News for hackers. Stuff that matters.
Re:NIST reopens draft recommendation on random number genera... by rdtsc on Wednesday September 11, 2013 @01:50AM (#6365754)
Yes but whenever NSA "suggests" changes such as certain constants or like classic S-boxes from DES. Those don't usually come with a clear explanation, more like "here makes these change, it will be better, trust us" kind of idea.

Another point is that most people (especially non-US citizens) don't necessarily view NSA and NIST as separate. They are seen as part of the same government. More like 2 offices in the same government department.

Now this also brings about an interesting thing I have been thinking about. NSA is also in charge of protecting its own data. So recommendations, practices and policies they tweak go into keeping its (and other agencies') classified data secure.

Given that they have managed to "tweak" and insert backdoors in some algorithms or systems, how likely they are to recommend those systems for its own and other government agency use? Do they want the communication or keys to the nuclear launch sites to use the "tweaked" version. They would need to have an pretty good feel that no other agency out there has also figured out the back door.

Re:NIST reopens draft recommendation on random number genera... by lambda on Wednesday September 11, 2013 @09:31AM (#6366998)
That's why the generally design the backdoor so that it's based on a key that only they have.

For example, with Dual EC DRBG, researchers discovered that it would be possible to create the constants based on another constant, with which you could predict the output easily. But without prior knowledge of that constant, it would be an infeasible brute-force search to find it.

Likewise, previous publicly known backdoors like the one in the export version of Lotus Notes depended on a key that the NSA had. There it was even simpler, and not obfuscated; it would just encrypt a portion of the session key with the NSA's public key, which they could decrypt and the easily brute-force the rest of the session key.[1]

The NSA doesn't want to make security weak against arbitrary attackers, they just want to give themselves the keys.

[1]: http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html

Re:NIST reopens draft recommendation on random number genera... by rdtsc on Wednesday September 11, 2013 @01:55PM (#6368735)
Ah, it makes sense now. Thank you for explaining it.
Re:NIST reopens draft recommendation on random number genera... by tptacek on Wednesday September 11, 2013 @10:26AM (#6367322)
And in the DES s-box case, you'd have been right to trust them, because they fixed a vulnerability in DES 20 years before the theory behind it would become public. They couldn't disclose the reasoning behind the new s-boxes without disclosing differential cryptanalysis, because they generated the new s-boxes by first generating random candidates and then testing them for resilience against differential cryptanalysis.
Re:NIST reopens draft recommendation on random number genera... by rdtsc on Wednesday September 11, 2013 @12:31PM (#6368174)
True and that is the problem they are facing. Before when they came in and said "trust us it is better" NIST and everyone would say "yup we trust you". Now it has switched to "no way, you are just building in a backdoor". That is the sad part.