Hacker News Reader

Comment by JulianMorrison | Hacker News Reader

"if it was backdoored by the NSA" - are you going to assume it will stay backdoored by only the NSA? A vulnerability is a vulnerability.

View on HN

Depends on how they do it . Dual_EC_DRBG is a secure random number generator if no one can solve the discrete log problem on a large curve. That's true w/ or without the NSA backdoor, since the NSA backdoor is just cheating and generated the curve with a known discrete log.

This, of course, doesn't make the backdoor a good idea, and back door or not, if someone does get the discrete log for the Dual_EC_DRBG constants, you are screwed.

With the known NSA backdoor in Dual_EC_DRBG then many people within the NSA must have access to the backdoor constants (even if they don't directly realise it and have access to them within an application).

If Edward Snowden was willing to give up his salary and liberty for what he thought was the moral thing to do then I think it's reasonable to assume there must be many more people within the NSA who are willing to leak secrets for money or loyalty to nation states, corporations or terrorist groups.

Some of those people will have given the Dual_EC_DRBG constants or applications that will crack cryptosystems using that PRNG to 'bad' actors.

Also, things leak by other means, eg: Son-Of-Stuxnet escapes into the wild with the constants in its penetration code.

Reply on news.ycombinator.com