RSA Warns Developers Not To Use RSA Products 128
rroman writes "RSA has recommended developers not to use Dual_EC_DRBG random number generator (RNG), which has been known to be weak and slow since 2006. The funny thing is, that even though this has been known for so long, it is the default RNG in BSafe cryptographic toolkit, which is product of RSA."
Doesn't matter (Score:5, Insightful)
Surely no-one in their right mind is still using crypto software from US companies? None of it can be trusted any more.
Re:Doesn't matter (Score:5, Funny)
I see that you're not using American software, let's go into this back room and you can tell me why you hate America.
Re: (Score:3)
Re: (Score:1)
And here, sports fans, is exactly why we need better controls on firearms and video games in the US.
Re: Doesn't matter (Score:2, Informative)
The "global police force" metaphor is used a lot but it is completely wrong.
The actions on the international stage are driven entirely by economical and geopolitical interests. If it so happens that the operation appears to "do good" then a media spin will be applied, furthering the "global policeman" illusion.
On the other hand, operations which topple democratic governments, install anti-leftist dictators, support smaller third world dictatorships in their abuses, grab the resources of a country, fund terr
Re: (Score:3)
On the other hand, operations which topple democratic governments, install anti-leftist dictators, support smaller third world dictatorships in their abuses, grab the resources of a country, fund terrorists to keep on destabilizing a country, etc., etc., these are not mentioned in the policing context.
This would be logical. The weird thing is they are. I have seen for example Vietnam, Cuba and Chile used in exactly the context you describe, including here on slashdot. It appears that most people in the US don't actually understand the details of what happened in those cases so people get away with such absurd and outrageous nonsense without being called on it.
Re: (Score:2)
You seem to have a rather idealized notion of "police". I never saw "global police force" as much of a compliment.
Re: Doesn't matter (Score:1)
I guess you can maintain a spurious moral high ground, and allow the US to fight your battles for you, all the while decrying their supposed Colonialism. Go look at the UN funding and see where lion's share of the money, infrastructure and personnel come from.
Re: (Score:1)
Because no one else would. Maybe not always the best thing, but often a lesser bad thing than to stay aside and watch.
Re: (Score:2)
In the USA, your crypto software doesn't trust you.
Ah, that explains TPM.
The obligatory NSA question (Score:5, Interesting)
Is NSA finding this RNG hard to crack, or did NSA tell RSA to slip in a backdoor back in 2006 - and RSA folks are trying to crawl out of the hole they dug for themselves?
Re:The obligatory NSA question (Score:5, Interesting)
"Is NSA finding this RNG hard to crack, or did NSA tell RSA to slip in a backdoor back in 2006 - and RSA folks are trying to crawl out of the hole they dug for themselves?"
Evidence very strongly suggests the latter.
Re:The obligatory NSA question (Score:5, Insightful)
It wasn't RSA. They trusted the NSA, with good reason. The NSA had earned the trust of just about everybody in the community by improving DES with changes nobody understood until fifteen years later.
Then someone figured out that the way this new RNG is set up, the constants the NSA chose *could be* the public half of an asymmetric key, and if so the RNG's state could be read with very little effort by anyone in possession of the private half. There is no mathematical way at all to tell whether this is the case, but apparently something in the Snowden documents at least strongly suggests the NSA did know about it and did use it.
It's important to highlight that this isn't the kind of weakness anyone _else_ can take advantage of; a blackhat would still have to discover their private key, the exact same problem he was facing before. The NSA are apparently not dumb enough to rely on keeping math a secret.
But it seems every successful security service forgets the basic lesson: set up a system with unchecked power, the scum of the earth will eventually take notice. From that moment they'll dedicate their lives to getting control of it. They'll eventually succeed.. Snowden took advantage of criminally slack security in the NSA. Just the the fact that he could reveal the documents he revealed is proof the NSA have already gotten arrogant and sloppy, never mind what's in them.
Re: (Score:1)
Of course it is easy to foreign agents to get ahold of any secret. The more info collected into one place, the bigger the carrot.
They're trained to wrestle information out of government and corporate hands. What will it take? Money? Threats? Violence? Brainwashing?
Google up how successful China is for instance.
Re: (Score:2)
It's likely that the issues with DES would have been discovered sooner had they not been fixed, after all an actively used system is far more worthy of study than something thats been superseded and is no longer used.
As for discovering the private key, who's to say Snowden doesn't have a copy of it? And for all we know, that key could have been leaked to others long ago, the US is not the only country that conducts spying...
Re: (Score:2)
It's likely that the issues with DES would have been discovered sooner had they not been fixed, after all an actively used system is far more worthy of study than something thats been superseded and is no longer used.
That is nonsense. The fixed DES was identical to the original DES, with the expectation of a couple of seemingly arbitrary numbers. Nobody's going to stop researching DES because the NSA changed a couple of numbers. In fact, the opposite is far more likely.
Re: (Score:2)
"The NSA had earned the trust of just about everybody in the community by improving DES with changes nobody understood until fifteen years later. "
Are you being sarcastic? The "improvements" they made are now being looked at, 15 years later, as examples of Government backdoors in their encryption.
(I know it's not every case, but the consensus is that it was in THIS case, and possibly several others. I have friends in the field and they knew about this particular instance of PRNG for elliptiical curve crypto way back when. Few trusted it except, apparently, RSA and its customers.)
So any "improvements" from the NSA have to come with a grain of sal
Re: (Score:1)
The "improvements" they made are now being looked at, 15 years later, as examples of Government backdoors in their encryption.
I suspect you're talking about some other DES [wikipedia.org].
Re: (Score:2)
"I suspect you're talking about some other DES."
Pardon me. My eyes must have skipped over the DES part. No, of course what I was saying doesn't apply to DES.
On the other hand, this situation has made a lot of people look at any government-approved encryption with a jaundiced eye.
Re:The obligatory NSA question (Score:5, Interesting)
Considering the consequences of defying the spooks, they had no real choice but to dig that hole or close the company.
Re: (Score:2)
Re:The obligatory NSA question (Score:5, Informative)
Yep NSA did play a hand in this insecure logarithm [arstechnica.com].
Sadly just a month ago such a comment would be modded -1 offtopic or -1 flamebait as the equailivant of that crazy guy drunk talking to himself on the subway.
Slightly different topic, this algorithm seems very strong as it is what slashdotters say is a perfect encryption mathmatical algorithm. It is Elispse based so there are more numbers to guess and the seed process is very stenious to make it harder to crack. It seems like the best one which is why BASE libraries use it just on that evidence. Can a mathmatician or crypto expert explain why this NSA endorsed algorithm has so many problems compared to SHA-2 or BES?
Re: (Score:1)
So where are all those clowns who parroted the "tinfoil hat" comments now, huh? Eating their humble pie, no doubt.
I TOLD YOU SO!
Re:The obligatory NSA question (Score:5, Interesting)
Re: (Score:2)
With the generational (1950-80's) change from dedicated cryptography machines to the 'internet' that same political and military deal had to be met.
How do you get the world chatter? You have to create any emerging digital standards. Just as the cryptography machines and telco equipment where interfered with and sold cheap to friendly nations.
If the UK and US encounter pe
Re: (Score:3)
If any national crypto private or public sector standards emerged from with in Asia or the forming NATO/EU the UK and US where quick to request individual firms or nations come back to the set 'NSA/GCHQ' weakened standard.
How would any nations mil or political leader say 'no' to the full might of NATO or the USA crypto?
Saying yes to the NSA/GCHQ bought in a
Re:The obligatory NSA question (Score:5, Interesting)
I've never seen any examples of negative press from government sources.
More likely the US simply developed an entire line of dedicated processors that can crack almost any code.
This probably happened about the same time they dropped their designation of encryption as a munition.
They already had the solution in hand.
However, when real time continuous encryption started to be the norm, (like encrypted Skype, VPNs in routers, and SSL everywhere)
they simply bought their way into the companies doing it, and induced them with money and contracts.
I've stated more than once here that I believe it will be eventually revealed that the NSA fully funded Microsoft's acquisition of SKYPE.
Probably because EBay was incompetent and not terribly interested in ripping out the un-traceable routing via small
remotely distributed groups of nodes and many volunteer notes.
Even if Ebay did provide access to the encryption technology, they couldn't circumvent the routing issues to provide taps.
The first thing Microsoft did was route all traffic through their servers. No more routing via anonymous "volunteers" or off-shore
peer-to-peer technology. It now goes direct to Microsoft and then to the other party. There was never a business case to do this.
It was working just fine, and hasn't improved since Microsoft took over. There was ONLY ever an intelligence case to make this change.
Why would Microsoft take on that expense for free? Because the NSA bought Skype for them.
Re: (Score:3)
That's not true. Earlier this month I have seen my Skype calls get routed through peers, who were not participating in the call. That however resulted in very unreliable calls, so I got the machine running Skype onto a public IP address. With that in place I could see the traffic was going directly between me and the IP addresses of the people I was commu
Re: (Score:2)
When parties on both sides of a firewall are cooperating in getting data through the firewall, there is little you can do to stop them. The solution is to limit what software gets to run on the trusted side of the firewall. If you don't want Skype on your network, then don't install it. Some corporations do use Skype as part of their work. Those corporations are happy that Skype is so easy to ge
Re: (Score:3)
I've also seen Skype work when it shouldn't - behind corporate firewalls that are supposed to be blocking traffic. Probably via a peer that somehow has better access...
That said, yes I still believe Microsoft has made skype easier to spy on.
Skype has always had great firewall piercing technology, even before Microsoft bought them.
Skype makes outbound connection(s) to the server. Its as easy as that. When a call comes in, the outbound
connections are used for bidirectional traffic.
It can do this on any port, and your corporate firewall can't block all ports
and still allow things like web browsers work.
Re: (Score:1)
for one, SHA-2 is a hashing algorithm, not encryption. Secondly, although the math is sound, the algorithm which generates the seed for the PRNG is allegedly based on constants which make the crypto trivial for the NSA to brute force.That algorithm is known as Dual_EC_BRDG.
Re:The obligatory NSA question (Score:5, Insightful)
Re: (Score:3)
Schneier has been speculating [schneier.com] about the possibility of an NSA planted backdoor in Dual_EC_DRBG since 2007. Which by the way took me a few attempts to find again since there are many hits if you search for NSA backdoor on his site.
Re: (Score:2)
Re:The obligatory NSA question (Score:4, Insightful)
The problem is that RSA made the worst generator (in every respect) of several the default. That cannot have been an engineering decision or a business decision in the interest of their customers. It is dead certain that NSA coercion is behind it, anybody that can build a working crypto library cannot be that incompetent.
Maybe not RSA, but certainly NSA (Score:4, Informative)
or did NSA tell RSA to slip in a backdoor back in 2006
It's not so much the possibility that the NSA influenced RSA, rather they influenced the standard itself.
Here's the whole story according to Bruce Schneier:
http://www.wired.com/politics/security/commentary/securitymatters/2007/11/securitymatters_1115 [wired.com]
No point pussy-footing around (Score:5, Insightful)
There's no point in pussy-footing around this. It's obvious that RSA was either forced or "rewarded" into using an insecure method. And that they knew it at the time (because they are cryptographers and because they don't live in the bottom of a well.)
Therefore, RSA has proven themselves untrustworthy at best, corrupt at worst, and quite likely both.
The question is what to do next? Rip out everything RSA in all infrastructure and replace it with something that works appears to be the best approach, but how should that be done and what should it be replaced with? And, most importantly, how can we verify that replacement?
Re:No point pussy-footing around (Score:5, Interesting)
"Therefore, RSA has proven themselves untrustworthy at best, corrupt at worst, and quite likely both."
And don't forget that their "super security" ID dongles were hacked just a year or so ago.
All in all, it's looking like RSA is a corporation to avoid.
Re:No point pussy-footing around (Score:5, Interesting)
An interesting scenario just came to mind...
1) RSA intentionally weakens their crypto at the behest of the NSA (this is fairly certain)
2) Chinese hack RSA - the only question is just how thoroughly (a known fact)
Now comes the speculation.
3) China analyzes what they got from RSA and discover the crypto is weaker than expected.
4) Quietly, China also begins to take advantage of this breakable crypto the NSA foisted on US companies and citizens.
5) China deduces why it was done and starts looking for weaknesses in other US crypto products - possibly succeeding, given they have a decent idea what to look for.
Followed by
6) China successfully and quietly penetrates most US defense contractors and financial institutions.
Re: (Score:1)
6) China successfully and quietly penetrates most US defense contractors and financial institutions.
So, you are saying you think the NSA deliberately weakens an encryption method, then proceeds to use that method itself? Because the NSA sets the standards for the DoD and defense contractors.
I can't tell, do you think the NSA is brilliant or stupid beyond belief?
Re: (Score:2)
"I can't tell, do you think the NSA is brilliant or stupid beyond belief?"
I'm pretty sure it means a little bit of both.
Re:No point pussy-footing around (Score:4, Interesting)
I think the NSA believed it was okay to weaken cryptography because they assumed they would be the only one who knew about what they'd done and specifically how they'd weakened it.
So really, what I believe is they were very clever and, at the same time, very naive... Or perhaps sophomoric and arrogant would be a better fit.
Re: (Score:2)
Re: (Score:2)
Yup - I have no argument at all with your statement.
Re: (Score:2)
The more bigger of a threat that China is, and the more hacking groups break into goverment files the more power the NSA is given, and they get the benifit of spying on themselves.
So it is a win/win to compromise your own systems.
Re: (Score:2)
It certainly explains how they've managed to penetrate so many large corporations, and in such a short window. There was a common weak security element between all these companies, and this was likely it.
I do remember the RSA was hacked into not so long ago, and a good chunk of their data was stolen. I wonder if they got a dose of their own medicine. In fact, I wonder if they allowed it to happen deliberately, to show the spooks what happens when they try to sabotage everybody indiscriminately.
Re: (Score:2)
Re: (Score:1)
The dongle hack was information about the SecurID token, which does not use the same PRNG. Of course this information is probably from RSA itself since it is sourced anonymously. The SecurID hack was apparently a phishing e-mail exploiting CVE-2011-0609 according to f-secure, so not specifically an RSA failure.
In other words, not the same crypto in question. Your scenario is probably more like 2 steps:
1) 2006 papers suggest Dual_EC_DRNG is predictable
2) China decrypts everything created by BSAFE Toolkits
Re: (Score:2)
"The dongles weren't hacked. Someone broke into RSA and stole the seed records, which is what goes inside the security dongle (and is supposedly impossible to extract from the dongle)."
Technically correct. I almost wrote "but it's a distinction with no difference"... except that's wrong. It's actually WORSE. It means it wasn't just a bug... RSA was woefully irresponsible with vital user data.
Re: (Score:2)
There is no reason for them to provide dongles pre-seeded... And if you buy such devices, you have no proof that the records have been destroyed even if the company claims they have.
Customers should be able to seed their own dongles.
Ofcourse i've been saying this for years, asking what happens if rsa get hacked and all the seeds taken... People said that was crazy talk, rsa would never get hacked etc.
Re:No point pussy-footing around (Score:4, Informative)
The question is what to do next? Rip out everything RSA in all infrastructure and replace it with something that works appears to be the best approach, but how should that be done and what should it be replaced with?
I have no need to, because I don't use any of RSA's software toolkits.
I use Microsoft CryptoAPI, GPG, GnuTLS, and OpenSSL, php-Mcrypt/php-Mhash, and some dedicated non-RSA special purpose libraries, for all my cryptography requirements.
Re: (Score:1, Redundant)
Putting it bluntly, you can't.
Here's the problem. Dual_EC_DRGB is flawed, but is *required* to be implemented as part of anything that claims FIPS 140-2 compliance. Anything cryptographic you sell to the government is *required* to be FIPS 140-2 compliant, and operated in FIPS 140-2 compliant mode.
This includes just about all routers, switches, firewalls, operating systems and any other network or security gear in use by the U.S. gov't. Companies that supply this equipment include Cisco, HP, Dell, IBM, Juni
android 2.3? (Score:2)
Was that mess posted with Android 2.3 by chance?
Re: android 2.3? (Score:2)
No, why? Had Android's autocorrect infected my brain where it now reads as normal to me?
Yeah, lots of repeats. Checked in multiple browers (Score:2)
I checked it in a couple of different browsers. Only the Android browser made it look correct, and that was only on the second viewing using that browser.
When I first viewed it, it was broken in Android too. Most lines are repeated three times. For example, the sentence starting with "Here's the problem. Dual_EC_DRGB is flawed" is in there three times. I wonder what you'll see if I repost a copy / paste of the text:
Putting it bluntly, you can't.
Here's the problem. Dual_EC_DRGB is flawed, but is *required*
Re: (Score:2)
Interesting. It was posted in Firefox 24, as it was too long to try and do thru my phone browser (Android 4.2.2). But it looked fine in both. Interesting that you see it differently.
For the longest time I had issues viewing Slashdot in the Android browser. I'd get essentially an infinite loop of comments in a threat. That seems to have been fixed about a month or so ago.
What you copied back in your reply also looks properly formatted to me.
Re: (Score:3)
what should it be replaced with?
To be trustable it has to be open source, but to be trustworthy will require both code scrutiny and careful analysis.
New maxim: you can't keep secrets with secrets.
Re: (Score:2)
Screw that. Simple 1 time pad will do the trick. Uncrackable by even the best crypto minds on the planet.
Re: (Score:2)
Re: (Score:2)
Well, using a known flawed system is also going to make you in violation of sarbanes-oxley...
So what do you do?
Re: (Score:2)
Screw that. Simple 1 time pad will do the trick. Uncrackable by even the best crypto minds on the planet.
Not if you use an insecure random number generator (i.e. pretty much anything that's pure software with no hardware component) to generate the pad.
Re: (Score:2)
5, 10 sided dice are kind of hard for the NSA to "tamper with".
Re: (Score:1)
I would think that dice qualify as a "hardware component".
Re: (Score:2)
Unless they're perfect dice (and they certainly won't be after generating gigabytes of material), there may still be a bias [springer.com] in the pad you generate with them.
Re: (Score:1)
Uncrackable by even the best crypto minds on the planet.
Only theoretically [wikipedia.org]. There are plenty of issues with using one-time pads that can make them suspectible to be cracked.
Re: (Score:2)
Re: (Score:2)
One of the major reason public key crypto was invented is the difficulty associated with securely distributing symmetric crypto keys.
A one-time pad is essentially a massive symmetric crypto key, so you're back to square one. And good luck distributing a copy of your one-time pad to everywhere you do e-commerce with, like your bank, Amazon.com and the like.
Re: (Score:1)
You make the wrong assumption that the guy read past the part of one-time pad's being "unbreakable" to all the downsides associated with them.
Re: (Score:2)
Like your assumption? as you seem to assume far more than you know.
It is "unbreakable" and anyone that has a clue about cryptography knows it. Yes there are weaknesses that are always human induced mistakes, like re-using the pad.
But there are still communications that were send during WW-II that have not been cracked that used a 1 time pad. For very high security it is still used to this day.
Re: (Score:3)
No. The entire purpose of RSA is providing the illusion of security.
Fixed. The problem with security is that you can't actually sell it; the customer has no way to tell if they are really secure, or just feeling secure. But the customer can certainly tell if they feel secure. So all security vendors tend to major on the warm fuzzy feelings. That means a lot of "trust us, we're the experts" and "you don't need to know the details, put your mind at ease" and not a lot of "here is the exact proof that you are secure, including every line of our source code and every mask in ou
Re: (Score:3)
I see some RSA shills repeating this argument ... but I don't see any explanation why they used it as the default after 2006. We really have no greater proof it's backdoor'd now than we had then ... if we didn't have the 2006 analysis of Dual_EC_DRNG then Snowden's leak could be referring to a whole lot of things.
All that has happened is that the legal threshold of plausible deniability has disappeared ... but the common sense threshold for plausible deniability disappeared in 2006, they knew and they kept
Re: (Score:1)
There are two separate points here - one, that RSA did not change the default, and two, that it was at the direction of the NSA. My objection is to the second. Maybe I am misreading, but you are taking the given, that the default was not changed, to mean that it therefore must have been at the request of some government agency. It is a simple and compelling argument to make, but it doesn't stand up given what I understand.
"RSA shills" are simply pointing out what RSA claimed. I have not seen anything so
Re: (Score:2)
There is no proof outside of mathematics, but it makes no more sense to doubt it than to doubt the sun will come up in the morning.
Re: (Score:1)
Actually this is not true, and it is obvious you have never done any crypto work yourself, having taken graduate level courses on the topic, I can tell you that 1) it is hard to prove that an encryption system (b/c thats what PRNG is at the core) is 'slightly' insecure, Proving glaring obvious faults is easy. 2) not every crypto secret is publicly known, look at DES and EC attacks
Take AES for example, its the standard that pretty much everything uses for symmetric enrcryption, but it is NOT a feistel ciphe
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:3)
Don't forget that this default also selected the slowest generator and the one with the worst security analysis. There is no way this was an engineering decision. In fact I would not be surprised if some people working on the library resigned right at the time this decision was made...
RSA is poor quality, as VMware learned (Score:2)
There's the proverb about not attributing to maliciousness that which can be explained by stupidity.
VMware (also an EMC subsidiary) used an RSA implementation for their SSO product. It had a ton of problems and bugs, and each new patch release introduced more bugs. Applying pressure to RSA via EMC didn't help, so VMware ripped out the RSA implementation with a band new in-house implementation.
Re: (Score:3)
"stupid" is not in the picture. Making the slowest generator, and the one with doubtful security at the same time, the default is not stupid, it has to be deliberate. Now if the NSA people were any good at their business, they would have made sure that their compromised generator was the fastest, so as to give a plausible reason for making it the default. They failed event at this simple Deception-101 idea.
The more I hear, the more I think the NSA is a ham-handed, incompetent, slow and stupid bureaucracy th
Re: (Score:3)
They had to deliver plain text 24/7 or face even less funding or other groups would have offered language contractors and bulk clearances.
The only trick was keeping the citation needed over generation.
The other half of the backdoor (Score:2)
When it was discovered in 2007 that the NSA insisted on adding this PRNG to the standard, with constants they chose the general reaction was "so what? after all, this is one of many alternatives, and it is the slowest and least efficient". I assumed their idea was to somehow choose the PRNG in applications where they were one of the parties, but that seemed unlikely.
It's now clear what the idea was: secretly having companies use this PRNG. The original assumption was that companies voluntarily choose what
What's a cryptographer to do? (Score:1)
"I personally believed that it was some theoretical cryptographer's pet project," one cryptographer who asked not to be named told Ars.
He (or she) is not accusing anyone or suggesting anything. Why the desire to remain anonymous? I bet that many people active in cryptography even in academic circles are afraid. Indeed, chances are that active researchers are being
OpenBSD entropy (Score:5, Informative)
Yet another reason that validates OpenBSD developers having spent years improving the quality of random number generation [openbsd.org].
Say what you want about Theo, but their developers are top-notch and their stuff really works.
Our... (Score:2)
Hearts...
Bleed...
NSA backdoors in algorithms ? I don't think so (Score:2)
Why would the NSA deliberately weaken crypto algorithms ?
Sure, that makes spying easier but it is also quite dangerous. Because if the vulnerability is found anyone can access the encrypted data, including the enemies.
Think about it : the NSA releases a "recommended" crypto package. Obviously, US companies will be much more likely to use it than, say, the Chinese. If this package happens to be weak and that the Chinese find out, US companies will be the most affected. Also, to spy on its own citizen, it is