Juniper Networks will drop code tied to National Security Agency

Re:Juniper Networks will drop code tied to National Security... by tptacek on Saturday January 09, 2016 @03:06PM (#10872653)

No, that's not how this backdoor works. If NSA didn't implant it, they don't have the private key corresponding to the parameters hardcoded into the software. That's why it's called a "NOBUS backdoor"; it's cryptographically locked to whoever implants it.

[ Parent | on HN ]

Re:Juniper Networks will drop code tied to National Security... by sandworm101 on Saturday January 09, 2016 @03:50PM (#10872821)

We don;t know that yet. This may have been the case of nsa-supported standards/devices/code being integrated without the agency being directly involved. Or it could have been a known tap put in place by someone without authority so to do. Either way, NSA may have access to things they don't even realize until they scan for whether their door has been installed.

Beyond juniper, This is a growing worry amongst open source projects.

[ Parent | on HN ]

Re:Juniper Networks will drop code tied to National Security... by tptacek on Saturday January 09, 2016 @05:09PM (#10873100)

You think Dual EC is a worry for open source projects?

Can you find any open source projects that use it? Or ever have used it?

[ Parent | on HN ]

Re:Juniper Networks will drop code tied to National Security... by sandworm101 on Saturday January 09, 2016 @06:03PM (#10873232)

Not DuelEC specifically, the concept that someone like NSA might be out there promoting open code or standards with known faults, even backdoors, in hope that they will be integrated without proper evaluation.

[ Parent | on HN ]

Re:Juniper Networks will drop code tied to National Security... by tptacek on Sunday January 10, 2016 @01:56PM (#10876578)

NSA doesn't need to do anything like this. Watch the CFRG standards process some time, or anywhere else on the IETF. They can sit back and let the standards committees do this stuff for them.

[ Parent | on HN ]