Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Strange Story of Dual_EC_DRBG – suspected NSA backdoor (2007)

schneier.com

Post reply on HN
Print view View original

71–78 of 78 posts

Re: The Strange Story of Dual_EC_DRBG – suspected NSA backdoor (2007)

#71

Post by enoch_r »

malandrew wrote: post #70
contingencies wrote: post #43

Earlier quoted context omitted.

Err, I think you'll find what you described is roughly the definition of a PRNG (though usually more mathematical in its verbiage). The problem is, we don't trust any particular PRNG. My question was, why not combine them so as to remove the need for absolute trust in any given PRNG.

I really need to get up to speed on cryptography. I've been a software developer for a while but haven't had a chance to get into it. Part of the reason is time, the other reason is that I haven't a clue where to start. I've heard about the books Security Engineering and Cryptography Engineering. Are they good books for someone new to all this?

I'd recommend the Coursera crypto course: https://www.coursera.org/course/crypto

Re: The Strange Story of Dual_EC_DRBG – suspected NSA backdoor (2007)

#72

Post by malkia »

malandrew wrote: post #3

Out of curiosity, why can't we just use a series of sensors on the computer to generate random numbers? Between mouse movements, touch inputs, video camera input, microphone movements, the behavior of applications in your system and how they use resources like RAM, CPU, hard-disk, listening to all the wifi + bluetooth signals around you and munging them, etc. I would imagine that there is enough entropy coming in thr…

Lava Lamp and camera?

Re: The Strange Story of Dual_EC_DRBG – suspected NSA backdoor (2007)

#73

Post by Jach »

malandrew wrote: post #3

Out of curiosity, why can't we just use a series of sensors on the computer to generate random numbers? Between mouse movements, touch inputs, video camera input, microphone movements, the behavior of applications in your system and how they use resources like RAM, CPU, hard-disk, listening to all the wifi + bluetooth signals around you and munging them, etc. I would imagine that there is enough entropy coming in thr…

If you've got time for a network call, there's http://www.fourmilab.ch/hotbits/ (There's another lab somewhere measuring quantum fluctuations in a vacuum that I think also provides access to random numbers. Edit: Here it is: http://qrng.anu.edu.au/index.php)

Re: The Strange Story of Dual_EC_DRBG – suspected NSA backdoor (2007)

#74

Post by contingencies »

cdumler wrote: post #69
contingencies wrote: post #42

Earlier quoted context omitted.

shouldn't be a need to do anything like what you're suggesting, ever, with a valid PRNG OK, but the point was that if we approach PRNGs like any other element of a secure system, ie. without trust, as the article was suggesting, then combining them in some way may assist with QA on the overall output. (Example: I mean, we don't trust the NSA - but do we trust Schneier? He could be paid handsomely by the NSA as a fals…

The difference is between a PRNG and encryption. Encryption's design is to obscure the data stream; thus, if there is a failure in an encryption it is masked by another encryption. Personally, I do not think this is a particularly useful activity. Public vetted encryption rarely spontaneously falls over. A modern encryption, like AES256, is well beyond the far future in computing requirements to brute force. It's bet…

The similarity was drawn to hashing algorithms (which function to produce a message digest or checksum given a message as input), not to cipher algorithms (which perform encryption to ciphertext given one or more keys and a plaintext as input).

A lot of people have responded suggesting there is no way to combine PRNGs to offset the risk of a single PRNG's potential compromise, however I have not seen any citations to this effect and it does really make logical sense to me. Arguments tend to fall back to table-thumping on mathematical proofs, which is a demonstrably naieve way of building a secure system if, for example, your mathematical process, computational platform or side-channel security assumptions are outmoded by an attacker.

Re: The Strange Story of Dual_EC_DRBG – suspected NSA backdoor (2007)

#75

Post by contingencies »

contingencies wrote: post #11

I'm no mathematician, so this is probably a dumb question that will serve as a great example for why random programmers shouldn't write cryptosystems. However, here goes anyway. Could a cryptographer please explain why it's not feasible to use multiple such PRNG algorithms in both series and parallel, perhaps even shuffling their order dynamically, at, err, random? Surely most attacks on PRNGs are based upon the assu…

After a beer last night, feeling unimpressed by the rest of the respones here, I wound up the courage to email the ninja himself - http://www.schneierfacts.com/

His answer, of course, is both simple and perceptive... somehow we all missed it. Cheers, Bruce!

Of course it's feasible.

The question is never about how to add a whole bunch of rounds, or multiple ciphers, to make something secure. The question is always security for a given unit of performance.

With no performance constraints, just use any old thing for a thousand rounds.

Re: The Strange Story of Dual_EC_DRBG – suspected NSA backdoor (2007)

#76

Post by comex »

efm wrote: post #27

The ANU Quantum Random Number generator http://qrng.anu.edu.au/ can be used as a source of additional randomness for your server's pseudo RNG, or directly. They monitor quantum fluctuation of a vacuum to generate the random numbers at a high rate.

Note that if you have the option, it's almost certainly better to get a new Intel processor that supports rdrand (not quantum, but still true hardware random) than to trust some university's server. Interesting, though.

Re: The Strange Story of Dual_EC_DRBG – suspected NSA backdoor (2007)

#77

Post by comex »

Myrmornis wrote: post #33

OK I have a probably naive/nonsensical cryptography question. It seems that one good way of transmitting a secret would be to do so with everyone thinking it is encrypted one way (or possibly believing it has not been encrypted) when the truth is it has been encrypted some other way. I.e. it would be a difficult problem to know when the message has truly been decrypted. So basically there would be multiple decrypted…

TrueCrypt does something like this by hiding encrypted data within random bytes that are supposed to be free space.

In cases where the key does not need to be memorized, a simple XOR cipher provides the property that you can create a "key" for any ciphertext and desired message.

Re: The Strange Story of Dual_EC_DRBG – suspected NSA backdoor (2007)

#78

Post by brokentone »

Can anyone confirm that 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0 is not the the backdoor sequence?

Seriously though, have we the people figured out this sequence yet? If there is a base sequence, and a relationship to a second sequence, I feel like this can't be too difficult to figure out mathematically, or through brute force means. Can someone who actually knows what they're talking about properly rebut me?

Post reply on HN