News for hackers. Stuff that matters.

A comment on Secret Code Found in Juniper's Firewalls Shows Risk of Government Backdoors. Parent comment

Re:Secret Code Found in Juniper's Firewalls Shows Risk of Go... by fabulist on Saturday December 19, 2015 @01:26PM (#10764359)
"Instead of using the NIST recommended curve points [ScreenOS] uses self-generated basis points..." [0]

The way I read this statement is that each device generates its own set of points. If this is the case, I don't see how it would work as a crypto backdoor.

If by "self-generated" they mean generated by Juniper once, well, thats fishy.

[0] http://kb.juniper.net/InfoCenter/index?page=content&id=KB282...

Edited to add: Upon further research, the latter possibility seems more likely.

[ Parent | on HN ]
Re:Secret Code Found in Juniper's Firewalls Shows Risk of Go... by anologwintermut on Saturday December 19, 2015 @01:36PM (#10764394)
Instead of using the NIST recommended curve points it uses self-generated basis points and then takes the output as an input to FIPS/ANSI X.9.31 PRNG, which is the random number generator used in ScreenOS cryptographic operations."

Looks like they feed the output through a standard CPRNG. Assuming it's true, that pretty much breaks the DUAL_EC attack because you can't use the output of the final CPRNG to recover the DUAL_EC state.

[ Parent | on HN ]
Re:Secret Code Found in Juniper's Firewalls Shows Risk of Go... by tptacek on Saturday December 19, 2015 @03:57PM (#10764819)
I wonder if that's going to be demonstrated to be a true statement, and further whether the tampering Juniper discovered will have disabled that second step.
[ Parent | on HN ]
Re:Secret Code Found in Juniper's Firewalls Shows Risk of Go... by pbsd on Saturday December 19, 2015 @04:20PM (#10764902)
It seems to be a true statement: Dual EC is used to seed a X9.31 generator with 3DES, where 8 bytes are the initial seed V, and the remaining 24 are K (cf. [1]). I don't see any other usage of Dual EC other than to self-test and to seed X9.31.

Oddly, you can disable the Dual EC seeding with the flag 'one-stage-rng'. But not the other way around.

[1] http://csrc.nist.gov/groups/STM/cavp/documents/rng/931rngext...

[ Parent | on HN ]
Re:Secret Code Found in Juniper's Firewalls Shows Risk of Go... by tptacek on Saturday December 19, 2015 @07:14PM (#10765463)
Unless the backdoor disables the X9.31 stage, what's the point of tampering with the Dual EC RNG, if its outputs are going to be mangled anyways?
[ Parent | on HN ]
Re:Secret Code Found in Juniper's Firewalls Shows Risk of Go... by pbsd on Saturday December 19, 2015 @07:48PM (#10765561)
I don't know, it makes little sense to me too. Maybe there's some subtle flaw somewhere, which I haven't spotted. Since subtlety doesn't seem to be a thing with the changes we've seen so far, I'm not sure what to think.
[ Parent | on HN ]