Lifting the Shadows of the NSA’s Equation Group

Re:Lifting the Shadows of the NSA’s Equation Group by rdtsc on Tuesday August 16, 2016 @12:38AM (#12295569)

It is entertaining to read NSA's recommendations on how US govt should secure its data. Because you always wonder if they'd know of a vulnerability if they'd still advise using that technology. That is, if that department which writes the guide talks to the department that does the exploits.

I imagine due to heavy and intentional compartmentalization this doesn't happen.

Perhaps it depends on the nature of the exploit. For example, I consider the weakening of Dual_EC_DRBG devilishly good: because of the chosen P and Q they knew it was weak but also were the only ones who had the key. They would definitely not tell anyone about that.

[ Parent | on HN ]

Re:Lifting the Shadows of the NSA’s Equation Group by nickpsecurity on Tuesday August 16, 2016 @12:25PM (#12298498)

I imagine due to heavy and intentional compartmentalization this doesn't happen"

That seems to be best explanation. Two different groups with IAD being smaller one. The IAD also faces many issues with regs, red tape, Congessional mandate to use COTS garbage, lack of liability enforcement, etc. It all adds up to them getting less effective over time.

They still do some good stuff when they put their pros on it. Their Inline Media Encryptor is great. I just cloned it and expanded in one of my designs. Just compare its security features to any encrypted USB disk. You'll see high-security vs mainstream security difference.

[ Parent | on HN ]