Dual EC DRBG

From Wikipedia, the free encyclopedia

Dual Elliptic Curve Deterministic Random Bit Generator (Dual_EC_DRBG)[1] is a claimed cryptographically secure pseudorandom number generator (CSPRNG) standardized by the National Institute of Standards and Technology (NIST), ANSI, and ISO. Dual_EC_DRBG is based on the elliptic curve discrete logarithm problem (ECDLP) and is one of the four CSPRNGs standardized in NIST SP 800-90A.

In 2007 a possible backdoor was discovered with Dual_EC_DRBG's design, with the design of Dual_EC_DRBG having the unusual property that it was theoretically impossible for anyone but Dual_EC_DRBG's designers (NSA) to confirm the backdoor's existence. Doubts about Dual_EC_DRBG's security and performance had also been expressed even before it was standardized. Bruce Schneier concluded shortly after standardization that the "rather obvious" backdoor (along with other deficiencies) would mean that nobody would use Dual_EC_DRBG.[2] In 2013, New York Times reported that documents "appear to confirm" that the backdoor was real, and had been deliberately inserted by the National Security Agency as part of the NSA's Bullrun decryption program. The alleged backdoor would allow NSA to decrypt for example SSL/TLS encryption which used Dual_EC_DRBG as a CSPRNG.[3] In 2004, before NIST standardized Dual_EC_DRBG, NSA paid RSA Security $10 million in a secret deal to use Dual_EC_DRBG as the default in the RSA BSAFE cryptography library, which resulted in RSA Security becoming the most important distributor of the backdoored algorithm.[4] In 2013 RSA responded to media reports to "categorically deny" any insinuation that RSA had ever knowingly colluded with the NSA to incorporate a flaw in Dual_EC_DRBG, saying "we have never kept [our] relationship [with the NSA] a secret".

Members of the ANSI standard group, to which Dual_EC_DRBG was first submitted, were aware of the exact mechanism of the potential backdoor and how to disable it,[5] but did not take sufficient steps to unconditionally disable the backdoor. The general cryptographic community was initially not aware of the potential backdoor, until of Dan Shumow and Niels Ferguson 2007 rediscovery, or of Certicom's Daniel R. L. Brown and Scott Vanstone's 2005 patent application describing the backdoor mechanism.

In September 2013, The New York Times reported that internal NSA memos leaked by Edward Snowden indicated that the NSA had worked during the standardization process to eventually become the sole editor of the Dual_EC_DRBG standard,[6] and concluded that the Dual_EC_DRBG standard did indeed contain a backdoor for the NSA.[7] As response, NIST stated that "NIST would not deliberately weaken a cryptographic standard."[8] According to the New York Times story, the NSA spends $250 million per year to insert backdoors in software and hardware as part of the Bullrun program.[9] A Presidential advisory committee subsequently set up to examine NSA's conduct recommended among other things that the US government "fully support and not undermine efforts to create encryption standards".[10]

Timeline

Time What happened
Indeterminate. Before NIST publication According to John Kelsey (who was listed as author of NIST SP 800-90A together with Elaine Barker), the possibility of the backdoor by carefully chosen P and Q values was brought up at an ANSI X9.82 meeting. As a result, a way was specified for implementers to choose their own P and Q values.[11] It turned out later that the specific subtle formulation put into the NIST standard meant that you could only get the crucial FIPS 140-2 validation of your implementation if you used the original compromised P and Q values.[12]
June 2004 A draft of ANSI X9.82, Part 3 is published, which includes Dual_EC_DRBG.[5] It is unknown if earlier drafts were published.
Sometime in 2004 RSA makes Dual_EC_DRBG the default CSPRNG in BSAFE. In 2013 Reuters reports this is a result of a secret $10 million deal with NSA.[4]
21 January 2005 Priority date of a patent application[13] by the two Certicom members of the ANSI X9.82 standardization committee. The patent describes the working of an elliptic curve CSPRNG backdoor identical to the potential backdoor in Dual_EC_DRBG, and ways to neutralize such a hidden backdoor by choosing alternative curve points and more bit truncation in the output function.[5]
Sometime 2005[14] ISO/IEC 18031:2005 is published, and includes Dual_EC_DRBG.[5]
December 2005[15] The first draft of NIST SP 800-90A is released to the public, includes Dual_EC_DRBG.[3]
16 March 2006 Kristian Gjøsteen publishes Comments on Dual-EC-DRBG/NIST SP 800-90, Draft December 2005 showing that part of Dual_EC_DRBG is "not cryptographically sound", and constructing a bit-predictor with an advantage of 0.0011, which is considered unacceptable for a CSPRNG.[3][15]
29 March 2006 Daniel R. L. Brown publishes "Conjectured Security of the ANSI-NIST Elliptic Curve RNG", concluding that "[Dual_EC_DRBG] should be a serious consideration", assuming less truncation of the curve points than is present in Dual_EC_DRBG, as shown necessary by Gjøsteen's 2006 paper. The paper also anticipates Shumow and Ferguson's 2007 announcement of a possible backdoor: "This proof makes essential use of Q being random. The reason for this is more than just to make the proof work. If Q is not random, then it may be the case the adversary knows a d such that dQ = P. Then dRi = dSi+1, so that such a distinguisher could immediately recover the secret prestates from the output. Once the distinguisher gets the prestates, it can easily distinguish the output from random. Therefore, it is generally preferable for Q to be chosen randomly, relative to P."[16]
29 May 2006 Berry Schoenmakers and Andrey Sidorenko publishes a Cryptanalysis of the Dual Elliptic Curve Pseudorandom Generator, showing that empirically the output from Dual_EC_DRBG can be distinguished from random bits, concluding that Dual_EC_DRBG is insecure as a CSPRNG. (note that this is a separate problem from the backdoor)[17]
June 2006 NIST SP 800-90A is published, includes Dual_EC_DRBG with the defects pointed out by Kristian Gjøsteen and Berry Schoenmakers and Andrey Sidorenko not having been fixed.
August 2007 Dan Shumow and Niels Ferguson gives an informal presentation pointing out that the choices giving rise to the predictability documented in the 2006 papers enabled a backdoor, with attacker chosen P and Q.[18]
15 November 2007 Bruce Schneier publishes an article with the title "Did NSA Put a Secret Backdoor in New Encryption Standard?" in Wired, based on Dan Shumow and Niels Ferguson's presentation.
6 June 2013 The first news stories (unrelated to Dual_EC_DRBG) based on Edward Snowden's leak of NSA documents are published.
5 September 2013 Existence of NSA's Bullrun program is revealed, based on the Snowden leaks. One of the purposes of Bullrun is described as being "to covertly introduce weaknesses into the encryption standards followed by hardware and software developers around the world." The New York Times states plainly that "the N.S.A. had inserted a back door into a 2006 standard adopted by N.I.S.T... called the Dual EC DRBG standard."[19]
10 September 2013 The NIST Public Affairs Office director released a statement, saying that "NIST would not deliberately weaken a cryptographic standard."[20]
19 September 2013 RSA Security advises its customers to stop using Dual_EC_DRBG in RSA Security's BSAFE toolkit and Data Protection Manager, citing NIST guidance made Sept. 12, 2013 that indicated: "NIST strongly recommends that, pending the resolution of the security concerns and the re-issuance of SP 800-90A, the Dual_EC_DRBG, as specified in the January 2012 version of SP 800-90A, no longer be used." [21] Initial media reports cast suspicion over RSA's continued use of Dual_EC_DRBG as the default in its BSAFE and Data Protection Manager products, particularly after 2007 in light of previous published concerns over the potential for a backdoor in the algorithm. RSA Chief of Technology Sam Curry writes a short justification for RSA Security's choice to use Dual_EC_DRBG as default, which is widely criticized by cryptographers, and forgets to mention the later revealed $10 million deal with NSA to use Dual_EC_DRBG.[22]
18 December 2013 A presidential advisory committee set up to examine the NSA recommended that the US government "fully support and not undermine efforts to create encryption standards"[10]
20 December 2013 Reuters reports on the existence of a $10 million deal between RSA and NSA to set Dual_EC_DRBG as the default CSPRNG in BSAFE.[4]
22 December 2013 RSA Security posts statements categorically denying that it "entered into a 'secret contract' with the NSA to incorporate a known flawed random number generator into its BSAFE encryption libraries" though its statements do not deny the existence of a $10 million deal between RSA and the NSA to set Dual_EC_DRBG as the standard in BSAFE.[23] Some news sites such as BBC summarize the press release as a direct denial of existence of the $10 million deal,[24] while other commentary point out that it is not clear what claims exactly the carefully worded RSA Security press release is denying, if any.[25][26]

Security

The stated purpose of including the Dual_EC_DRBG in NIST SP 800-90A is that its security is based on computational hardness assumptions from number theory. A mathematical security reduction proof can then prove that as long as the number theoretical problems are hard, the random number generator itself is secure. However, the makers of Dual_EC_DRBG did not publish a security reduction for Dual_EC_DRBG, and it was shown soon after the NIST draft was published that Dual_EC_DRBG was indeed not secure, because it output too many bits per round.[27][28][29] The output of too many bits (along with carefully chosen elliptic curve points P and Q) is what makes the NSA backdoor possible, because it enables the attacker to revert the truncation by brute force guessing. The output of too many bits was not corrected in the final published standard, leaving Dual_EC_DRBG both insecure and backdoored.[3]

In many other standards, constants which are meant to be arbitrary are chosen by the nothing up my sleeve number principle, where the constants are derived from for example pi in a way that leaves little room for adjustment. However, Dual_EC_DRBG did not specify how the default P and Q constants were chosen, possibly because they were constructed by NSA to be backdoored. Because the standard committee were aware of the potential for a backdoor, a way for an implementer to choose their own secure P and Q were included.[5][11] But the exact formulation in the standard was written such that use of the alleged backdoored P and Q was required for FIPS 140-2 validation, so the OpenSSL project chose to implement the backdoored P and Q, even though they were aware of the potential backdoor and would have preferred generating their own secure P and Q.[30] New York Times would later write that NSA had worked during the standardization process to eventually become the sole editor of the standard.[6]

A security proof was later published for Dual_EC_DRBG by Daniel R.L. Brown and Kristian Gjøsteen, showing that the generated elliptic curve points would be indistinguishable from uniformly random elliptic curve points, and that if less bits were output in the final output truncation, and if the two elliptic curve points P and Q were independent, and if three problems were shown to be hard (only one of which is generally accepted as being hard), then Dual_EC_DRBG is secure. The proof relied on the assumption that three problems were hard: the decisional Diffie–Hellman assumption (which is generally accepted to be hard), and two newer problems which are not generally accepted to be hard: The truncated point problem, and the x-logarithm problem.[27][28] Dual_EC_DRBG was quite slow compared to many alternative CSPRNGs (which don't have security reductions[31]), but Daniel R.L. Brown argue that the security reduction makes the slow Dual_EC_DRBG a valid alternative (assuming implementors disable the obvious backdoor).[31] Note that Daniel R.L. Brown works for Certicom, the main owner of elliptic curve cryptography patents, so there may be a conflict of interest in promoting an EC CSPRNG.

The alleged NSA backdoor would allow the attacker to determine the internal state of the random number generator from looking at the output from a single round (32 bytes); all future output of the random number generator can then easily be calculated, until the CSPRNG is reseeded with an external source of randomness. This makes for example SSL/TLS vulnerable, since the setup of a TLS connection includes the sending of a randomly generated cryptographic nonce in the clear.[3] NSA's alleged backdoor would depend on NSA knowing the single e such that e*Q=P - this is a hard problem, given Q and P, but easy to generate if you can choose P and Q.[18] So e is a secret key presumably known only by NSA, and the alleged backdoor is a kleptographic asymmetric hidden back door.[32] Matthew Green's blog post The Many Flaws of Dual_EC_DRBG has a simplified explanation of how the alleged NSA backdoor might work employing the discrete-log kleptogram introduced in Crypto 1997.[33]

Standardization and implementations

NSA first introduced Dual_EC_DRBG in the ANSI X9.82 DRBG in the early 2000s, including the same parameters which created the alleged backdoor, and Dual_EC_DRBG was published in a draft ANSI standard. Dual_EC_DRBG also exists in the ISO 18031 standard.[5]

According to John Kelsey (who together with Elaine Barker was listed as author of NIST SP 800-90A), the possibility of the backdoor by carefully chosen P and Q was brought up at an ANSI X9F1 Tool Standards and Guidelines Group meeting.[5]

At least two members of the Members of the ANSI X9F1 Tool Standards and Guidelines Group which wrote ANSI X9.82, Daniel R. L. Brown and Scott Vanstone from Certicom,[5] were aware of the exact circumstances and mechanism in which a backdoor could occur, since they filed a patent application[13] in January 2005 on exactly how to insert or prevent the backdoor in DUAL_EC_DRBG. The working of the "trap door" mentioned in the patent is identical to the one later confirmed in Dual_EC_DRBG. Brown and Vanstone's patent list two necessary conditions for the backdoor to exist

1) Chosen Q

An elliptic curve random number generator avoids escrow keys by choosing a point Q on the elliptic curve as verifiably random. Intentional use of escrow keys can provide for back up functionality. The relationship between P and Q is used as an escrow key and stored by for a security domain. The administrator logs the output of the generator to reconstruct the random number with the escrow key.

2) Small output truncation

[0041] Another alternative method for preventing a key escrow attack on the output of an ECRNG, shown in Figures 3 and 4 is to add a truncation function to ECRNG to truncate the ECRNG output to approximately half the length of a compressed elliptic curve point. Preferably, this operation is done in addition to the preferred method of Figure 1 and 2, however, it will be appreciated that it may be performed as a primary measure for preventing a key escrow attack. The benefit of truncation is that the list of R values associated with a single ECRNG output r is typically infeasible to search. For example, for a 160-bit elliptic curve group, the number of potential points R in the list is about 280, and searching the list would be about as hard as solving the discrete logarithm problem. The cost of this method is that the ECRNG is made half as efficient, because the output length is effectively halved.

According to John Kelsey, the option in the standard to choose a verifiably random Q was added as an option in response to the suspected backdoor.[11] Though in such a way that FIPS 140-2 validation could only be attained by using the possibly backdoored Q.[30] Steve Marquess (who helped implement NIST SP 800-90A for OpenSSL) speculated that this requirement to use the potentially backdoored points could be evidence of NIST complicity.[34] It is not clear why the standard did not specify the default Q in the standard as a verifyably generated nothing up my sleeve number, or why the standard did not use greater truncation, which Brown's patent said could be used as the "primary measure for preventing a key escrow attack". The small truncation was unusual compared to previous EC PRGs, which according to Matthew Green had only output 1/2 to 2/3 of the bits in the output function.[3] The low truncation was in 2006 shown by Gjøsteen to make the RNG predictable and therefore unusable as a CSPRNG, even if Q had not been chosen to contain a back door.[15] The standard says that implementations "should" use the small max_outlen provided, but gives the option of outputting a multiple of 8 less bits. Appendix C of the standard gives a loose argument that outputting less bits will make the output less uniformly distributed. Brown's 2006 security proof relies on outlen being much smaller the default max_outlen value in the standard.

The ANSI X9F1 Tool Standards and Guidelines Group which discussed the back door also included three employees from RSA Security.[5] In 2004, RSA Security made an implementation of Dual_EC_DRBG which contained the NSA backdoor the default CSPRNG in their RSA BSAFE as a result of a secret $10 million deal with NSA. In 2013, after the New York Times reported that Dual_EC_DRBG contained a backdoor by the NSA, RSA Security said they had not been aware of any backdoor when they made the deal with NSA, and told their customers to switch CSPRNG.

A draft of NIST SP 800-90A including the Dual_EC_DRBG was published in December 2005. The final NIST SP 800-90A including Dual_EC_DRBG was published in June 2006. Documents leaked by Snowden have been interpreted as suggesting that the NSA backdoored Dual_EC_DRBG, with those making the allegation citing the NSA's work during the standardization process to eventually become the sole editor of the standard.[6] The early usage of Dual_EC_DRBG by RSA Security (for which NSA was later reported to have secretly paid $10 million) was cited by the NSA as an argument for Dual_EC_DRBG's acceptance into the NIST SP 800-90A standard.[4] RSA Security subsequently cited Dual_EC_DRBG's acceptance into the NIST standard as a reason they used Dual_EC_DRBG.[35]

Daniel R. L. Brown's March 2006 paper on the security reduction of Dual_EC_DRBG mentions the need to more output truncation and randomly chosen Q, but mostly in passing, and does not mention his conclusions from his patent that these two defects in Dual_EC_DRBG together can be used as a back door. Brown writes in the conclusion: "Therefore, the ECRNG should be a serious consideration, and its high efficiency makes it suitable even for constrained environments." Note that others have criticised Dual_EC_DRBG as being extremely slow, with Bruce Schneier concluding "It's too slow for anyone to willingly use it",[2] and Matthew Green saying Dual_EC_DRBG is "Up to a thousand times slower" than the alternatives.[3] The potential for a backdoor in Dual_EC_DRBG was not widely publicised outside of internal standard group meetings. It was only after Dan Shumow and Niels Ferguson's 2007 presentation that the potential for a backdoor became widely known. Shumow and Ferguson had found the backdoor because they had been tasked with implementing Dual_EC_DRBG for Microsoft, in the course of which the possible backdoor became apparent. Bruce Schneier wrote in a 2007 Wired article that he Dual_EC_DRBG's flaws were so obvious that nobody would be use Dual_EC_DRBG: "It makes no sense as a trap door: It's public, and rather obvious. It makes no sense from an engineering perspective: It's too slow for anyone to willingly use it."[36] Schneier was apparently unaware that RSA Security's had used Dual_EC_DRBG as the default in BSAFE since 2004.

OpenSSL implemented all of NIST SP 800-90A including Dual_EC_DRBG at the request of a client. The OpenSSL developers were aware of the potential backdoor because of Shumow and Ferguson's presentation, and wanted to use the method included in the standard to choose a guarantied non-backdoored P and Q, but was told that to get FIPS 140-2 validation they would have to use the default P and Q. OpenSSL choose to implement Dual_EC_DRBG despite its dubious reputation for completeness, noting that OpenSSL tried to be complete and implements many other insecure algorithms. OpenSSL did not use Dual_EC_DRBG as the default CSPRNG, and it was discovered in 2013 that a bug made the OpenSSL implementation of Dual_EC_DRBG non-functioning, meaning that no one could have been using it.[30]

Bruce Schneier reported in December 2007 that Microsoft added Dual_EC_DRBG support to Windows Vista, though not enabled by default, and Schneier warned against the known potential back door.[37] Dual_EC_DRBG is still listed as available for Windows 8, according to msdn.microsoft.com,[38] so it was presumably also available in Windows 7.

On September 9, 2013, following the Snowden leak, and the New York Times report on the backdoor in Dual_EC_DRBG, the National Institute of Standards and Technology (NIST) ITL announced that in light of community security concerns, it was reissuing SP 800-90A as draft standard, and re-opening SP800-90B/C for public comment. NIST now "strongly recommends" against the use of Dual_EC_DRBG, as specified in the January 2012 version of SP 800-90A.[39][40] The discovery of a backdoor in a NIST standard has been a major embarrassment for the NIST.[41]

RSA Security had kept Dual_EC_DRBG as the default CSPRNG in BSAFE even after the wider cryptographic community became aware of the potential backdoor in 2007, but there does not seem to have been a general awareness of BSAFE's usage of Dual_EC_DRBG as a user option in the community. Only after widespread concern about the back door was there an effort to find software which used Dual_EC_DRBG, of which BSAFE was by far the most prominent found. After the 2013 revelations, RSA security Chief of Technology Sam Curry provided Ars Technica with a rationale for originally choosing the flawed Dual EC DRBG standard as default over the alternative random number generators.[42] The technical accuracy of the statement was widely criticized by cryptographers, including Matthew Green and Matt Blaze.[22] On December 20, 2013, it was reported by Reuters that RSA had accepted a secret payment of $10 million from the NSA to set the Dual_EC_DRBG random number generator as the default in two of its encryption products.[4][43] On December 22, 2013, RSA posted a statement to its corporate blog "categorically" denying a secret deal with the NSA to insert a "known flawed random number generator" into its BSAFE toolkit [23]

Following the New York Times story asserting that Dual_EC_DRBG contained a back door, Brown (who had applied for the backdoor patent and published the security reduction) wrote an email to an ietf mailing list defending the Dual_EC_DRBG standard process:[31]

1. Dual_EC_DRBG, as specified in NIST SP 800-90A and ANSI X9.82-3, allows an alternative choice of constants P and Q. As far as I know, the alternatives do not admit a known feasible backdoor. In my view, it is incorrect to imply that Dual_EC_DRBG always has a backdoor, though I admit a wording to qualify the affected cases may be awkward.

2. Many things are obvious in hindsight. I'm not sure if this was obvious. [...]

8. All considered, I don't see how the ANSI and NIST standards for Dual_EC_DRBG can be viewed as a subverted standard, per se. But maybe that's just because I'm biased or naive.
—Daniel Brown, 

Software and hardware which contained the possible backdoor

Implementations which used Dual_EC_DRBG would usually have gotten it via a library. At least RSA Security (BSAFE library), OpenSSL, Microsoft, and Cisco[44] has libraries which included Dual_EC_DRBG, but only BSAFE used it by default. According to the Reuters article which revealed the secret $10 million deal between RSA Security and NSA, RSA Security's BSAFE was most important distributor of the algorithm.[4] There was a flaw in OpenSSL's implementation of Dual_EC_DRBG that made it non-working outside test mode, from which OpenSSL's Steve Marquess concludes that nobody used OpenSSL's Dual_EC_DRBG implementation.[30]

A list of products which have had their CSPRNG-implementation FIPS 140-2 validated is available at http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgval.html ; The validated CSPRNGs are listed in the Description/Notes field. Note that even if Dual_EC_DRBG is listed as validated, it may not have been enabled by default. Many implementations come from a renamed copy of a library implementation.[45]

The BlackBerry software includes support for Dual_EC_DRBG. BlackBerry Ltd has however not issued an advisory to any of its customers who may have used it, because they do not consider the probably backdoor a vulnerability.[46]

Bruce Schneier has pointed out that even if not enabled by default, having a backdoored CSPRNG implemented as an option can make it easier for NSA to spy on targets:

A Trojan is really, really big. You can’t say that was a mistake. It’s a massive piece of code collecting keystrokes. But changing a bit-one to a bit-two [in the registry to change the default random number generator on the machine] is probably going to be undetected. It is a low conspiracy, highly deniable way of getting a backdoor. So there’s a benefit to getting it into the library and into the product.
—Bruce Schneier, [44]

In December 2013 a proof of concept backdoor[32] was published that uses the leaked internal state to predict subsequent random numbers, an attack viable until the next reseed.

See also

References

  1. ↑ Recommendations for Random Number Generation Using Deterministic Random Bit Generators (Revised) (PDF). National Institute of Standards and Technology. January 2012. NIST SP 800-90. 
  2. ↑ 2.0 2.1 Bruce Schneier (2007-11-15). "Did NSA Put a Secret Backdoor in New Encryption Standard?". Wired News. 
  3. ↑ 3.0 3.1 3.2 3.3 3.4 3.5 3.6 Matthew Green. "The Many Flaws of Dual_EC_DRBG". 
  4. ↑ 4.0 4.1 4.2 4.3 4.4 4.5 Menn, Joseph (December 20, 2013). "Exclusive: Secret contract tied NSA and security industry pioneer". San Francisco. Reuters. Retrieved December 20, 2013. 
  5. ↑ 5.0 5.1 5.2 5.3 5.4 5.5 5.6 5.7 5.8 http://blog.cryptographyengineering.com/2013/12/a-few-more-notes-on-nsa-random-number.html
  6. ↑ 6.0 6.1 6.2 "Revealed: how US and UK spy agencies defeat internet privacy and security". The Guardian. 
  7. ↑ Perlroth, Nicole (September 10, 2013). "Government Announces Steps to Restore Confidence on Encryption Standards". The New York Times. Retrieved September 11, 2013. 
  8. ↑ Cryptographic Standards Statement NIST 10 September 2013
  9. ↑ http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
  10. ↑ 10.0 10.1 "NSA should stop undermining encryption standards, Obama panel says". Ars Technica. 
  11. ↑ 11.0 11.1 11.2 http://cryptome.org/2013/12/800-90-dual-ec-drbg.pdf
  12. ↑ http://marc.info/?l=openssl-announce&m=138747119822324&w=2
  13. ↑ 13.0 13.1 US 2007189527, Brown, Daniel R. L. & Vanstone, Scott A., "Elliptic curve random number generation" 
  14. ↑ http://www.iso.org/iso/iso_catalogue/catalogue_ics/catalogue_detail_ics.htm?csnumber=30816
  15. ↑ 15.0 15.1 15.2 http://www.math.ntnu.no/~kristiag/drafts/dual-ec-drbg-comments.pdf
  16. ↑ Daniel R. L. Brown (2006). Conjectured Security of the ANSI-NIST Elliptic Curve RNG. 
  17. ↑ http://eprint.iacr.org/2006/190.pdf
  18. ↑ 18.0 18.1 http://rump2007.cr.yp.to/15-shumow.pdf
  19. ↑ http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html
  20. ↑ http://www.nist.gov/director/cybersecuritystatement-091013.cfm
  21. ↑ NIST, National Institute of Standards & Technology. "SUPPLEMENTAL ITL BULLETIN FOR SEPTEMBER 2013". NIST.gov. Retrieved 12 September 2013. 
  22. ↑ 22.0 22.1 Matthew Green (2013-09-20). "RSA warns developers not to use RSA products". A Few Thoughts on Cryptographic Engineering. Retrieved 2013-09-28. 
  23. ↑ 23.0 23.1 The Security Division of EMC, RSA,. "RSA Response to Media Claims Regarding NSA Relationship". RSA. Retrieved 22 December 2013. 
  24. ↑ http://www.bbc.co.uk/news/technology-25492461
  25. ↑ http://www.techdirt.com/articles/20131222/23532125671/rsas-denial-concerning-10-million-nsa-to-promote-broken-crypto-not-really-denial-all.shtml
  26. ↑ http://arstechnica.com/security/2013/12/rsa-issues-non-denying-denial-of-nsa-deal-to-favor-flawed-crypto-code/
  27. ↑ 27.0 27.1 Kristian Gjøsteen. Comments on Dual-EC-DRBG/NIST SP 800-90
  28. ↑ 28.0 28.1 Daniel R. L. Brown and Kristian Gjøsteen. A Security Analysis of the NIST SP 800-90 Elliptic Curve Random Number Generator, CRYPTO 2007, LNCS 4622, Springer, pp. 466–481. IACR ePrint version
  29. ↑ Berry Schoenmakers and Andrey Sidorenko. Cryptanalysis of the Dual Elliptic Curve Pseudorandom Generator, IACR ePrint 2006/190.
  30. ↑ 30.0 30.1 30.2 30.3 Steve Marquess. "Flaw in Dual EC DRBG (no, not that one)". OpenSSL project. 
  31. ↑ 31.0 31.1 31.2 http://www.ietf.org/mail-archive/web/cfrg/current/msg03651.html
  32. ↑ 32.0 32.1 http://blog.0xbadc0de.be/archives/155
  33. ↑ Adam L. Young, Moti Yung (1997). "The Prevalence of Kleptographic Attacks on Discrete-Log Based Cryptosystems". CRYPTO. 
  34. ↑ Steve Marquess. "Secure or Compliant, Pick One". 
  35. ↑ "We don’t enable backdoors in our crypto products, RSA tells customers". Ars Technica. 
  36. ↑ http://www.wired.com/politics/security/commentary/securitymatters/2007/11/securitymatters_1115
  37. ↑ https://www.schneier.com/blog/archives/2007/12/dual_ec_drbg_ad.html
  38. ↑ http://msdn.microsoft.com/en-us/library/aa375534.aspx
  39. ↑ http://csrc.nist.gov/publications/nistbul/itlbul2013_09_supplemental.pdf
  40. ↑ "Government Announces Steps to Restore Confidence on Encryption Standards". New York Times. 
  41. ↑ http://spectrum.ieee.org/telecom/security/can-you-trust-nist
  42. ↑ "Stop using NSA-influenced code in our products, RSA tells customers". Ars Technica. 
  43. ↑ "$10m NSA contract with security firm RSA led to encryption 'back door'". Guardian. 20 December 2013. 
  44. ↑ 44.0 44.1 http://www.wired.com/threatlevel/2013/09/nsa-backdoor/all/
  45. ↑ http://veridicalsystems.com/blog/secure-or-compliant-pick-one/
  46. ↑ http://jeffreycarr.blogspot.dk/2014/01/blackberry-ltd-nsa-and-encryption.html

External links

This article is issued from Wikipedia. The text is available under the Creative Commons Attribution/Share Alike; additional terms may apply for the media files.