Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snowden leak: Cavium networking hardware may contain NSA backdoor

twitter.com

Post reply on HN
Print view View original

471–480 of 628 posts

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#471

Post by GuB-42 »

convivialdingo wrote: post #71

Looking more closely at this, the backdoor is almost certainly based on the back-doored random number generator, Dual_EC_DRBG, which is implemented as NIST SP 800-90A. From Wiki: >>> NIST SP 800-90A ("SP" stands for "special publication") is a publication by the National Institute of Standards and Technology with the title Recommendation for Random Number Generation Using Deterministic Random Bit Generators. The publ…

Is there any proof that Dual_EC_DRBG is backdoored?

All I know is that Dual_EC_DRBG can be backdoored. And there are indeed suspicions, it was known from the start that not only Dual_EC_DRBG could be backdoored, but that it was rather weak to begin with. So, how could it be adopted as a standard?

Now it seems that everyone takes the backdoor as a given. Is there any proof? Ideally the keys themselves (that would make it undeniable), but more credibly, leaks that show usage or potential usage of the backdoor.

But what seems surprising to me about that story is that the potential for a backdoor was known even before the adoption of Dual_EC_DRBG as a standard. Any credible enemy of the state would know that and use something else, and be very suspicious of imported products using it. The ones following NIST recommendations would be allies, but why would you want allies to use weak ciphers?

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#472

Post by carbotaniuman »

GuB-42 wrote: post #471
convivialdingo wrote: post #71

Looking more closely at this, the backdoor is almost certainly based on the back-doored random number generator, Dual_EC_DRBG, which is implemented as NIST SP 800-90A. From Wiki: >>> NIST SP 800-90A ("SP" stands for "special publication") is a publication by the National Institute of Standards and Technology with the title Recommendation for Random Number Generation Using Deterministic Random Bit Generators. The publ…

Is there any proof that Dual_EC_DRBG is backdoored? All I know is that Dual_EC_DRBG can be backdoored. And there are indeed suspicions, it was known from the start that not only Dual_EC_DRBG could be backdoored, but that it was rather weak to begin with. So, how could it be adopted as a standard? Now it seems that everyone takes the backdoor as a given. Is there any proof? Ideally the keys themselves (that would make…

If you believe you are the only one who can break the cipher, then it doesn't really matter if your allies are using them - after all, spying happens even among ostensibly allied or friendly countries.

I think most people's source of proof is the Snowden leaks, but I haven't actually read it or corroborated, and most backdoors should be deniable anyway - it'd be real dumb if they weren't. I think strong circumstantial evidence is really the only thing one can go on.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#473

Post by lazide »

GuB-42 wrote: post #471
convivialdingo wrote: post #71

Looking more closely at this, the backdoor is almost certainly based on the back-doored random number generator, Dual_EC_DRBG, which is implemented as NIST SP 800-90A. From Wiki: >>> NIST SP 800-90A ("SP" stands for "special publication") is a publication by the National Institute of Standards and Technology with the title Recommendation for Random Number Generation Using Deterministic Random Bit Generators. The publ…

Is there any proof that Dual_EC_DRBG is backdoored? All I know is that Dual_EC_DRBG can be backdoored. And there are indeed suspicions, it was known from the start that not only Dual_EC_DRBG could be backdoored, but that it was rather weak to begin with. So, how could it be adopted as a standard? Now it seems that everyone takes the backdoor as a given. Is there any proof? Ideally the keys themselves (that would make…

It has constants chosen with NSA input which weaken it - and which were called out a long time ago as doing so.

It isn’t a back door in the sense of ‘poke the code in a certain way and voila’, rather ‘if you know the counterpart to this constant, you can guess what values the RNG spits out at statistically improbable rates’.

You’d never know if someone was doing so unless they admitted it or someone got arrested in a way that was only possible if they’d used it. Which good luck.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#474

Post by lazide »

pyinstallwoes wrote: post #456
DyslexicAtheist wrote: post #443

Earlier quoted context omitted.

wouldnt such a backdoor invalidate all promises made by external audits e.g. https://cloud.google.com/security/compliance/offerings and more importantly wouldn't it violate safe harbor agreement with the EU or whatever sham this safe-harbor was replaced with?

I mean, if you can detect it.

And you’re allowed to notice it without dudes in suits And dark sunglasses convincing you it’s a bad idea to do so.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#475

Post by lazide »

amluto wrote: post #458
jhallenworld wrote: post #424

Earlier quoted context omitted.

The IBM one for z was level 4 I think.. Yes: https://www.ibm.com/docs/en/cryptocards?topic=4768-overview

This is so weird. The idea of an adversary covertly walking off with an IBM Mainframe or covertly bringing an electronics lab, a microscope, logic analyzers, glitching hardware, etc to the aforementioned mainframe is rather strange. Whereas someone doing that to a phone or a laptop or a game console is very likely. If I wanted to store an important long term key in a secure facility, I would worry, first and foremost…

Evil maid attack applies to data centers too doesn’t it?

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#476

Post by 0xDEAFBEAD »

jdblair wrote: post #359
jdblair wrote: post #354

Help me out here: if my network hardware is compromised, but all of my communication is encrypted, that leaves… traffic analysis? hoovering up the data and storing it to decrypt in the future when it becomes feasible? using the router as a foothold to attack the rest of my network? The first two are already happening for data that leaves my LAN. Unencrypted data on my LAN is vulnerable, and there is plenty of unencry…

still thinking… if the three-letter-agency has compromised the random number generator, then that means all traffic encrypted by the router may be easier to crack. What data is encrypted on the router? VPNs, for one. So a VPN, and all the plaintext traffic sent over it, could be made vulnerable.

>What data is encrypted on the router? VPNs, for one.

What sort of VPN are we talking about?

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#477

Post by lmm »

Obscurity4340 wrote: post #249
PeterStuer wrote: post #244

Earlier quoted context omitted.

Addendum: if your threat model includes any nation state that has significant ties to the nation state that hosts your physical or transit infrastructure, you're hosed.

How might this apply or what are the implications of Signal given its US jurisdiction?

The US authorities can make the same orders that they made with LavaBit (i.e. ordering them to produce a backdoored build and replace yours with it), and they can make them secretly. Given that Signal by design requires you to use it with auto-update enabled (and, notably, goes to some effort to take down ways of using it without auto-update), and has no real verification of those auto-updated builds, I would consider it foolish to rely on the secrecy of Signal if your threat model includes the US authorities or anyone who might be able to call in a favour with them.

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#478

Post by jiggawatts »

GuB-42 wrote: post #471
convivialdingo wrote: post #71

Looking more closely at this, the backdoor is almost certainly based on the back-doored random number generator, Dual_EC_DRBG, which is implemented as NIST SP 800-90A. From Wiki: >>> NIST SP 800-90A ("SP" stands for "special publication") is a publication by the National Institute of Standards and Technology with the title Recommendation for Random Number Generation Using Deterministic Random Bit Generators. The publ…

Is there any proof that Dual_EC_DRBG is backdoored? All I know is that Dual_EC_DRBG can be backdoored. And there are indeed suspicions, it was known from the start that not only Dual_EC_DRBG could be backdoored, but that it was rather weak to begin with. So, how could it be adopted as a standard? Now it seems that everyone takes the backdoor as a given. Is there any proof? Ideally the keys themselves (that would make…

> Is there any proof that Dual_EC_DRBG is backdoored?

The algorithm is bad: it's complicated and slow.

The competing algorithms were much simpler, much more secure by construction, and much faster. Most importantly, there was no obvious way to backdoor the competing algorithms, but there's a hilariously trivial way to backdoor Dual_EC_DRBG.

Ergo: the only reason you would ever devise or use Dual_EC_DRBG is to introduce a backdoor capability. There is no other believable benefit or reason.

But rest assured, the NSA promised that they destroyed all copies of the private key they used to generate the public key for Dual_EC_DRBG.

Oh wait, you thought you could generate your own pair and throw away the private key? Ha-ha... haaa. No. That's not compliant with the "standard", which the NSA forced upon the industry, and/or literally bribed companies with millions of dollars to accept willingly.

It's as obvious a backdoor as you could possibly have.

Even if the NSA didn't use it as a backdoor -- I'm crying with laughter now -- the Chinese hacking group APT5 definitely did: https://blog.cryptographyengineering.com/2015/12/22/on-junip...

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#479

Post by [deleted] »

GuB-42 wrote: post #471
convivialdingo wrote: post #71

Looking more closely at this, the backdoor is almost certainly based on the back-doored random number generator, Dual_EC_DRBG, which is implemented as NIST SP 800-90A. From Wiki: >>> NIST SP 800-90A ("SP" stands for "special publication") is a publication by the National Institute of Standards and Technology with the title Recommendation for Random Number Generation Using Deterministic Random Bit Generators. The publ…

Is there any proof that Dual_EC_DRBG is backdoored? All I know is that Dual_EC_DRBG can be backdoored. And there are indeed suspicions, it was known from the start that not only Dual_EC_DRBG could be backdoored, but that it was rather weak to begin with. So, how could it be adopted as a standard? Now it seems that everyone takes the backdoor as a given. Is there any proof? Ideally the keys themselves (that would make…

[deleted]

Re: Snowden leak: Cavium networking hardware may contain NSA backdoor

#480

Post by 0xDEAFBEAD »

ZoomerCretin wrote: post #224

I'm looking forward to someone explaining to me why Chinese telecom equipment should continue to be off limits. Is the problem that we are afraid of possible Chinese backdoors, or that Chinese telecom equipment isn't backdoored by the NSA? An interesting question I'd like answered: Are the TPM 2.0 modules that Microsoft is requiring for Windows 11 installs similarly backdoored? https://www.theverge.com/2013/6/6/44038…

>We've known (or have assumed to know) for years that CPUs produced by AMD, Intel, and Apple have backdoors.

What's the evidence for this?

>Obviously we have to assume that these are all backdoored as well, but that shouldn't matter as my activities don't likely won't make me a target of the PRC.

Elsewhere in this thread it was claimed that the NSA has hacked Huawei. The NSA could have stolen the backdoors then, or it could've analyzed e.g. Huawei's hardware independently.

Post reply on HN