Hacker News Reader

Comment by anonymouz | Hacker News Reader

This is quite interesting, as the NSA on the one hand needs to provide secure algorithms for the public to use, but on the other hand has an interest in being able to break algorithms.

IIRC, during the standarization of DES, the NSA has also modified some S-Boxes without giving any explanation. Only later, when differential cryptoanalysis became known to the public, it was clear that this was to strengthen DES against this particular attack (which was already known to the NSA).

The case here is more interesting though: It seems like you need to know some secret numbers (a sort of "private key" if you will) to be able to attack the PRNG. So it seems that the NSA could place a "safe" backdoor that even an attacker with the same cryptography knowledge as they have cannot break unless he himself possesses the "private key".

View on HN

What sense does it make to backdoor an RNG that no normal system is ever going to use, and to do so in a public standard, and further to do so by using deliberately broken curve parameters?

It was an interesting story because it was so weird. But even had Dual EC not become known to the world exclusively as "the CSPRNG with the backdoor in it", nobody would have used it anyways.

As a teaching moment? I've been told a story about a group of embassy staffers (state department, not the other kind) that were in the habit of being rather loose with sensitive conversations over the local telephones. This was during the cold war when secure conversations often meant driving into the office to speak face to face, which could understandably make weekend news rather unwelcome. This apparently made some folks on station rather unhappy, but repeated admonishment fell on deaf ears. The reported solution was to remove a tiny bit of insulation from several of the phone wires as they entered the building on the roof. This lead to a very occasional clicking on the lines as wind would move the wires and cause a momentary short which blossomed into a newfound respect among the corps for communication protocol.

Most people learn much better by doing (or getting done).

I agree it was interesting because it was weird. One wonders if the NSA might put things out like this to test the analysis ability of the 'open' community? I wonder if there is ever the question inside the Fort like "Well we can do this, but how obvious is it to people outside our group?" Testing that question isn't easy, but answering it is important for knowing the size of the threat posed by an equivalent type vulnerability.

Since many of these procedures are implemented in hardware directly, maybe it could be utilized as a conditional fall-back? An example might be a MITM attack that indicates an invalid hand shake or shows that an insufficient random pool is detected so it would attempt to connect using each alternative in order till it gets to the weak link. Technically speaking this would be ideal since the government and ISP's that carry these messages are so intertwined that the breadth would cover every citizen in their own country and likely many others.

Yeah that is rather weird. A botched attempt maybe?

No.

Reply on news.ycombinator.com