News for hackers. Stuff that matters.
Re:This shouldn't have happened: A vulnerability postmortem by ajxs on Wednesday December 01, 2021 @08:35PM (#29411476)
Can you provide more information on this? I'd be interested to read about this topic.
Re:This shouldn't have happened: A vulnerability postmortem by astrange on Thursday December 02, 2021 @12:23AM (#29412827)
He's confused it with Dual_EC_DRBG, a backdoored random number generator in a different non-international standard.

SSL is complicated because we didn't understand how to design secure protocols in the 90s. Didn't need help.

Re:This shouldn't have happened: A vulnerability postmortem by hedora on Saturday December 04, 2021 @12:22PM (#29442369)
No; this predated that by about a decade. They had moles on the committees that codified SSL in the 90’s. Those moles added a bunch of extensions specifically to increase the likelihood of implementation bugs in the handshake.

I’m reasonably sure it was covered in cryptogram a few decades ago. These days, it’s not really discoverable via internet search, since the EC thing drowned it out.

Edit: Here’s the top secret budget for the program from 2013. It alludes to ensuring 4G implementations are exploitable, and to some other project that was adding exploits to something, but ramping down. This is more than a decade after the SSL standards sabotage campaign that was eventually uncovered:

http://s3.documentcloud.org/documents/784159/sigintenabling-...

With SSL, the moles kept vetoing attempts to simplify the spec, and also kept adding complications, citing secret knowledge. It sounds like they did the same thing to 4G.

Note the headcount numbers: Over 100 moles, spanning multiple industries.