61–70 of 81 posts
It irks me that many people are calling this a backdoor. It's not. It's a vulnerability. You have to exploit it to get in.
An intentionally introduced vulnerability can be considered a backdoor, even if it's not a matter of saying "open sesame" to open the so-called backdoor.
Earlier quoted context omitted.
"The length of time that Dual_EC_DRBG takes can be seen as a virtue: it also slows down an attacker trying to guess the seed." If a system's seed is weak, one attack is to try all likely seeds, run them through the PRNG to generate keys, and see if any of the keys work. A slow PRNG indeed slows down this process. For instance, it would have slowed down the attack on the Taiwan Cryptocards, which exploited patterns in…
No, it wouldn't have slowed the attack on the Taiwan Cryptocards one bit. That and the related "Mining Your P's and Q's" research involved deriving the private keys from the public keys using bulk factorization. They did not need to simulate the operation of the poorly-seeded PRNG that generated them.
Earlier quoted context omitted.
An interesting data point from the boilerplate about the RSA in a press release [1]: "With approximately a billion RSA BSAFE-enabled applications in use worldwide, more than nine million RSA SecurID authentication users and almost 20 years of industry experience, RSA Security has the proven leadership and innovative technology to address the changing security needs of e-business and bring trust to the new, online eco…
Let me just say that when my brain tries to survey the landscape for products that use crypto, it mentally discounts all the SecurID tokens; it doesn't occur to me to think about the RSA in-house products that use BSAFE. So yes, there's another group of deployed products that use commercial crypto libraries, because they're sold by a company that also owns a commercial crypto library. My reasoning about this mostly c…
--
First off, my comment wasn't out of spite or anything. I would call it a friendly jab. I'm guilty of reaching temporary frustration in some previous discussions with you over civil liberties and privacy, which may have colored a few comments, but I totally respect you and don't generally disagree with you on technical matters. I'm not even going to pretend I have a leg up on you anywhere related to security. I'm sure when the day comes that there is an obscure subtopic of security for which this is the case, it will quickly become known though! (The civil liberties issues are another story, because your opinion is in fact wrong on all issues related to civil liberties, along with seemingly everybody in your "must read" list. Yes, that's a joke. Kind of.)
> Nobody does use it. How important a product do you think this is? Isn't it basically a commercial packaging of rsaref?
> Name a piece of crypto technology that you or, say, Moxie Marlinspike or, I don't know, Jacob Appelbaum relies on that uses Dual_EC.
I don't know who uses it, but that's kind of the point. I don't think anyone can really have a good idea of who uses it or who ships it as a default, we can just know who doesn't. It's in the standard, so my assumption is that it's not unlikely that someone chose it, perhaps in a proprietary implementation in corners of the internet that are not the most obvious. The fact that RSA sell it strongly reinforces my suspicion that it's in more places than you think.
> What's frustrating are the people who insist on taking the wrong message away from what I'm saying. I'm not defending Dual_EC. I imagine that I have the exact same perspective on it that Matthew Green does.
I don't think anyone thinks you're defending it (I certainly don't), just that you think that it's not a concern worthy of paying attention to. On the other hand, Matthew Green seems rather disturbed by the recent revelations. The interest in this topic involves more than a specific backdoor that got into a widespread implementation and who isn't likely affected by that particular instance.
> Also: how was this comment helpful? Yours will obviously be the top comment on this thread, and it's basically about, what are the implications of this blog post on the 'tptacek HN persona?" Is that all you have to talk about?
Yes, that was all I had to talk about. It was just a casual comment, and I didn't intend nor expect it to be the top. But I did have a point:
You are the most well-known commenter around here. and everybody looks to you for crypto and security expertise. Sometimes you get rather adamant about whichever position you adopt, which might mix opinion in with fact from time to time. You know what you're talking about dan you're usually right. However, forces that govern our universe guarantee that if one makes bold and authoritative claims on the internet that turn out to be less than correct, the strength of the claim and the number of times it is repeated are proportional to the promptness with which someone else will present something to challenge the claim. (Edit: I wrote this before noticing all of the top comments in this thread came to say the same thing. Come on, you have to chuckle...) I know you understand this because you do it all the time :P Do you want to hear about my 100% undetectable rootkit?
Anyway, I just disagreed with your dismissive comments on other threads as though it's nothing that we need to discuss. I get why one of your missions is to be the Outrage Police, but I think you're overzealous about it from time to time. I know, I'm sure I'm overzealous with my pitchfork as well...
> How many threads have you and I managed to find something to argue about in information security and privacy? How many times have I top-commented a thread about you? I don't because wow, is that ever boring.
I'm not really sure why you're making it personal. For one thing, I'm not important enough to get a top comment about in a thread I haven't yet posted in ;) I don't think I have a habit of dominating those discussions, nor do I think I have enough credibility to do. It probably has more to do with that than being boring. But why do your questions take for granted that your commenting habits are the benchmark for appropriate behavior? Is that not just a tad arrogant?
> Later edit: BSAFE is apparently used in some way by some popular consumer electronics products that I've never taken a close look at, so I was wrong about that. My point about the pervasiveness (or lack thereof) of Dual_EC stands.
Earlier quoted context omitted.
Then feel free to question Schneier's chops: http://www.wired.com/politics/security/commentary/securityma... Edit: this was in response to the deleted comment
I'll take you up on that. Here's Schneier on ECC: https://www.schneier.com/crypto-gram-9911.html#EllipticCurve... He wrote this in 1999; ECC was at the time sort of a novelty, it's headline being "a way to do cryptography with smaller key sizes", as if ECC was mostly a way to fit crypto into smaller memory software. Schneier and Ferguson wrote _Practical Cryptography_ in 2003. It has virtually no mention whatsoever o…
It's been almost 15 years since then. No new classes of weak curves were discovered since then (the last one was anomalous curves, around 1998), nor advances towards a general notion of smoothness in the general setting §, despite intense study. It seems unlikely that Solinas would have been able to, in 1999, slip a weak curve past everyone for so long, given the attention the problem has gotten in the last decade. All in all, I think Schneier may be doing more harm than good with those recent ECC comments.
§ Summation polynomial-based approaches are the exception, but they are not general. They only work over extension fields, including binary fields, and are mostly impractical attacks.
Earlier quoted context omitted.
No, it wouldn't have slowed the attack on the Taiwan Cryptocards one bit. That and the related "Mining Your P's and Q's" research involved deriving the private keys from the public keys using bulk factorization. They did not need to simulate the operation of the poorly-seeded PRNG that generated them.
They got the first 103 keys with batch GCD. After that, they found many more keys by looking at patterns in the keys and doing trial division by keys that were similar to the patterns. A better PRNG would make that harder (to reverse-engineer the patterns in the seed) and a slower PRNG makes it slower.
Earlier quoted context omitted.
This was actually going to be the first thing I posted when I read this link. tptacek repeatedly assured everyone that this was absolutely not a big deal and meant nothing because nobody in their right mind uses the standard. Except whoops, one of, if not the, largest players in the field. I'm sure he'll have a bunch of really great replies that manage to simultaneously say why this still isn't a big deal and passive…
tptacek repeatedly assured everyone that this was absolutely not a big deal and meant nothing because nobody in their right mind uses the standard. He was right. Nobody in their right mind does use Dual_EC_DRBG. From this episode I conclude that RSA Security LLC was not in their right mind.
Edit: Actually, I take that back. I have no problem believing that RSA Security are perfectly sane. Would we be completely shocked if the reason they chose a questionable default was due to coercion from the spooks? Only NSA has the keys, so it's a pretty safe backdoor.
You know, props to China, had to go through the work of owning RSA's seed server last year just to level the playing field. They get so derided in the media for doing that, but it seems unfair when the other team has a backdoor. Who is the real "Advanced Persistent Threat"?
Earlier quoted context omitted.
tptacek repeatedly assured everyone that this was absolutely not a big deal and meant nothing because nobody in their right mind uses the standard. He was right. Nobody in their right mind does use Dual_EC_DRBG. From this episode I conclude that RSA Security LLC was not in their right mind.
To be fair, the insanity of anyone using it was never called into question. We agree it shouldn't be used. As we all know, science has yet to establish any correlation between sanity and what companies are actually doing in the real world for security. Edit: Actually, I take that back. I have no problem believing that RSA Security are perfectly sane. Would we be completely shocked if the reason they chose a questiona…
The problems with it were known days after the standard was published.. meaning anyone who implemented was well aware of its problems.
Edit: actually, the first attack was in march 06 -- 3 months before the standard was published: http://www.math.ntnu.no/~kristiag/drafts/dual-ec-drbg-commen...
Earlier quoted context omitted.
You seem to have already addressed it in another comment: >Thanks for the link. I would have just gone on confirming my own biases without it. This is incredibly evident in your comments on Dual_EC and sometimes happens on other comments as well. You draw a line in the sand and argue around it constantly, eventually bleeding into passive-aggressive attacks on the knowledge of others. I find it valuable to hear from o…
How about this: why don't you tell me what you think my "line in the sand" is? I bet I don't have that line at all. I have a different explanation for why I always seem to be at odds with people on NSA topics, but I'll wait to provide it.
I'm very interested in that actually. I'm often curious what shapes people's perspectives on these issues, particularly if it doesn't align with any obvious incentives. I always thought that you must have family in law enforcement or something, but I'd love to know the actual reason.
Earlier quoted context omitted.
To be fair, the insanity of anyone using it was never called into question. We agree it shouldn't be used. As we all know, science has yet to establish any correlation between sanity and what companies are actually doing in the real world for security. Edit: Actually, I take that back. I have no problem believing that RSA Security are perfectly sane. Would we be completely shocked if the reason they chose a questiona…
I'll call into question the sanity of anyone using it. The problems with it were known days after the standard was published.. meaning anyone who implemented was well aware of its problems. Edit: actually, the first attack was in march 06 -- 3 months before the standard was published: http://www.math.ntnu.no/~kristiag/drafts/dual-ec-drbg-commen...
I should have said calling into question the insanity, will edit.
Earlier quoted context omitted.
Let me just say that when my brain tries to survey the landscape for products that use crypto, it mentally discounts all the SecurID tokens; it doesn't occur to me to think about the RSA in-house products that use BSAFE. So yes, there's another group of deployed products that use commercial crypto libraries, because they're sold by a company that also owns a commercial crypto library. My reasoning about this mostly c…
Oh man, you DELETED your comment! I was replying and lost it, so it will be reproduced here due to quoting, as it is important to me that your backpedal of the century be committed to the historical record. -- First off, my comment wasn't out of spite or anything. I would call it a friendly jab. I'm guilty of reaching temporary frustration in some previous discussions with you over civil liberties and privacy, which…
I have no idea what the "100% undetectable rootkit" thing is about; if you're referring to the talk me, Nate Lawson, and Peter Ferrie did about Joanna Rutkowska's "Blue Pill", our talk made the exact opposite claim --- that virtualization did not make rootkits undetectable.
Look: you don't offend me. I do not mind if you think I'm wrong about stuff. I'm just frustrated because I like Matthew Green's blog, and your comment hijacked the thread. I'm sure you didn't mean it to, but it was obvious to me that it would.