"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

Re:"OpenSSL has exploit mitigation countermeasures to make s... by jrochkind1 on Wednesday April 09, 2014 @07:59AM (#7558759)

> I would assume the NSA is interested in gaining access to systems in a way that doesn't allow basically anyone to ride on their coattails.

Don't we actually already have evidence of other cases of the NSA adding backdoors to widely used systems, exploitable by anyone aware of them? Isn't that what the elliptic curve backdoor was? http://www.wired.com/2013/09/nsa-backdoor/all/

Apparently your assumption is quite not safe to assume.

I guess the NSA either figures nobody else will notice the backdoor, or just doesn't care. I guess only they know their motivations.

[ Parent | on HN ]

Re:"OpenSSL has exploit mitigation countermeasures to make s... by caf on Wednesday April 09, 2014 @08:09AM (#7558785)

The mooted backdoor in the Dual-ECDRBG involves the possibility that the public parameters were generated based on some secret values, such that knowing the secret values allows you to break the generator.

It doesn't allow just anyone to break it - merely knowing the backdoor is there isn't enough.

[ Parent | on HN ]