secret Back door code is pretty easy!!

[spineboy]

Maybe the NSA could have thought a little harder at entering a back door code. Secret sources have revealed the NSA back door code to be.

up, up, down, down, left, right, left, right, B, A

Re:

[cromar]

Just be careful to use the L & R buttons when engaging the mega-powerup. If you use the normal left and right thrust controls, the spaceship will explode.

Re:

[r_jensen11]

Soo, the NSA has unlimited lives?

Re:

[aesiamun]

Contra on NES.

But i think other konami games used it as well.

Re:

[krack]

It is the Konami Code, made famous by its use in Contra. It was used in many other games and has since passed into gamer lore.

(not a shill, just love thier stuff) http://www.pennyarcademerch.com/pat070051.html [pennyarcademerch.com]
and
http://en.wikipedia.org/wiki/Konami_Code [wikipedia.org]

Re:Really...

[Applekid]

What you're essentially proposing is encrypting the same data twice, first with the questionable algorithm, then with another algorithm of your choice. If that's the case, you might as well just encrypt it with the second algorithm, hopefully more complicated than just shifting and adding. ;)

Re:Really...

[yo_tuco]

"Wait... couldn't you just add something to the random number? Or perhaps shift the digits over?"

You can do what TFA said:

"It's possible to implement Dual_EC_DRBG in such a way as to protect it against this backdoor, by generating new constants with another secure random-number generator and then publishing the seed. This method is even in the NIST document, in Appendix A."

Re:

[hax0r_this]

What is the point of plugging the output of a secure random generator into a non-secure one? Why not just use the secure one?

Re:

[caluml]

The secure one goes up to 11 (3).

Re:

[The Ultimate Fartkno]

Datamining? I thought it was just another of those stupid online games that encourages you to spam everywhere.

Re:

[Feyr]

it's an OS for women, they dont need nor want performances, unless it's a hamlet play

Re:"may have"

[civilizedINTENSITY]

Well it *does* have a backdoor, the only question is does anyone have the constants? FTFA:

What Shumow and Ferguson showed is that these numbers have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can predict the output of the random-number generator after collecting just 32 bytes of its output.

Also FTFA:

The researchers don't know what the secret numbers are. But because of the way the algorithm works, the person who produced the constants might know; he had the mathematical opportunity to produce the constants and the secret numbers in tandem.

Re:

[aproposofwhat]

No - it's not baseless and idle speculation, it's just good security practise not to knowingly use a method that has a documented insecurity.

Whether the NSA have the second set of numbers or not is immaterial - the fact that they might have them is sufficient to make this implementation insecure.

Now with OSS, we can change the set of numbers used to one of our own choosing, and use the algorithm with a reasonable expectation of security.

With Vista? Sorry, mate, but there's no way to change the numbers.

Hope

Re:

[gazbo]

Wait a minute...so the wife has to quit her job due to cock-based time constraints, and also the husband has to clean each and every cock.

Well surely that implies he'll not have time to work either? So who's going to earn money to feed them and pay the mortgage? I assume it's the African-Americans mentioned in the story - if so, why not mention this benevolence in the story - surely it's a mitigating factor? Frankly, I'm beginning to suspect the telling of this story has a racist bias.

Section Tag

[solar_blitz]

Wouldn't this go under "Your Rights Online"?

Re:

[backbyter]

What Rights Online?

Re:Section Tag

[naapo]

Don't know about our rights online, but I gladly noticed that this was tagged quite appropriately

ahhjeezenotthisshitagain

It was not exactly a dupe, but clearly an "ahhjeezenotthisshitagain".

From the article

[tieTYT]

"It's not enabled by default, and my advice is to never enable it. Ever."

Re:From the article

[Smidge204]

It's not enabled by default ... until the next Automatic Update rolls around.

=Smidge=

Re:

[Stray7Xi]

Windows update doesn't update that now, there will be an update to make windows update update this though.

Re:

[Daimanta]

That's what I think about Vista.

And if you really want to be secure, you can throw Windows on the same heap.

Given the known problems of Dual_EC_DRBG

[morgan_greywolf]

Given the known problems of Dual_EC_DRBG, which, from the Bruce Schneier article, include the fact that's slow, that it's got an obvious backdoor, and that it was inexplicably pushed for the NSA for seemingly no reason, why would Microsoft add it to Vista SP1?

Now adding the algorithm itself isn't really a backdoor per se, because no one is forcing you to use that particular random number generator. But it is also interesting to note that this isn't the first time Microsoft has been accused of inserting backdoors for the CIA or the NSA. Of course, Microsoft vehemently denies such allegations, but I would assume that they would. Given what the telcos did for the NSA, would anyone be surprised if it really did come out that the NSA actually forced Microsoft to put backdoors in Office or Windows?

Re:Given the known problems of Dual_EC_DRBG

[RightSaidFred99]

I know this is crazy talk, but maybe there's a simple explanation. Microsoft put it in the OS as an option so that people who want to use it (hmm...government contracts?) can if they so choose. So maybe Microsoft sees the NSA as a "customer" and decided they were important enough to include it for their use and for other government use.

Insane - I know, they must be "out to get us".

Re:Given the known problems of Dual_EC_DRBG

[morgan_greywolf]

Who even says that at an RNG has to be at the OS level? If NSA or its customers want to use Dual_EC_DRBG, there is nothing stopping them from doing so on Vista or any other OS.

As another poster said, where in the OS is this used? Do you know? Does anyone but Microsoft?

Re:

[adolf]

I could make the same argument about anything:

Who even says that a GUI has to be at the OS level? If the NSA or its customers want to use graphics, there is nothing stopping them from doing so on Linux or any other OS.

Or:

Who even says that a filesystem has to be at the OS level? If the NSA or its customers want to use files, there is nothing stopping them from doing so on *BSD or any other OS.

Or even:

Who even says that a TCP/IP stack has to be at the OS level? If the NSA or its customers want to use Teh

Re:

[a_n_d_e_r_s]

Well everybody - except Microsoft of course - knows that the GUI don't have to be in the kernel.

What should be in the kernel is the code for handling the hardware and give those resources to programs in a secure way. Nothing more nothing less.

Re:

[gnasher719]

A few governments will know where this code is used at in vista sp1 (microsoft does allow select country's to view the source). Not only do we have to worry about the US government using a backdoor we have to worry about anyone who has there hands on the source using it as well.

If you had read, and possibly understood, the previous article about this, then you would know that

1. Nobody knows for sure that a backdoor exists. The backdoor _could_ have been created at the time the constants in the algorithm were defined. If it didn't happen back then, then no backdoor exists and no backdoor can be created anymore.

2. The source code doesn't give any information whether the backdoor exists, and if it exists, how it works. 3. If the backdoor exists, then it seems most likely that

Re:

[CastrTroy]

because no one is forcing you to use that particular random number generator

That's hard to say. What does Vista use this RNG for internally. Does it use it for generating keys for use in SSL communications in Internet Explorer? Does it use this RNG to generate random keys for connecting to a VPN? Does it use this RNG to create a salt when storing your passwords? Does it use this RNG to generate the keys for BitLocker? There's many places where one may be using this RNG without even knowing it.

Re:

[CastrTroy]

That's not the point. The point is, is that using this RNG may actually be unavoidable in any number of instances. It may not be used in the instances I pointed out, but there could be many uses of this RNG in the OS, and it would be hard to avoid it. Who's to say they didn't update the previously used RNG to just call this one?

Re:

[VertigoAce]

No it's not open source, but any company with 1500+ SA seats of Windows gets access to the source [microsoft.com] at no additional cost for debugging and security/privacy audit purposes. State and local governments appear to have access provided that they are in certain geographical areas (it's not entirely clear, but it looks like the 1500+ seat requirement doesn't apply). National governments also get zero-cost read-only access to the source code for Windows and Office [microsoft.com].

Re:

[SpaceLifeForm]

They have no way of knowing that the source the can review
actually matches any binaries provided via Windows Update.

Re:

[davidsyes]

Maybe it's because mshaft are in bed with the NSA? After all, the various US intel agencies (and probably those of many governments) want to decrypt ANYthing they think is important enough to them, and they want QUICK not painstakingly-slow access to the plain text.

By including the back doors, mshaft can further differentiate itself from Open Source, maybe to marginalize OpenSource (I wonder what Novell will say in this regard) and try to make companies and governments think OpenSource/Linux applications an

Re:

[secPM_MS]

Sorry to deflate the conspiracy theorists. Certain governmental customers wanted the ECC random number generator. MS provided it. This random number generator is not used by default. The default random number generator is CryptGenRandom, which was revised to deal with the issues that have been discussed with rather more sensationalism than was warranted.

Customers who want to use the ECC generator can choose to use it. This is rather like turning on FIPS mode.

As for backdoors, anybody who is paranoid abo

Re:Given the known problems of Dual_EC_DRBG

[morgan_greywolf]

This random number generator is not used by default.

Prove it. Oh, that's right, you can't because you don't have the source code. Unless maybe you're astroturfing. Even then you'd be under an NDA anyhow.

Other governments are not going to be willing to buy a system with a NSA backdoor.

And other governments have replaced Windows with custom Linux distros due to the potential of this very problem. This is a fact that cannot be denied.

Re:Given the known problems of Dual_EC_DRBG

[secPM_MS]

I don't have to prove it. Not only that, but you wouldn't believe me if even if the code was released - after all, how do you know that the code corresponds to the actual binary?

Look at the FIPS and CC documentation. Governments do use these systems in security critical environments, but they configure them very carefully. There is configuration data available on how to configure system for security critical environments. Selecting your random number generator is one of the things you can do.

The staff working on this are noted cryptographers who do know what they are doing. I have been working with the cryptographers at Microsoft for some time and I have been working in crypto related areas for > 20 years.

Re:

[Burz]

I have been working with the cryptographers at Microsoft for some time and I have been working in crypto related areas for > 20 years.

A dubious distinction. Microsoft is almost criminally negligent when it comes to encryption and most other security issues. Between that and your obvious conflict of interest here, why should anyone believe you?

I'll heed Schneier's concerns over your schilling any day. I'd set his words to music before accepting that soiled "expert opinion" you're pushing, because at the very least you are deranged for smearing those concerns as "paranoid" against the backdrop of massive government spying we see today.

Re:

[secPM_MS]

In the early days, MS focused upon features more than security, as that is what the customers responded to. About the same as the current "Web 2.0", which is essentially untrustworthy by design.

Once security problems became a customer concern, MS moved on it. Indeed, MS is being subjected to considerable criticsm in Vista and Server 2008 for overinvesting in security with respect to neat new features. There is always the feature / security tradeoff. You can configure your system for security, minimizing t

Re:

[Burz]

Indeed, MS is being subjected to considerable criticsm in Vista and Server 2008 for overinvesting in security with respect to neat new features.

Certainly if you count the performance-killing DRM features as "security". Most of us here are talking about the users' security, not Hollywood's.

Of course, the presence of DRM itself throws their crypto incompetence into high relief.

The Secure Development Lifecycle process that was introduced a few years ago has a cryptographic portion that requires crypto usage to conform to reasonable standards...

I know of one MS systems architect who thinks that SSL is broken (but of course, no evidence is ever forthcoming). They are FUD-spewing charlatans, and you believe in them.

Do tell us more about Microsoft's reasonable "standards". Is it anything like what they are doing with k

Re:

[Kidbro]

I don't have to prove it. Not only that, but you wouldn't believe me if even if the code was released - after all, how do you know that the code corresponds to the actual binary?

You don't need to trust the binary if you have the source. You compile your own, and use that one. I know we're going off on a tangent here, but this is exactly why closed source software can't be trusted when open source software can.

I'm not arguing any other point you make though.

Re:

[secPM_MS]

That is not good enough. The attack can be in the compiler or other tools in the build environment. Such attacks have been demonstrated. That is why I mentioned the CC issue. The evaluation laboratories have access to the source, have competent security staff, and are "trusted" by both the customer and the manufacturer to accurately represent what they have found.

For all the talk about closed source, a rather large number of customers, including numerous governments, has read access to the Windows Source

Re:

[secPM_MS]

I try and provide a reasonably knowledgable and balanced response to the frequently unreasonable claims and responses. Clearly I will not have any impact on the true believers, but with luck I will have some impact upon those willing to consider the issues. I joined MS 4 years ago and have worked in security the entire time, assisting the Vista security effort for the past few years and I have some involvement with the crypto efforts. By background, I was more of a BSD'er than anything before I joined MS, h

Re:

[Applekid]

I disagree about making snooping warrants obsolete. Prosecutors love (and, many times, need) redundant evidence to make sure the accused it put away for a long time.

Re:Given the known problems of Dual_EC_DRBG

[dvice_null]

> As for backdoors, anybody who is paranoid about this issue will ignore or disbelieve me when I say that there is no backdoor that I am aware of.

I can believe that you don't know, but would they really tell you if there were such backdoors?

> Governments both in the US and elsewhere do this, which suggests that no backdoor is available.

If you had a backdoor which allows you to access remote computers anywhere would you
a) Tell everyone that you can do it
b) Use some dummy keyloggers and malware to suggests that you can't do it

Stop the Senseless Moderation!

[mpapet]

Let's walk through these expert comments one step at a time:

Anybody who is paranoid about this issue

Did you see what just happened there? This is a clever sleight of words used to disparage and marginalize anyone who questions his premise. Disagree? Put on your tin foil hat and go to the psych ward. There's no room for discussion or even consideration of alternatives. Based on my direct, but very distant experience, Bruce is right in calling the backdoor.

The Common Criterial evaluators look for such is

Re:

[secPM_MS]

EAL is not about security features, it is about assurance levels. In the case of EAL4, the evaluators have access to the source code and design docs and they go through looking for issues and devising tests that the evaluation lab can use to ascertain that the code behaves as expected. The reason I mentioned CC is that the CC evaluation lab has source level access to the system, not that the CC evaluation raises the security functionality. Indeed, in general you will find that the evaluated configuration of

Re:

[pizpot]

...Governments both in the US and elsewhere do this, which suggests that no backdoor is available.

If you ignore reality then yeah. Try thinking "spy first, warrent later" and you will be in the right league. Trolling has become too important to give up.

Re:

[wirelessbuzzers]

As for backdoors, anybody who is paranoid about this issue will ignore or disbelieve me when I say that there is no backdoor that I am aware of. The Common Criterial evaluators look for such issues and submit issues for fixing if and when they find them.

I don't think you understand the issue here. Nobody is claiming that this represents a backdoor in Microsoft's code. The issue is that the approved parameters for the algorithm Dual_EC_DRBG could be a back door.

Essentially, Dual_EC_DRBG is a public-key encryption algorithm* disguised as a random number generator. The NIST parameters are a public key. The generator has some painfully-generated random internal state. It steps by encrypting* using the internal state as a parameter. It outputs the cipher

Re:

[ConceptJunkie]

Bearing in mind that the bill to pay off all the people involved in the moon landings hoax is decreasing every year now they've started to die off, it's likely that the US Dept of Coverups has plenty of budget to spare for this kind of thing now.

Clearly you're forgetting about the bill to pay off all the people involved in the 9/11 cover-ups, which is much bigger than the Apollo cover-ups ever required.

Re:

[Dr_Marvin_Monroe]

To follow up on the poster's point, I've believed that there's been collusion between MS and the Government since GWB's quick settlement of the anti-trust case, and my "tin-foil hat" is not looking so silly any more. At the same time he's wrangling with the telcos to get access to domestic phone records and calls (as the NYT points out, almost immed. after he enters office), he's most likely wrangling with MS to get back doors installed. At least that's what I'd do, and I'm possibly of "normal" intelligen

Well...

[$RANDOMLUSER]

I worry more about the 0-day backdoors in Vista than I do about the NSA backdoors.

Concerned About Security...

[Nom du Keyboard]

You're concerned about security, and you're using WINDOWS VISTA???

Re:

[rucs_hack]

You're concerned about security, and you're using WINDOWS VISTA???

Thats because is is an hero..

Re:

[$RANDOMLUSER]

Well yeah. It IS the "Most Secure Windows" EVAR. Says so right on the box.

Re:

[ConceptJunkie]

Well yeah. It IS the "Most Secure Windows" EVAR. Says so right on the box.

And you know what? It's actually true.

But the "most secure Windows ever" is kind of like the "most stylish haircut Bill Gates has ever had" or "most evolved species that Steve Ballmer resembles".

Re:

[Aqualung812]

Assuming the poster is being forced to use Windows, then yeah, DUH!

There are many features in Vista (such as Bitlocker) that are great security improvements over XP. Yes, Vista is a slow, buggy P.O.S. compared to XP, but it is MORE secure than XP.

it's true

[circletimessquare]

i seeded the dual_EC-DRBG with the following ASCII strings the and got the following output in ASCII:

missionaccomplished -> LOL

waterboard -> buckshottotheface

osamabinladen -> loofahnotfalafel

iraq -> vietnam

No surprise here

[Anonymous Coward]

No surprise, really. After all, Microsoft did this a long time ago (remember the whole "NSA KEY" fiasco?)

http://en.wikipedia.org/wiki/NSAKEY [wikipedia.org]

Is this "feature" back-ported to XP SP3, too?

[denis-The-menace]

Is this "feature" back-ported to XP SP3, too?
SP3 is supposed to have some of Vista's most useful features as well as all previous bug fixes.
Would a shame to ruin a good service pack that speeds up XP by 10%.

Why...

[Basilius]

...does every article about Vista make me less likely to ever use it? Aren't things like this supposed to _improve_ with time?

Re:

[Gadgetfreak]

because this is Slashdot! Did you really expect a "Vista is GREAT" article? Not that they exist.

Re:

[Deanalator]

sensationalist pseudo-journalism?

If you want an informed opinion about vista, slashdot is not the place to get it. Microsoft was in a tough place for this release. The more mandatory access controls they implemented, the more it broke legacy code. In the end they decided security was more important than backwards compatibility in most cases.

It's not perfect, and I'm not switching away from linux anytime soon, but at least microsoft is trying.

OK, this is just stupid.

[rrkap]

So, let's review:

1. Government introduces a new cryptography standard (which it will presumably require for some applications) that requires that systems provide a choice of 4 random number generators, one of which MAY have a flaw.
2. Manufacturers implement the new standard.
3. Grand conspiracy!!!

Come on, could it just possibly be that Microsoft wants to be able to claim to be NIST 800-90 compliant for customers who want that kind of thing and that the NSA likes the idea of there being a variety of random number generators available? The only way that making this function available is a risk is the NSA also has control of the application and can force it to call this random number generator without properly seeding it. If they have that level of control, they have enough control to do whatever else they want in a much more direct way.

Re:

[SL Baur]

Why use constants if they want it to be the standard. That just doesnt make sense.

Actually, it makes a whole lot of sense. Consider the history of the DES. When it was first being proposed, the NSA suggested some changes to the internal constants used. It wasn't until over a decdade later that it was discovered that the particular choice of constants made DES resistant against a certain block cipher cracking technique (the Wiki page is at least accurate on this account - http://en.wikipedia.org/wiki/Data_Encryption_Standard [wikipedia.org]) that was widely unknown at the time the standard was made.

Some of the suspicions about hidden weaknesses in the S-boxes were allayed in 1990, with the independent discovery and open publication by Eli Biham and Adi Shamir of differential cryptanalysis, a general method for breaking block ciphers. The S-boxes of DES were much more resistant to the attack than if they had been chosen at random, strongly suggesting that IBM knew about the technique back in the 1970s. This was indeed the case -- in 1994, Don Coppersmith published the original design criteria for the S-boxes. According to Steven Levy, IBM Watson researchers discovered differential cryptanalytic attacks in 1974 and were asked by the NSA to keep the technique secret.

Trust Us, We're From the Government

[Doc Ruby]

What kind of commie doesn't just trust the NSA? I mean, we've got a FISA to protect us from the government and from corporations cooperating with rogue regimes [slashdot.org], right?

Updated for 2007:

[leoxx]

Trust us, we're from a multinational corporation!

there must be a ulterior motive

[wherrera]

...because this one seems too obvious. So, perhaps the NSA crypto folks have a couple of found back doors in some of the other algorithms, and this is a bit of misdirection to keep people from noticing what they really intend to use... :)

Does anyone who uses Vista...

[gillbates]

Have any expectation of privacy or security in the first place?

IIRC, some of the key SCOTUS decisions regarding the Fourth Amendment have centered around a person's expectation of privacy. They've argued:

• That someone doesn't have a reasonable expectation of privacy regarding their garbage.
• That email doesn't have a reasonable expectation of privacy...
• That a person's car is subject to Fourth Amendment protection.

That said, the government could persuasively argue that someone who runs Windows, especially Vista, has no expectation of privacy in the first place:

• More malware and trojans run on Windows than Mac and Linux combined. In fact, there are more viruses available for Windows than there are editors - even applications - for Linux.
• Microsoft has continued a trend of introducing software with gaping holes for that past 10 years. No OS vendor in the last decade has produced a less secure OS than Microsoft. Surely the user must be aware of this, and have accepted the risk.
• Users accept the Windows EULA, which, among other things, allows Microsoft to remotely check Windows for proper activation - so they already have given up their privacy to a corporation.

Now the sad thing is that this does come across as a troll, but sadly, it's true. And it needs to be addressed. For some reason, the /. crowd thinks it is acceptable that a majority of the population uses an OS which is horribly less secure than the ones we ourselves use (Linux, Macs, etc...). We're supposed to be the technical ones who have the solution to these problems, and yet, most /.ers just choose to blame the victim and whine about Microsoft being evil. Granted, we already know that.

Is it really acceptable that our collective rights are surrendered because a major corporation finds more profit in insufficient design and testing of its software? I realize that most of you loathe Windows, but unless we actually do something to fix the social barriers to the adoption of Linux, we can expect that, because Windows is so insecure, our government will be able to convince SCOTUS that a computer user has no "reasonable expectation of privacy".

It doesn't matter so much that this PRNG is insecure. A knowledgeable cryptographer isn't going to trust the OS for random numbers, anyway - unless it is in compliance with some standard to which their code must comply. What matters is that Vista is full of holes, and we're talking about a PRNG which no software of cryptographical consequence is going to use anyway.

Instead, we ought to worry that Windows itself is easily compromised by the government. That is the real problem. Why would you break the PRNG when you can rootkit even a fully patched Vista box with an email?.

Re:

[Chris Burke]

That email doesn't have a reasonable expectation of privacy...

Afaik, this issue has only reached the federal appeals court level, and they ruled that email does have a reasonable expectation of privacy.

The reason, as us techie guys so often forget, is that the "reasonable expectation" has nothing to do with the technical feasibility of someone violating your privacy. It has much more to do with social norms, the intent of the user, and active steps being taken by the privacy-violator. It doesn't mean that

Re:

[Vegeta99]

I can have my car (and pretty much any Ford before about 1998) unlocked and started in less than 30 seconds with a screwdriver and a slimjim, and I don't have to get anybody to click "Yes" to do it. Not only that, but I could put it all back together with no damage! Furthermore, most cars are built like this.

Why, if we use your logic, is my car protected?

It's more akin...

[gillbates]

Well, let's extend your analogy: Suppose you bought a Jeep. Would you expect the contents in the back to be safe from theft, or inspection by law enforcement? Vista is that Jeep - it exposes your personal life to anyone who wants to have a look, breaks down a lot, costs a lot to maintain, and leaves the user exposed to anything hostile coming its way.

Re:

[LaskoVortex]

> For some reason, the /. crowd thinks it is acceptable that a majority of the population uses an OS which is horribly less secure than the ones we ourselves use (Linux, Macs, etc...).

You haven't done a survey so you don't know the usage. I'd imagine more than half of the /. crowd are gamers and thus satisfy their guilty pleasures on a vista box. There is a lot of complaining about vista here simply because that is the major OS of /. Your points are valid, but they are largely falling on ears deafened by

Re:

[Burz]

I agree with the overall thrust of your post, BUT:

unless we actually do something to fix the social barriers to the adoption of Linux

...seems to imply the problem mainly lies with society in general. But the problem is basically within the Linux community: You are trying to sell people on nothing. [slashdot.org] At least nothing they can grasp, being non-sysadmins and non-programmers.

Contrast the product structure of "Linux" with more successful FOSS projects like Firefox and OpenOffice, and learn the lesson well... or be content watching MS not only rebound in desktop share, but use that to eventually

This is not Trivial...

[deweycheetham]

Supporting Information from Original Author:

|Cryptanalytic Attacks on Pseudorandom Number Generators

J. Kelsey, B. Schneier, D. Wagner, and C. Hall

Fast Software Encryption, Fifth International Workshop Proceedings (March 1998), Springer-Verlag, 1998, pp. 168-188.

ABSTRACT: In this paper we discuss PRNGs: the mechanisms used by real-world secure systems to generate cryptographic keys, initialization vectors, "random" nonces, and other values assumed to be random. We argue that PRNGs are their own unique type of cryptographic primitive, and should be analyzed as such. We propose a model for PRNGs, discuss possible attacks against this model, and demonstrate the applicability of this model (and our attacks) to four real-world PRNGs. We close with a discussion of lessons learned about PRNG design and use, and a few open questions. | http://www.schneier.com/paper-prngs.html [schneier.com]

If you have been keeping up with computer security, everyone should be aware of the weakness of Random Number generators and it's vast effects over large sections of the computer world. This is not trivial...

Worth Noting

[Anonymous Coward]

The talk [cr.yp.to] referenced by Schneier in his essay [schneier.com] as being the one that publicly disclosed the backdoor was given by two Microsoft researchers. So all the "OMG micro$oft iz so stoopid" posts might be a bit .... misdirected.

You're doing it wrong

[Nazlfrag]

The talk [cr.yp.to] referenced by Schneier in his essay [schneier.com] as being the one that publicly disclosed the backdoor was given by two Microsoft researchers. So all the "OMG micro$oft iz so stoopid" posts might be a bit .... misdirected.

Shhhh! That's not the way to bash Vista! Regardless, I was wondering when this little fact would spring up, and lo and behold it is by an AC after hundreds of 'stupid microsoft' quips.

Let us all eat a large slice of humble pie.

So...

[jav1231]

The obvious joke here is that its a lot of trouble to go after the 12 people still using Vista. Baddump-bump!

But seriously, this is a continuation of Microsoft's vendor-first, consumer-second approach.

Random fun in the old days of computing

[Bones3D_mac]

This kind of reminds me of the old days of computing where random number generators simply cycled through a fixed series of values that would be repeated over and over each time you powered up the computer. One fun exploit of these early random number generators was to place two identical computers on the same circuit, then flip the switch causing both machines to boot simultaneously. Assuming the factors were reasonably identical, you could simultaneously launch any program that used random numbers and use

If true...

[TheNetAvenger]

If true, do you really think Microsoft would 'want' to do this? They have been pretty strong privacy advocates, especially Gates, denying even backdoor access for Bitlocker in a fight several years ago when bitlocker was demonstrated to the FBI.

If the government is FORCING MS to do this, then we should be calling our representatives and not sitting around speculating or smacking on Microsoft.

The whole big brother NSA thing is very much a Republican/Bush/Neo-con era mechanism, and Gates and lots of others a

Clever!

[spun]

I see what you did there. You implied that anyone who criticizes the US or Vista is a paranoid loony. Now why would you do that? Do you just assume that people will criticize the US? Is the US that worthy of criticism that you have to defend it preemptively? I know that's a popular tactic these days, but is it entirely necessary? Nice how you posted AC, too. You sir are an all-around class act.

Re:

[Bill, Shooter of Bul]

No, he said there are some paranoid people here "who rant about how U.S. is a fascist state and how Vista is the new 'evil'"

Thats true. That does not imply what that any criticism is paranoid. It is possible for a subject to be criticized legitimately by some people, and delusionaly by others. He's referring to those who always lose arguments due to godwin's law.

Re:

[spun]

Ah, well, that's completely true. Nutters on all sides of any issue, eh?

Re:Much Ado About Nothing

[Kadin2048]

Agreed. The only interesting thing about this whole story is that the NSA apparently reviewed the PRNG function and rubber-stamped it, missing the critical vulnerability. Since the vulnerability really isn't that good of a backdoor, and doesn't seem to have been all that subtle, I think this is far more likely to be incompetence rather than malice on their part.

As an American, that doesn't make me feel a whole lot better -- in some ways, I'd really like to have the secret agencies of so many spy movies rather than the massive bureaucratic pile that I know exists in reality -- but disappointment in government is something I've gotten used to. You don't last long in Washington without it.

Re:Conspiracy theorists come forth! Now it the tim

[hey!]

I disagree.

This has absolutely nothing to do with open or closed source. A completely open source random number generator would have precisely the same vulnerability, because the problem isn't potential skulduggery by the vendor, it's potential skulduggery by the people who designed the standard.

What Microsoft has done is to implement a questionable standard. It makes no sense in this case to blame them for its shortcomings, especially since developers have alternative standards they can use.

Now when it comes to application software using a random number generator, then there actually is a closed/open source argument to be made. Do you know which random number generator is used by the software you use? With closed source, almost certainly not. With open source, programmers can undo the choice of the dodgy elliptic curve RNG and replace it with a more solid, equally standards compliance alternative. And get a speed boost too. You also know that you might not want to trust the source for your software if they use the inferior algorithm.

Re:

[internic]

This has absolutely nothing to do with open or closed source. A completely open source random number generator would have precisely the same vulnerability, because the problem isn't potential skulduggery by the vendor, it's potential skulduggery by the people who designed the standard.

I agree that the vulnerability of this particular PRNG has nothing to do with closed vs. open source, but I think there is some relevance to the larger issue. Namely, in a closed source OS it seems (at least naively) that

Re:

[rrkap]

I'm 24 years old. I don't want to go through the next 50 years of my life living in an international air of worry and uncertainty. I don't want to live in a permanent state of fear, generated by a megalomaniacal American government taking advantage of the majority low IQ populous' capacity for being brainwashed.

Can I suggest you up your meds? Your current dosage isn't doing its job.

Re:

[Jackie_Chan_Fan]

I'm with ya... America sucks... and i'm American. Sigh.

We're doomed.

Re:

[hyades1]

The U.S. isn't doomed, but there is certainly a huge, deep pile of shit to be shoveled if it's going to get back to what it was.

Re:

[pizpot]

The U.S. isn't doomed, but there is certainly a huge, deep pile of shit to be shoveled if it's going to get back to what it was.

Nice try, keeping your chin up, positive attitude and all that. Showing you are real and not a nut. Well now try realizing that you've only learned the tip of the iceberg.

Re:

[DrNASA]

"Children so stupid they think America invented the Internet, computer, motor car, light bulb, telephone etc ad infinitum...."

Hmmm.....America invented the:

Internet.....check
Computer.....check...holy crap...modern computing actually has it's roots in TEXAS of all places (see the integrated circuit)...so DOUBLE check
Motor Car....check again...lol - who would have thought, surely SOMETHING on this list was not invented by America
Light Bulb....check again, wow
Telephone.....and....wait for it.......c

Re:

[Anonymous Coward]

Germany invented the car.

An automobile powered by an Otto gasoline engine was built in Mannheim, Germany by Karl Benz in 1885 and granted a patent in January of the following year under the auspices of his major company, Benz & Cie. which was founded in 1883.

Although several other German engineers (including Gottlieb Daimler, Wilhelm Maybach, and Siegfried Marcus) were working on the problem at about the same time, Karl Benz is generally acknowledged as the inventor of the modern automobile.[5] In 1879

Re:Fuck You AmeriKKKa!

[Jerry Rivers]

Telephone was the culmination of the work of several people, and so the nationality of the inventor is in dispute. Bell did most of his work on the telephone in Canada.

The first computer was a German invention (Konrad Zuse's Z3 in 1941).

The first automobile was a French invention (1881).

The light bulb had already been invented by several people, mostly European, before Edison perfected it.

Re:

[Yold]

"invented the computer" is ambiguous. Many people, Babbage, Turing, etc. worked on the analytical model, and dozens if not hundreds of engineers worked out the details.

http://en.wikipedia.org/wiki/Von_Neumann_architecture#History [wikipedia.org]

An American did however invent the concept of the modern computer.

Re:

[Jerry Rivers]

""invented the computer" is ambiguous. Many people, Babbage, Turing, etc. worked on the analytical model, and dozens if not hundreds of engineers worked out the details."

Fair enough.

Re:Fuck You AmeriKKKa!

[sherpajohn]

Computer.....check...holy crap...modern computing actually has it's roots in TEXAS of all places (see the integrated circuit)...so DOUBLE check

Bzzzt, wrong! Even though he is dead, his guy: http://en.wikipedia.org/wiki/Konrad_Zuse [wikipedia.org] would argue with that.

Motor Car....check again...lol - who would have thought, surely SOMETHING on this list was not invented by America

Wait another dead guy wants a chat - http://en.wikipedia.org/wiki/Karl_Benz [wikipedia.org] - says he invented the automobile.

Light Bulb....check again, wow

Um, better check your's again, I think its a bit dim if not burnt out. If you refer to Edison, he was not even close to the first to demonstrate what is now known as the incandescent light bulb. http://en.wikipedia.org/wiki/Lightbulb [wikipedia.org]

Well, 2 out of 5 ain't bad right? Well, the telephone is not a sure thing, so lets make it 1.5.

Re:

[Anonymous Coward]

Wait another dead guy wants a chat - http://en.wikipedia.org/wiki/Karl_Benz [wikipedia.org] - says he invented the automobile.

But that's disputed. Actually, http://en.wikipedia.org/wiki/Siegfried_Marcus [wikipedia.org] started to construct cars a few years earlier. But since he was a jew, the nazis were keen to hide this fact and declared Benz the inventor. They even tried to destroy Marcus' car in the museum. (But the museum staff was quicker, and had already built a wall around it, so it does still exist today.)

Re:

[jdigriz]

Internet: Yeah, we did.
Computer: Arguable, depends on your definition of what constitutes a computer. Take a look at the work of Konrad Zuse. Yes, the US invented the integrated circuit.
Motor Car: No, Benz, Daimler and others invented the car. However, an American, Ford, was the first with an affordable mass-produced car.
Light Bulb: Edison may not have invented the light bulb but he did significantly improve it and mass produced the first long-lived incandescent.
Telephone: Given that telephone is the

Re:

[DrNASA]

Lol - you know, I actually had a line about Babbage, but deleted it, figuring that there was no need to point out the distinction between what the op was referring to and what Babbage actually designed (but never created).

I think the argument could be made that Bell was in America when the telephone was invented - not conceived.
Regarding the lightbulb - toss up in my opinion. Edison built the first functional working model. Again, the difference between concept and function.

Point taken on the auto's,

Re:

[Amouth]

i can't see how i got a troll for that - i was posting that with the unnoted refrence to my sig... i mean this "back door" isnt' even confirmed - it is jsut someones idea that it "might" exist.. without proof though you don't know - so MS is using it - sure give them bad press if it is "known to have" a "back door" but really without proof what do you have other than random people trolling about nothing..

come to think about it my comment isn't any better than the rest of the people's here.. feel free to re

Re:Article summary follows

[Fractal Dice]

"Don't worry, our Chinese contractors assure us there are no NSA backdoors"