Re:Patch Critical Cryptographic Vulnerability in Microsoft W...
by andromeduck on Tuesday January 14, 2020 @04:54PM
(#22049631)
It was Dual EC DRBG, a prng
Re:Patch Critical Cryptographic Vulnerability in Microsoft W...
by mzs on Tuesday January 14, 2020 @04:46PM
(#22049563)
There is no evidence that US push flawed curves.
Re:Patch Critical Cryptographic Vulnerability in Microsoft W...
by alasdair_ on Tuesday January 14, 2020 @06:08PM
(#22050184)
>There is no evidence that US push flawed curves.
"Reuters reported in December that the NSA had paid RSA $10 million to make a now-discredited cryptography system the default in software used by a wide range of Internet and computer security programs. The system, called Dual Elliptic Curve, was a random number generator, but it had a deliberate flaw - or “back door” - that allowed the NSA to crack the encryption."
https://www.reuters.com/article/us-usa-security-nsa-rsa/excl...
Re:Patch Critical Cryptographic Vulnerability in Microsoft W...
by tptacek on Tuesday January 14, 2020 @06:31PM
(#22050323)
"Dual Elliptic Curve" is an RNG, a PKRNG, that works by using a public key to encrypt its state, which is then directly revealed (as public key ciphertext) to callers (for instance: in the TLS random blob). The problem with PKRNGs has nothing to do with elliptic curves; you could design one with RSA as well. The problem is that for a given public key, there's also a private key, and if you have that private key you can "decrypt" the random value to reveal the RNG's state.
That's not a flawed curve that NSA pushed; it's a much more straightforward cryptographic backdoor.
Could be the knew about it for a while and had milked it hard until they caught someone else using it. Or like the parent said, previously discovered flaws meant that someone might catch this one, too.