Hacker News Reader

Comment by flyryan | Hacker News Reader

"I did not break the official algorithm. I do not know the secret value used to compute the Q constant, and thus cannot break the default implementation. Only NSA (and people with access to the key) can exploit the PRNG weakness."

I found this note interesting. How big is the secret value used to compute the Q constant? Is it a single static value or does it vary? Would it be possible to brute force this? I'm not a crypto expert and want to understand this a bit better.

One of the big arguments about the NSA introducing weaknesses into these algorithms is "this makes them insecure for everyone and flaws exploited by the government could be exploited by anyone", but this makes it sound like ONLY the NSA could exploit this.

I'm not saying this is better. I just think, if true, it's an interesting discussion point in the debate.

[Cross-posted and answered at /r/netsec]: http://www.reddit.com/r/netsec/comments/1u5jvw/dual_ec_drbg_...

View on HN

> but this makes it sound like ONLY the NSA could exploit this.

Exactly right, and that's why NSA can still claim with a straight face that they were not trying to go around breaking crypto in a generic fashion. Like Clipper and Lotus Notes's initial crypto support, NSA was trying to make the crypto safe against everyone but NSA.

Now this is one area where I disagree totally with NSA's actions, but it is true that the way they went about weakening Dual EC DRGB is more nuanced than simply inserting a secret backdoor that anyone could exploit.

Right. I think the big issue is that we are one NSA key leak away from breaking every product that uses this type of encryption. It introduces a single point of failure.

Can't you say the same thing about SSL keys? One leak away and every gmail account can be MITM'd.

SSL certificates can be revoked.

and the Dual_EC_DRBG specs allow for the user to supply their own values for P and Q (much like the author did). NSA only provides the default.

TLS provides forward secrecy though, so leaking the SSL keys doesn't mean anything for those exabytes of recorded transactions the NSA is presumably saving for a rainy day. If the secret keys for the default Dual_EC_DRBG configuration are leaked, aren't there more serious implications?

Yes, the comparison was faulty.

Dual_EC_DRBG is a pseudo random number generator, so if it's compromised you could use the internal state to recreate the sequence of pseudo random digits from that point forward. SSL/TLS is protocol which incorporates a suite of algorithms for authentication, key exchange and encryption. So on that level, like the sibling comment mentions, they aren't really comparable. The part of the SSL/TLS protocol that really depends on the certificate is the authentication, though - Diffie Helmann can be done in the clear without compromising its security, and once you've established the key any algorithm can be used to encrypt. When you revoke a certificate, you're essentially saying that you suspect someone else may be able impersonate you on the internet, so don't trust anyone authenticating with it. The algorithm is secure, but the certificate is not.

The point I was trying to make is that if you suspect someone has compromised your certificate, you can revoke it to reestablish secure communications. If you suspect your random number generator has been compromised, you can likewise just change the configuration (assuming it's not hardcoded into some piece of cryptographic equipment).

> I'm not saying this is better.

Introducing weaknesses which adversaries can exploit versus ones which they cannot? It is much better.

Reply on news.ycombinator.com